Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Dec. 31, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk Management and Strategy The Company’s operations rely on the secure processing, storage, and transmission of confidential and personal identifiable information within various technology platforms. Cybersecurity is a high priority and the Company has made significant investments in its processes and programs designed to prevent, detect, and respond to and recover from cybersecurity threats. We also have processes in place to help ensure compliance with our information security program with respect to our use of third-party service providers, including review of vendor certifications, execution of appropriate data protection agreements, and contractual security requirements. The Company is actively maturing its third-party risk management program to establish risk-based vendor tiering, due diligence standards, and ongoing monitoring controls for vendors. The Company’s cybersecurity program is structured around the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”), which guides our approach to identifying, protecting, detecting, responding to, and recovering from cybersecurity risks. The Company maintains an active cybersecurity roadmap aligned to NIST CSF to continuously mature its security posture and address identified risks. Such processes and programs are a part of the Company’s overall risk management and compliance programs. The Company continues to enhance its intrusion protection and detection technology, infrastructure and application firewalls, and network monitoring. The Company has also installed advanced endpoint threat protection technology and implemented a mandatory security awareness training program for all employees. The Company enforces multi-factor authentication and least-privilege access principles across critical systems. The Company has identified its current network architecture as an area of elevated risk and is actively executing a cybersecurity roadmap, aligned to the NIST CSF, to transition to a segmented, enterprise-grade network infrastructure. This initiative includes the replacement of end-of-life network equipment and the implementation of network segmentation controls to reduce lateral movement risk. This training is reinforced through periodic simulated phishing tests to assess our employees’ responses to suspicious emails. The Company maintains backup and recovery capabilities designed to help enable us to resume business in the event of a disaster or cybersecurity incident. The Company has identified resilience and recovery as a key area of focus within its cybersecurity roadmap and is actively working toward implementing cloud-enabled Business Continuity and Disaster Recovery (“BCDR”) with validated, tested recovery objectives designed to meet applicable BCDR compliance requirements. Through recurring internal audits, controls are regularly reviewed, tested, and enhanced to promote best practices. The Company recognizes ransomware and software supply chain compromises as significant threat vectors and is implementing controls including vendor integrity validation, and rapid isolation protocols as part of its evolving incident response capabilities. The Company has augmented our information security program through a partnership with a leading global cybersecurity service provider to review and implement additional services such as Security Event Monitoring, Advanced Endpoint Threat Detection, Incident Management Retainer Services, and Strategic Advisory Services focused on Chief Information Officer (“CIO”) duties such as counter-threat intelligence. Our information security program also includes a cybersecurity Incident Response Plan (“IRP”) that is designed to help protect the integrity, availability and confidentiality of information, prevent loss of service, and comply with legal requirements. The IRP specifies the process for identifying and reporting an incident, initial investigation, risk classification, documentation and communication of incidents, responder procedures, incident reporting, and ongoing training. The IRP also includes processes for determining the materiality of the incident, including the assessment of relevant qualitative and quantitative factors. Upon identifying a potential cybersecurity incident, the Company follows a structured assessment process to determine materiality and, where applicable, fulfill its obligation to disclose such incident in accordance with SEC rules. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our board of directors, third-party advisors and other stakeholders. The Company also maintains dedicated cyber liability insurance for breach event costs including: post breach event remediation costs; cybercrime coverage (including financial fraud,
telecommunications fraud, and phishing attacks); and coverage for system failure, bricking loss, and physical damage. The policy also provides coverage for lost revenue due to a damaged reputation from a cyber breach. While no cybersecurity incidents have materially affected or are reasonably likely to materially affect our operations to date, there can be no assurance that future incidents will not have a material impact on the Company’s business, financial condition, or results of operations.
