Item 1A. Risk Factors
ITEM 1A. RISK FACTORS
In addition to the other information set forth in this Quarterly Report, you should carefully consider the factors discussed under “Risk Factors” in the Company’s Annual Report on Form 10-K for the year ended December 31, 2022 as filed with the SEC. These risks could materially and adversely affect the business, financial condition and results of operations of CBIZ.
Cyber-attacks or other security breaches involving our computer systems or the systems of one or more of our vendors could materially and adversely affect our business.
Our systems, like others in the industries we serve, are vulnerable to cyber security risks, and we are subject to potential disruption caused by such activities. Corporations such as ours are subject to frequent attacks on their systems, such as computer hacking, phishing attempts, cyber-attacks, malware and ransomware attacks. The attacks may have various goals, from seeking confidential information to causing operational disruption. If a ransomware attack or other cybersecurity breach occurs, either internally or at our information technology vendors, it is possible we could be prevented from accessing our data, cause us to incur remediation costs or requires us to pay ransom to the attackers. Although to date such activities have not resulted in material disruptions to our operations or, to our knowledge, a material breach of any security or confidential information, no assurance can be provided that such material disruptions or a material breach will not occur in the future. Any significant violations of data privacy could result in the loss of business, litigation, regulatory investigations, penalties, ransom payments, ongoing expenses related to client credit monitoring and support, and other expenses, any of which could damage our reputation and adversely affect the growth of our business. While we have deployed resources that are responsible for maintaining appropriate levels of cyber security, and while we utilize third-party technology products and services to help identify, protect, and remediate our information technology systems and infrastructure against security breaches and cyber-incidents, our responsive and precautionary measures may not be adequate or effective to prevent, identify, or mitigate attacks by hackers, foreign governments, or other actors or breaches caused by employee error, malfeasance, or other disruptions. We are also dependent on security measures that some of our third-party vendors and customers are taking to protect their own systems and infrastructures. If our third-party vendors do not maintain adequate security measures, do not require their subcontractors to maintain adequate security measures, do not perform as anticipated and in accordance with contractual requirements, or become targets of cyber-attacks, we may experience operational difficulties and increased costs, which could materially and adversely affect our business.
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.