XML 369 R32.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
ICL’s global cybersecurity strategy has been designed based on industry standards, such as the NIST Cybersecurity Framework, and resides on three fundamental pillars: (a) plants and operational security, (b) critical assets & data protection, and (c) fraud prevention. These pillars provide a framework for assessing cybersecurity risk and identifying and managing cybersecurity threats and incidents, including threats and incidents associated with ICL’s use of services, applications and products provided by third-party vendors and service providers. Although we conduct third-party examination, onboarding, and other procedures designed to assess the data privacy and cybersecurity practices of third-party vendors and service providers (including risk assessments and contractual protections), our ability to monitor or control the data privacy and cybersecurity practices of third parties is limited and there can be no assurance that we can detect, prevent, mitigate, or remediate the risk of any weakness, compromise or failure in the information systems, software, networks and other assets owned or controlled by our third-party vendors and service providers. When we do become aware that a third-party vendor or service provider has experienced any compromise or failure, we attempt to mitigate our risk, including by terminating such third party’s connection to our information systems and networks where appropriate.
 
As cyberattacks evolve and become more sophisticated, ICL has had to strengthen its overall resilience, including its prevention, monitoring, mitigation, and remediation efforts. As part of such efforts, ICL routinely reviews, reinforces, and tests its cybersecurity processes and procedures, including its Cyber business continuity plans, through exercises in the areas of cybersecurity.
 
The outcome of such exercises is an important part of a feedback process designed to improve ICL’s cybersecurity posture and culture and raise the level of cybersecurity awareness and preparedness of certain key personnel. ICL also retains cybersecurity intelligence services, as well as the services of a security operations center that operates 24 hours a day, as part of our incident management process. We also conduct internal and third-party risk assessments of our information systems and networks in cooperation with several leading Israeli and international companies in the field of cybersecurity. As part of our ongoing efforts to strengthen our cybersecurity defenses, in 2019, we began conducting regular Cyber Maturity surveys approximately every 18 months in cooperation with a leading international consulting firm, the last survey taking place in 2024. In addition, we conduct regular penetration tests, the last of which also took place in 2024. ICL is also part of the critical national infrastructure of Israel, and as such, we continuously monitor communications from and cooperate with Israel’s National Cyber Emergency Response Team (“National CERT”), which is part of (the Israel National Cyber Directorate), as well as Israel’s Ministry of Energy and Ministry of Environmental Protection for the purpose of protecting our two critical plants from a variety of risks, including cybersecurity risks. Our Internal Auditor also performs several audits each year on our cybersecurity programs compliance with ICL’s policies and regulations in the field of cybersecurity. Other lines of action also include our management undergoing periodic training and practical drills in cybersecurity approximately every 18 months. These exercises are designed to simulate real-world cyberattacks, allowing our management to enhance their skills and preparedness in handling potential threats.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] ICL’s global cybersecurity strategy has been designed based on industry standards, such as the NIST Cybersecurity Framework, and resides on three fundamental pillars: (a) plants and operational security, (b) critical assets & data protection, and (c) fraud prevention. These pillars provide a framework for assessing cybersecurity risk and identifying and managing cybersecurity threats and incidents, including threats and incidents associated with ICL’s use of services, applications and products provided by third-party vendors and service providers.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] Despite our efforts and investment in many resources over the years to improve the reliability of our cybersecurity programs and to prevent cybersecurity incidents, complete protection in the field of cybersecurity cannot be guaranteed and we can make no assurances that we have not experienced an undetected cybersecurity incident, including an incident that may have been material. For further information on cybersecurity risks, see “Item 3 - Key Information— D. Risk Factors— Significant disruptions in our, or our service providers’, information technology systems or breaches of our, or our service providers’, information security systems could adversely affect our business”.
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our Global IT team handles the operational cybersecurity policies and measures regarding ICL’s global infrastructures, in collaboration with the plants' engineering and control units. In an effort to effectively prevent, detect, and respond to cybersecurity threats and incidents, the Global IT team employs a multi-layered cybersecurity risk management program supervised by our Vice President Chief Information Security Officer (“CISO”), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, and processes. Such responsibilities include identifying, considering and assessing material cybersecurity threats and incidents on an ongoing basis, establishing processes designed to detect, prevent and monitor potential cybersecurity risks, implementing mitigation and remedial measures, and maintaining our cybersecurity programs. Our CISO has served in the role of CISO for over 5 years and has significant expertise in cybersecurity technology, including serving in key leadership positions, such as Head of the National CERT and Chief Executive Officer of a cyber strategic consulting company. As part of ICL’s incident response processes, our CISO has a direct line of communication with our Chief Executive Officer and provides updates on certain cybersecurity threats and incidents and as required, the Board of Directors, based on our management’s assessment of risk.
 
As part of its oversight responsibilities, the Board of Directors receives annual updates on our cybersecurity practices as well as technology, cybersecurity and information security risks from our CISO. These annual updates include topics related to cybersecurity, data privacy, and risk management processes, such as third-party assessments of our cybersecurity programs, updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments.
 
Cybersecurity risk management is an integral part of our overall enterprise risk management program, which is overseen by the Board of Directors. As part of its enterprise risk management efforts, the Board of Directors also meets with senior management, including the CISO, to assess and respond to critical business risks, including those that may arise from cybersecurity threats and incidents. The CISO meets with our Global Executive Committee (GEC) quarterly and the Board of Directors annually to review and discuss our technology, cybersecurity, and information security strategies and approve our technology, cybersecurity, and information security plans.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Global IT team handles the operational cybersecurity policies and measures regarding ICL’s global infrastructures, in collaboration with the plants' engineering and control units. In an effort to effectively prevent, detect, and respond to cybersecurity threats and incidents, the Global IT team employs a multi-layered cybersecurity risk management program supervised by our Vice President Chief Information Security Officer (“CISO”), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, and processes. Such responsibilities include identifying, considering and assessing material cybersecurity threats and incidents on an ongoing basis, establishing processes designed to detect, prevent and monitor potential cybersecurity risks, implementing mitigation and remedial measures, and maintaining our cybersecurity programs.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] As part of ICL’s incident response processes, our CISO has a direct line of communication with our Chief Executive Officer and provides updates on certain cybersecurity threats and incidents and as required, the Board of Directors, based on our management’s assessment of risk.
Cybersecurity Risk Role of Management [Text Block] As part of its enterprise risk management efforts, the Board of Directors also meets with senior management, including the CISO, to assess and respond to critical business risks, including those that may arise from cybersecurity threats and incidents. The CISO meets with our Global Executive Committee (GEC) quarterly and the Board of Directors annually to review and discuss our technology, cybersecurity, and information security strategies and approve our technology, cybersecurity, and information security plans.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] As part of its oversight responsibilities, the Board of Directors receives annual updates on our cybersecurity practices as well as technology, cybersecurity and information security risks from our CISO. These annual updates include topics related to cybersecurity, data privacy, and risk management processes, such as third-party assessments of our cybersecurity programs, updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CISO has served in the role of CISO for over 5 years and has significant expertise in cybersecurity technology, including serving in key leadership positions, such as Head of the National CERT and Chief Executive Officer of a cyber strategic consulting company.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] As part of its enterprise risk management efforts, the Board of Directors also meets with senior management, including the CISO, to assess and respond to critical business risks, including those that may arise from cybersecurity threats and incidents. The CISO meets with our Global Executive Committee (GEC) quarterly and the Board of Directors annually to review and discuss our technology, cybersecurity, and information security strategies and approve our technology, cybersecurity, and information security plans.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true