|
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] | The Company maintains backup and recovery capabilities designed to help enable us to resume business in the event of a disaster or cybersecurity incident. The Company has identified resilience and recovery as a key area of focus within its cybersecurity roadmap and is actively working toward implementing cloud-enabled Business Continuity and Disaster Recovery (“BCDR”) with validated, tested recovery objectives designed to meet applicable BCDR compliance requirements. Through recurring internal audits, controls are regularly reviewed, tested, and enhanced to promote best practices. The Company recognizes ransomware and software supply chain compromises as significant threat vectors and is implementing controls including vendor integrity validation, and rapid isolation protocols as part of its evolving incident response capabilities. The Company has augmented our information security program through a partnership with a leading global cybersecurity service provider to review and implement additional services such as Security Event Monitoring, Advanced Endpoint Threat Detection, Incident Management Retainer Services, and Strategic Advisory Services focused on Chief Information Officer (“CIO”) duties such as counter-threat intelligence. Our information security program also includes a cybersecurity Incident Response Plan (“IRP”) that is designed to help protect the integrity, availability and confidentiality of information, prevent loss of service, and comply with legal requirements. The IRP specifies the process for identifying and reporting an incident, initial investigation, risk classification, documentation and communication of incidents, responder procedures, incident reporting, and ongoing training. The IRP also includes processes for determining the materiality of the incident, including the assessment of relevant qualitative and quantitative factors. Upon identifying a potential cybersecurity incident, the Company follows a structured assessment process to determine materiality and, where applicable, fulfill its obligation to disclose such incident in accordance with SEC rules. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our board of directors, third-party advisors and other stakeholders. The Company also maintains dedicated cyber liability insurance for breach event costs including: post breach event remediation costs; cybercrime coverage (including financial fraud,
telecommunications fraud, and phishing attacks); and coverage for system failure, bricking loss, and physical damage. The policy also provides coverage for lost revenue due to a damaged reputation from a cyber breach.
|
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Our information security program also includes a cybersecurity Incident Response Plan (“IRP”) that is designed to help protect the integrity, availability and confidentiality of information, prevent loss of service, and comply with legal requirements. The IRP specifies the process for identifying and reporting an incident, initial investigation, risk classification, documentation and communication of incidents, responder procedures, incident reporting, and ongoing training. The IRP also includes processes for determining the materiality of the incident, including the assessment of relevant qualitative and quantitative factors. Upon identifying a potential cybersecurity incident, the Company follows a structured assessment process to determine materiality and, where applicable, fulfill its obligation to disclose such incident in accordance with SEC rules. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our board of directors, third-party advisors and other stakeholders.
|
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] | While no cybersecurity incidents have materially affected or are reasonably likely to materially affect our operations to date, there can be no assurance that future incidents will not have a material impact on the Company’s business, financial condition, or results of operations.
|
| Cybersecurity Risk Board of Directors Oversight [Text Block] | Our board of directors recognizes the important role of information security and mitigating cybersecurity and other data security threats. Although our full board of directors maintains ultimate responsibility with respect to risk management oversight, our board of directors has delegated oversight of the Company’s information security program and matters of cybersecurity to the Audit Committee of the board of directors. The Audit Committee receives regular briefings from the CIO on the state of the cybersecurity program, emerging threats, and the Company’s risk mitigation progress against its cybersecurity roadmap. The Company’s senior officers, including its CIO, are responsible for the operation of the information security program and regularly communicate with the Audit Committee on the state of the program, risks faced by the Company and the Company’s risk mitigation efforts related thereto. The Company’s CIO, supported by a dedicated information security team, is responsible for the day-to-day management of the information security program and regularly briefs the Audit Committee on cybersecurity risks, program status, and risk mitigation efforts. In addition, the Company’s information technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security. Our data security employees have backgrounds in cybersecurity and data protection, including prior relevant experience in the industry and industry standard certifications.
|
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Although our full board of directors maintains ultimate responsibility with respect to risk management oversight, our board of directors has delegated oversight of the Company’s information security program and matters of cybersecurity to the Audit Committee of the board of directors. |
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The Company’s senior officers, including its CIO, are responsible for the operation of the information security program and regularly communicate with the Audit Committee |
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Company’s senior officers, including its CIO, are responsible for the operation of the information security program and regularly communicate with the Audit Committee on the state of the program, risks faced by the Company and the Company’s risk mitigation efforts related thereto. |
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | In addition, the Company’s information technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security. Our data security employees have backgrounds in cybersecurity and data protection, including prior relevant experience in the industry and industry standard certifications.
|