Item 1A. Risk Factors
ITEM 1A. RISK FACTORS (CONTINUED)
Cyber Security
We are highly dependent on information technology systems to operate our business. A breakdown, invasion, corruption, destruction or interruption of critical information technology systems by employees, others with authorized access to our systems or unauthorized persons could negatively impact operations. In the ordinary course of business, we collect, store and transmit confidential information and it is critical that we do so in a secure manner to maintain the confidentiality and integrity of such information. Additionally, we outsource certain elements of our information technology systems to third parties. As a result of this outsourcing, our third party vendors may or could have access to our confidential information making such systems vulnerable. Data breaches of our information technology systems, or those of our third party vendors, may pose a risk that sensitive data may be exposed to unauthorized persons or to the public.
We have experienced cybersecurity events and disruptions such as viruses and attacks targeting our information technology systems. Such prior events have not had a material impact on our financial condition, results of operations or liquidity. However, future threats could have a materially adverse impact on our company by, among other things, causing harm to our business, financial condition, results of operations or reputation; disrupting our operations; exposing us to potential liability, regulatory actions and loss of business; and challenging our eligibility for future work on sensitive systems. Due to the evolving nature of these security threats, the potential impact of any future incident cannot be predicted. Our insurance coverage may not be adequate to cover all the costs related to cybersecurity attacks or disruptions resulting from such events.
While we believe that we have taken appropriate security measures to protect our data and information technology systems and have been informed by our third party vendors that they have as well, there can be no assurance that our efforts will prevent breakdowns or breaches in our systems, or those of our third party vendors, that could adversely affect our business.
Environmental Matters and Climate Change
The Company and many of its customers are subject to regulation by federal, state and international environmental laws, including those relating to climate change, that are subject to rapid change, which could result in regulatory uncertainty as well as potential significant increases in compliance costs. There can be no assurance that the steps we take to abide by applicable requirements will meet all current and future regulatory. Any failures to do so could result in governmental enforcement actions, fines, and other penalties, or other liabilities, that could adversely affect our business.
Data Privacy
We control, process, or have access to personal information regarding our own employees or employment candidates, as well as that of many of our customers or other third parties. Information concerning these individuals may also reside in systems controlled by third party vendors with whom we do business. The legal and regulatory environment concerning data privacy is becoming more complex and challenging, and the potential consequences of non-compliance have become more severe. The European Union’s General Data Protection Regulation, the California Consumer Privacy Act, the Health Insurance Portability and Accountability Act of 1996 and similar laws impose additional compliance requirements related to the collection, use, processing, transfer, disclosure, and retention of personal information, which can increase operating costs and resources to accomplish. Any failure to abide by these regulations or to protect such personal information from inappropriate access or disclosure, whether through social engineering or by accident or other cause, could have severe consequences including fines, litigation, regulatory sanctions, reputational damage, and loss of customers or employees. There can be no assurance that the steps we take to abide by applicable requirements and protect information will meet all current and future regulatory requirements, anticipate all potential methods of unauthorized access, or prevent all inappropriate disclosures. Any failures to do so could result in governmental enforcement actions, fines, and other penalties, or other liabilities, that could adversely affect our business.
20