Cybersecurity Risk Management and Strategy Disclosure	12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]	As part of our ERM program, we conduct an annual evaluation of cybersecurity risks and share the results with management and the A&FC. The CISO and internal subject-matter experts review scenarios, such as data theft, cash theft, widespread outages, and business disruptions, and the potential consequences. We maintain a continuous monitoring program to detect and respond to potential threats in near real time. Log data from technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events and analyzes them. If the SIEM identifies a potential security event, it can direct controls to stop the activity and generate alerts for detection and response. Alerts are monitored by a managed security service provider that augments our dedicated internal Security Operations Center team. Third‑Party Risk Management We operate a third‑party risk management (TPRM) program to identify, assess, monitor, and mitigate risks associated with third‑party relationships, including cybersecurity risks. The TPRM program is designed to help confirm that appropriate controls and measures are in place to manage potential risks and vulnerabilities associated with third parties. Our policies and procedures govern the lifecycle from initial due diligence, selection, and contracting through oversight and termination, and include provisions to address security incident notification and cooperation when appropriate. Audit and Third-party Assessments Our Internal Audit organization conducts audits across our information technology and operational technology environments to evaluate compliance with information security policies and standards. Process control network assurance audits are conducted on a risk‑based rotating schedule, providing coverage across each major operational business area at intervals no greater than five years. We also engage external cybersecurity experts to conduct assessments, penetration testing, and cybersecurity maturity assessments. Incident Response Our ECIRP provides a documented framework for responding to cybersecurity incidents, including investigating, containing, documenting, and mitigating incidents, with defined reporting to senior management and other key stakeholders and escalation to the Board, when appropriate. Materiality and Disclosure Practices We have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past; however, we do not believe that any of these events or incidents, individually, or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect. Our procedures include defined processes for prompt escalation of potentially material cybersecurity incidents to our management for materiality assessment and, if required, public disclosure in accordance with applicable securities laws and regulations. For additional information concerning cybersecurity risks, see “Item 1A. Risk Factors.”
Cybersecurity Risk Management Processes Integrated [Flag]	true
Cybersecurity Risk Management Processes Integrated [Text Block]	We maintain a continuous monitoring program to detect and respond to potential threats in near real time. Log data from technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events and analyzes them. If the SIEM identifies a potential security event, it can direct controls to stop the activity and generate alerts for detection and response. Alerts are monitored by a managed security service provider that augments our dedicated internal Security Operations Center team.
Cybersecurity Risk Management Third Party Engaged [Flag]	true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]	true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]	false
Cybersecurity Risk Board of Directors Oversight [Text Block]	Board of Directors The Audit and Finance Committee (A&FC) of the Board of Directors oversees the company’s Enterprise Risk Management (ERM) program, including the processes that management uses to assess, identify, and manage risks associated with cybersecurity and information technology. The A&FC receives written reports and periodic briefings from the Chief Information Security Officer (CISO) that address topics such as the results of vulnerability assessments, independent external reviews, changes to the threat environment, technology trends, and benchmarking. The A&FC provides regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management’s response to cyber-related incidents and escalation protocols, including, reporting to the Board of Directors when appropriate.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]	The Audit and Finance Committee (A&FC) of the Board of Directors oversees the company’s Enterprise Risk Management (ERM) program, including the processes that management uses to assess, identify, and manage risks associated with cybersecurity and information technology.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]	The A&FC receives written reports and periodic briefings from the Chief Information Security Officer (CISO) that address topics such as the results of vulnerability assessments, independent external reviews, changes to the threat environment, technology trends, and benchmarking. The A&FC provides regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management’s response to cyber-related incidents and escalation protocols, including, reporting to the Board of Directors when appropriate.
Cybersecurity Risk Role of Management [Text Block]	. Personnel reporting to the CISO have relevant educational and industry experience in threat hunting and intelligence, digital standards, data privacy, cyber training, and security operations center management. In addition to internal capabilities, we regularly engage consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks. The CISO receives ongoing reporting on cybersecurity threats and, together with management, regularly reviews risk management measures to identify, assess, and mitigate data protection and cybersecurity risks. The CISO also works closely with the company’s Senior Counsel, Brand, Cyber & Privacy, to oversee compliance with legal, regulatory, and contractual security requirements, and coordinates with our executive leadership, as well as other leaders from our legal and finance organizations to support timely materiality assessments and, where required, public disclosure.
Cybersecurity Risk Management Positions or Committees Responsible [Flag]	true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]	The A&FC receives written reports and periodic briefings from the Chief Information Security Officer (CISO) that address topics such as the results of vulnerability assessments, independent external reviews, changes to the threat environment, technology trends, and benchmarking. The A&FC provides regular reports to the Board of Directors on data protection and cybersecurity matters.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]	The CISO has extensive cybersecurity knowledge and skills gained through company experience and prior law enforcement service, supported by advanced professional certifications.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]	The A&FC receives written reports and periodic briefings from the Chief Information Security Officer (CISO) that address topics such as the results of vulnerability assessments, independent external reviews, changes to the threat environment, technology trends, and benchmarking. The A&FC provides regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management’s response to cyber-related incidents and escalation protocols, including, reporting to the Board of Directors when appropriate.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]	true

