Custom Truck One Source (CTOS) Risk Factors

We depend on the timely and sufficient delivery of finished goods from our suppliers. Disruptions in the supply chains of these manufacturers and dealers, such as pandemic-related plant and production shutdowns, semiconductor chip shortages, labor and equipment shortages, and transportation delays, have impacted and in the future could significantly impact our ability to meet customer demand and generate revenue, which could have a material adverse effect on our business, financial condition and results of operations.

A number of our customers are impacted by government funding of infrastructure projects. Policies of governments attempting to address local deficit or structural economic issues, or a decrease in expected levels of infrastructure spending, could have a material impact on our customers and markets. Any decrease or delay in government funding of infrastructure projects could cause our revenues and profits to decrease.

Companies across industries are facing increasing scrutiny from a variety of stakeholders related to their ESG and sustainability practices. Expectations regarding voluntary ESG initiatives and disclosures and consumer demand for alternative forms of energy may result in increased costs (including, but not limited to increased costs related to compliance, stakeholder engagement, contracting and insurance), changes in demand for certain products, enhanced compliance or disclosure obligations, or other impacts to our business, financial condition, or results of operations. In the past year, we have published our inaugural ESG report, and we may in the future engage in additional voluntary ESG initiatives (such as voluntary disclosures, certifications, or goals, among others) or commitments to improve the ESG profile of our company and/or our products; such initiatives or achievements of such commitments may be costly and may not have the desired effect. For example, expectations around company's management of ESG matters continues to evolve rapidly, in many instances due to factors that are out of our control. In addition, we have and may continue to commit to certain initiatives or goals and we may not ultimately be able to achieve such commitments or goals due to factors that are within or outside of our control. Moreover, actions or statements that we have taken and may take in the future based on expectations, assumptions, methodologies, or third-party information that we currently believe to be reasonable may subsequently be determined to be erroneous, insufficient, unaligned with stakeholder expectations, or be subject to misinterpretation. Certain such expectations, assumptions and methodologies are necessarily uncertain due to the long timelines involved and the varying approaches to identifying, assessing, addressing, and reporting on ESG matters. Our disclosures on these matters, a failure to satisfy evolving stakeholder expectations for ESG practices and reporting, or a failure to meet our commitments or targets on our established timeline may potentially harm our reputation and negatively impact relationships with certain investors and other stakeholders. Even if this is not the case, our current actions may subsequently be determined to be insufficient by various stakeholders, and we may be subject to investor or regulator engagement on our ESG initiatives and disclosures, even if such initiatives are currently voluntary. In addition, various policymakers have adopted, or are considering adopting, requirements for extensive disclosures on climate-related and/or other ESG information, which may require us to incur significant additional costs to comply, including the implementation of significant new internal controls on matters historically not subject to such controls, and impose increased oversight obligations on our management and board. Simultaneously, there are efforts by some stakeholders to reduce companies' efforts on certain ESG-related matters. Both advocates and opponents to certain ESG matters are increasingly resorting to a range of activism forms, including media campaigns and litigation, to advance their perspectives. To the extent we are subject to such activism, it may require us to incur costs or otherwise adversely impact our business. This and other stakeholder expectations will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor. Additionally, many of our business partners and suppliers may be subject to similar expectations, which may augment or create additional risks, including risks that may not be known to us. Certain market participants, including major institutional investors and capital providers, use third-party benchmarks and scores to assess companies' ESG profiles in making investment or voting decisions. Unfavorable ESG ratings could lead to increased negative investor sentiment towards us and/or our industry, which could negatively impact our share price as well as our access to and cost of capital. To the extent ESG matters negatively impact our reputation, it may also impede our ability to compete as effectively to attract and retain employees or customers, which may adversely impact our operations.

The equipment dealership and rental industries are highly competitive and fragmented. Many of the markets in which the Company operates are served by a large number of competitors, ranging from national and multi-regional equipment rental companies to small, independent businesses with a limited number of locations. Some of the Company's competitors may have significantly greater financial, marketing, and other resources than the Company does, and may be able to reduce rental rates or sales prices in the market and erode customer loyalty, which could negatively impact our business. The Company may encounter increased competition from existing competitors or new market entrants in the future, which could have a material adverse effect on the Company's business, financial condition and results of operations.

Our sales order backlog represents future production for which we have written orders from our customers for customized and stock equipment. Orders that comprise our backlog may be subject to change in quantities, delivery, specifications and terms, or cancellation. Our backlog remains strong despite a year-over-year decrease, and may not remain at such levels in the future. Our reported sales order backlog may not be converted to revenue in any particular period and actual revenue from such orders may not equal our backlog. Therefore, our sales order backlog may not be indicative of the level of our future revenues.

Uncertainty and negative trends in general economic conditions in the United States and abroad, including widespread health emergencies, rising inflation and interest rates, the continued conflict between Russia and Ukraine, supply chain disruptions, increases in labor costs, significant tightening of credit markets and commodity price volatility, may create difficult operating environments for our lessees and also for our industry. Many factors, including factors that are beyond our control, may impact our operating results or financial condition and/or affect the lessees that form our customer base. A number of governments have implemented, or are considering implementing, a broad variety of governmental actions or new regulations for the financial markets. In addition, limitations on the availability of capital, higher costs of capital or financing expenditures or the desire to preserve liquidity, may cause our current or prospective customers to make reductions in future capital budgets and spending.

