XML 53 R32.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management and Strategy

Our business operations rely upon secure information technology systems for data processing, storage and reporting. As a global energy company based in Israel, we face heightened risks of cybersecurity incidents, and we remain potentially vulnerable to known or unknown threats, which are constantly evolving. Although to date we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition, there can be no assurance that we will not experience such an incident in the future. See “Item 3.D: Key Information - Risk Factors” for additional information about the risks to our business associated with cybersecurity threats.

Our cybersecurity strategy emphasizes detection, analysis and recovery of cybersecurity threats, while increasing our resiliency against cybersecurity incidents and effective management of cybersecurity risks and events.

We adopted internal policies and procedures aimed at enhancing protection of our information system against cybersecurity risks and detecting and managing cybersecurity events. We maintain physical, administrative and technical safeguards of our information systems, and also maintain plans and procedures whose objective is to help us prevent and timely and effectively respond to cybersecurity threats or incidents. We implement our policies and procedures through employee training, software enhancements and improvements and management oversight.

We conduct periodic risk assessments to identify, document and mitigate cybersecurity risks, including penetration tests and risk surveys. These risk assessments are conducted by qualified third party service providers. In addition, employees receive periodic information security training.

Exposure of third-party service providers to our information systems is minimized and made on a “need to know” basis and subject to execution of non-disclosure agreements to protect the confidentiality of our information.

Although we conduct third-party examination and other procedures designed to assess the data privacy and cybersecurity practices of third-party vendors and service providers (including contractual protections), our ability to monitor or control the data privacy and cybersecurity practices of third parties is limited and there can be no assurance that we can detect, prevent, mitigate, or remediate the risk of any weakness, compromise or failure in the information systems, software, networks and other assets owned or controlled by our third-party vendors and service providers. When we do become aware that a third-party vendor or service provider has experienced any compromise or failure, we attempt to mitigate our risk, including by terminating such third party’s connection to our information systems and networks where appropriate.

Governance

Our board of directors has overall responsibility for risk oversight, with its committees assisting the board in performing this function based on their respective areas of expertise. With the assistance of the audit committee, our board of directors oversees our cybersecurity and ensures that we adequately address and mitigate the evolving cybersecurity threats we face. Our management team, including our external Information Technologies service provider, are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our external Information Technologies service provider has over twenty-five years’ experience in information technology systems, structure and support and over ten years’ experience in information security, and are experienced in overseeing implementation, certification and compliance processes of international standards of information security such as ISO27001, TiSAX, etc.

In addition, in the event of a potentially material cybersecurity event, the CEO and Chairman of the Board are notified and briefed, and meetings of the Audit Committee and/or full Board would be held, as appropriate.

As part of its oversight responsibilities, our Audit Committee receives periodic updates from our management and through the internal audit plan on our cybersecurity practices as well as technology, cybersecurity and information security risks.

We engage a third-party consultant to help us assess and identify risks from cybersecurity threats, including the threat of a cybersecurity incident, and to assist us in establishing our cybersecurity defenses and policies and manage our cyber risk assessment program. Our third-party consultant monitors cybersecurity threats to our software.

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] Although to date we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition, there can be no assurance that we will not experience such an incident in the future.
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Board of Directors Oversight [Text Block]

Our board of directors has overall responsibility for risk oversight, with its committees assisting the board in performing this function based on their respective areas of expertise. With the assistance of the audit committee, our board of directors oversees our cybersecurity and ensures that we adequately address and mitigate the evolving cybersecurity threats we face. Our management team, including our external Information Technologies service provider, are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our external Information Technologies service provider has over twenty-five years’ experience in information technology systems, structure and support and over ten years’ experience in information security, and are experienced in overseeing implementation, certification and compliance processes of international standards of information security such as ISO27001, TiSAX, etc.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our management team, including our external Information Technologies service provider, are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our external Information Technologies service provider has over twenty-five years’ experience in information technology systems, structure and support and over ten years’ experience in information security, and are experienced in overseeing implementation, certification and compliance processes of international standards of information security such as ISO27001, TiSAX, etc.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

In addition, in the event of a potentially material cybersecurity event, the CEO and Chairman of the Board are notified and briefed, and meetings of the Audit Committee and/or full Board would be held, as appropriate.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Third Party Engaged [Flag] true