COVENANT LOGISTICS GROUP, INC. 10-Q

ITEM 1A. RISK FACTORS   While we attempt to identify, manage, and mitigate risks and uncertainties associated with our business, some level of risk and uncertainty will always be present. Our Form 10-Q for the quarter ended March 31, 2023 and Form 10-K for the year ended December 31, 2022, in the sections entitled "Item 1A. Risk Factors," describe some of the risks and uncertainties associated with our business. The information presented below supplements such risk factors. We are amending and restating in its entirety the risk factor entitled “We depend on the proper functioning and availability of our management information and communication systems and other information technology assets (including the data contained therein) and a system failure or unavailability, including those caused by cybersecurity breaches, or an inability to effectively upgrade such systems and assets could cause a significant disruption to our business and have a materially adverse effect on our results of operations” from our Form 10-K for the year ended December 31, 2022, as set forth below. The risk factor set forth below should be read in conjunction with the risk factors included in our Form 10-Q for the quarter ended March 31, 2023 and Form 10 K for the year ended December 31, 2022. These risks and uncertainties have the potential to materially affect our business, financial condition, results of operations, cash flows, projected results, and future prospects.   We depend on the proper functioning and availability of our management information and communication systems and other information technology assets (including the data contained therein) and a system failure or unavailability, including those caused by cybersecurity breaches internally or with third parties, or an inability to effectively upgrade such systems and assets could cause a significant disruption to our business and have a materially adverse effect on our results of operations.   We depend heavily on the proper functioning, availability, and security of our management information and communication systems and other information technology assets, including financial reporting and operating systems and the data contained in such systems and assets, in operating our business. Our operating system is critical to understanding customer demands, accepting and planning loads, dispatching equipment and drivers, and billing and collecting for our services. Our financial reporting system is critical to producing accurate and timely financial statements and analyzing business information to help us manage effectively. Furthermore, data privacy laws, which provide data privacy rights for consumers and operational requirements for companies, may result in increased liability and amplified compliance and monitoring costs, any of which could have a material adverse effect on our financial performance and business operations.   Our operations and those of our technology and communications service providers are vulnerable to interruption by natural disasters, such as fires, storms, and floods, which may increase in frequency and severity due to climate change, as well as, power loss, telecommunications failure, cyberattacks, terrorist attacks, Internet failures, computer viruses, and other events beyond our control. More sophisticated and frequent cyberattacks in recent years have also increased security risks associated with information technology systems. We also maintain information security policies to protect our systems, networks, and other information technology assets (and the data contained therein) from cybersecurity breaches and threats, such as hackers, malware, and viruses; however, such policies cannot ensure the protection of our systems, networks, and other information technology assets (and the data contained therein). In addition, remote or flexible work options for our employees could create increased demand for information technology resources and increase the avenues for unauthorized access to sensitive information, phishing, and other cyberattacks. If any of our critical information systems fail or become otherwise unavailable, whether as a result of a system upgrade project or otherwise, we would have to perform the functions manually, which could temporarily impact our ability to dispatch and manage our fleet efficiently, to respond to customers' requests effectively, to maintain billing and other records reliably, and to bill for services and prepare financial statements accurately or in a timely manner. Our business interruption insurance may be inadequate to protect us in the event of an unforeseeable and extreme catastrophe. Any significant system failure, upgrade complication, security breach (including cyberattacks), or other system disruption could interrupt or delay our operations, damage our reputation, cause us to lose customers, or impact our ability to manage our operations and report our financial performance, any of which could have a materially adverse effect on our business. Such risks related to system failure, upgrade complication, security breach (including cyberattacks), or other system disruption may also impact our customers, vendors, third-party capacity providers, and other counterparties, which could result in declines and volatility in customer demand and unavailability of products and services from vendors and third-party capacity providers, any of which could have a materially adverse effect on our business.   In addition, we are currently dependent on a single vendor to support several information technology functions. If the stability or capability of such vendor became compromised and we were forced to migrate such functions to a new platform, it could adversely affect our business, financial condition, and results of operations.   Page 42 Table of Contents