There are inherent climate-related risks wherever business is conducted. Various meteorological phenomena and extreme weather events (including, but not limited to, storms, flooding, drought, wildfire, and extreme temperatures) may disrupt our operations or those of our customers and suppliers, require us to incur additional operating or capital expenditures, reduce the demand for certain of our product offerings, or otherwise adversely impact our business, financial condition, or results of operations. Climate change may impact the frequency and/or intensity of such events. While we may take various actions to mitigate our business risks associated with climate change, this may require us to incur substantial costs and may not be successful, due to, among other things, the uncertainty associated with the longer-term projections associated with managing climate risks. Additionally, regulatory, market, and other changes to respond to climate change may adversely impact our business, financial condition, or results of operations. Developing alternatives that satisfy the market's evolving expectations of vehicle emissions profiles may require us to incur significant costs. Additionally, there are several competing alternatives to replace petroleum-based fuels for vehicles, including but not limited to: electricity, hydrogen, and compressed and/or renewable gas. To the extent potential customers prefer technologies different from those used in the vehicles we develop and manufacture, then demand for such vehicles may not develop as quickly as we expect, or at all. Reporting expectations are also increasing, with a variety of customers, capital providers, and regulators seeking increased information on climate related risks. For example, the SEC has proposed a rule that, if finalized, may require us to incur significant costs to assess and disclose on a range of climate-related data and risks. Increased scrutiny from various parties may also result in increased compliance costs and increased legal risks may also impact our suppliers or customers, which may indirectly impact our business, financial condition, or results of operations.

The security and integrity, or the perception thereof, of our information technology systems and assets ("IT systems") are critical to our business and ability to monitor and control our operations, deliver our products and services, and adjust to changing market conditions. While we own and manage certain of our IT systems, we also engage third parties across an array of software, systems and technologies (including cloud-based) and functions (e.g., HR, finance, communications, compliance), which enable us to conduct, monitor and/or protect our business, operations, systems and data assets. In addition, in the ordinary course of business, we and/or our service providers generate, collect, process and store sensitive information and data, including intellectual property, our proprietary business data and that of our customers, suppliers and business partners, as well as personal information (collectively, "Confidential Information"). We face evolving cybersecurity risks that threaten the confidentiality, integrity, and availability of our IT systems and Confidential Information, and we and our service providers have experienced and expect to continue to experience cyberattacks and security incidents. Despite various security controls and measures, we and third parties remain vulnerable to cyberattacks and security incidents resulting from malware (e.g., ransomware), computer viruses, software and hardware vulnerabilities, malfeasance by external or internal actors (including state-sponsored organizations, opportunistic hackers and hacktivists, and insider data misappropriation), and/or incidents attributable to human error (e.g., due to social engineering or phishing), as well as malicious code embedded in open-source software, or misconfigurations, "bugs" or other vulnerabilities in commercial software that is integrated into our (or our third parties') IT systems, products or services. The White House, SEC and other regulators have accordingly increased their focus on companies' cybersecurity vulnerabilities and risks. We have also observed a global increase, in both frequency and impact, in cybersecurity threats and more sophisticated cyber-attacks and threat actors. Such attacks and threats are unpredictable as to their timing, nature and scope. As a result, we may be unable to anticipate or prevent future attacks, particularly as the methodologies utilized by attackers change frequently or are not recognized until launched, and we may be unable to identify, investigate or remediate incidents due to the increased use by threat actors of tools and techniques-including artificial intelligence- that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. There can also be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT systems and Confidential Information. Cybersecurity risks due to work-from-home arrangements at the Company and third parties have increased due to the challenges associated with managing remote computing assets and the security vulnerabilities in many non-corporate and home networks. Any successful or perceived cyberattack, compromise, breach, or disruption involving, or in relation to, our or our service providers' IT systems or Confidential Information, or the failure of any IT systems to operate as expected could, depending on the magnitude of the problem, adversely affect our operating results by limiting our capacity to effectively monitor and control our operations, adjust to changing market conditions and maintain the effectiveness of our internal control over financial reporting. Further, any compromise or breach of IT systems or Confidential Information could result in adverse publicity, harm our reputation, lead to claims against us and affect our relationships with our customers and employees, and require significant resources for remediation and compliance purposes, any of which could have a material adverse effect on our business. Certain of our software applications are also utilized by third parties who provide outsourced administrative functions, which may increase the risk of a cybersecurity incident. In addition, because our systems may contain sensitive data and information about individuals and businesses, our failure to maintain the security, integrity or confidentiality of the data we hold, whether the result of our insider malfeasance or errors or the malfeasance or errors of others, could harm our reputation or give rise to legal liabilities leading to lower revenues, increased costs for compliance and systems remediation, increased costs of liability for litigation (including class actions) and regulatory proceedings as well as fines and penalties, result in the misuse of our systems and networks, manipulation and destruction of data, misappropriation of assets or production stoppages and supply shortages, and other potential material adverse effects on our results of operations. Our failure to appropriately maintain the security of the data we hold could also violate applicable privacy, data security and other laws and subject us to lawsuits, fines, and other means of regulatory enforcement. Global consumer protection, data privacy and cybersecurity rules, regulations and industry standards are rapidly evolving, including laws like the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), which provide for a private right of action for certain types of data breaches and create compliance obligations around user choice, data subject rights and transparency, among others. The requirements of such laws and regulations, as well as their application and interpretation, are constantly evolving and developing. Complying with such new or changing legal and regulatory requirements could force us to incur substantial expenses or require us to change our business practices in a manner that could harm our business. If any actual or perceived security or disruptive attacks, breaches or incidents are not detected or deflected by our current security measures,we could also be required to expend additional capital and other resources, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants. Although we maintain insurance coverage for various cybersecurity risks and liabilities, there can be no guarantee that any or all costs or losses incurred will be partially or fully insured.