Cybersecurity Risk Management and Strategy Disclosure

12 Months Ended

Dec. 31, 2025

Cybersecurity Risk Management, Strategy, and Governance [Line Items]

Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

As part of our ERM program, we conduct an annual evaluation of cybersecurity risks and share the results with management and the A&FC. The CISO and internal subject-matter experts review scenarios, such as data theft, cash theft, widespread outages, and business disruptions, and the potential consequences. We maintain a continuous monitoring program to detect and respond to potential threats in near real time. Log data from technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events and analyzes them. If the SIEM identifies a potential security event, it can direct controls to stop the activity and generate alerts for detection and response. Alerts are monitored by a managed security service provider that augments our dedicated internal Security Operations Center team.

Third‑Party Risk Management

We operate a third‑party risk management (TPRM) program to identify, assess, monitor, and mitigate risks associated with third‑party relationships, including cybersecurity risks. The TPRM program is designed to help confirm that appropriate controls and measures are in place to manage potential risks and vulnerabilities associated with third parties.

Our policies and procedures govern the lifecycle from initial due diligence, selection, and contracting through oversight and termination, and include provisions to address security incident notification and cooperation when appropriate.

Audit and Third-party Assessments

Our Internal Audit organization conducts audits across our information technology and operational technology environments to evaluate compliance with information security policies and standards. Process control network assurance audits are conducted on a risk‑based rotating schedule, providing coverage across each major operational business area at intervals no greater than five years. We also engage external cybersecurity experts to conduct assessments, penetration testing, and cybersecurity maturity assessments.

Incident Response

Our ECIRP provides a documented framework for responding to cybersecurity incidents, including investigating, containing, documenting, and mitigating incidents, with defined reporting to senior management and other key stakeholders and escalation to the Board, when appropriate.

Materiality and Disclosure Practices

We have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past; however, we do not believe that any of these events or incidents, individually, or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect. Our procedures include defined processes for prompt escalation of potentially material cybersecurity incidents to our management for materiality assessment and, if required, public disclosure in accordance with applicable securities laws and regulations. For additional information concerning cybersecurity risks, see “Item 1A. Risk Factors.”

Cybersecurity Risk Management Processes Integrated [Flag]

true

Cybersecurity Risk Management Processes Integrated [Text Block]

We maintain a continuous monitoring program to detect and respond to potential threats in near real time. Log data from technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events and analyzes them. If the SIEM identifies a potential security event, it can direct controls to stop the activity and generate alerts for detection and response. Alerts are monitored by a managed security service provider that augments our dedicated internal Security Operations Center team.

Cybersecurity Risk Management Third Party Engaged [Flag]

true

Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]

true

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]

false

Cybersecurity Risk Board of Directors Oversight [Text Block]

Board of Directors

The Audit and Finance Committee (A&FC) of the Board of Directors oversees the company’s Enterprise Risk Management (ERM) program, including the processes that management uses to assess, identify, and manage risks associated with cybersecurity and information technology. The A&FC receives written reports and periodic briefings from the Chief Information Security Officer (CISO) that address topics such as the results of vulnerability assessments, independent external reviews, changes to the threat environment, technology trends, and benchmarking. The A&FC provides regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management’s response to cyber-related incidents and escalation protocols, including, reporting to the Board of Directors when appropriate.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

The A&FC receives written reports and periodic briefings from the Chief Information Security Officer (CISO) that address topics such as the results of vulnerability assessments, independent external reviews, changes to the threat environment, technology trends, and benchmarking. The A&FC provides regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management’s response to cyber-related incidents and escalation protocols, including, reporting to the Board of Directors when appropriate.

Cybersecurity Risk Role of Management [Text Block]

. Personnel reporting to the CISO have relevant educational and industry experience in threat hunting and intelligence, digital standards, data privacy, cyber training, and security operations center management. In addition to internal capabilities, we regularly engage consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks. The CISO receives ongoing reporting on cybersecurity threats and, together with management, regularly reviews risk management measures to identify, assess, and mitigate data protection and cybersecurity risks. The CISO also works closely with the company’s Senior Counsel, Brand, Cyber & Privacy, to oversee compliance with legal, regulatory, and contractual security requirements, and coordinates with our executive leadership, as well as other leaders from our legal and finance organizations to support timely materiality assessments and, where required, public disclosure.

Cybersecurity Risk Management Positions or Committees Responsible [Flag]

true

Cybersecurity Risk Management Positions or Committees Responsible [Text Block]

Cybersecurity Risk Management Expertise of Management Responsible [Text Block]

The CISO has extensive cybersecurity knowledge and skills gained through company experience and prior law enforcement service, supported by advanced professional certifications.

Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]

true