We rely extensively on information technology ("IT") and operational technology ("OT") systems to conduct business operations, including financial and operational processes, communications, procurement, and the collection and analysis of operational data. These systems support vessel navigation, positioning, propulsion monitoring, maintenance diagnostics, environmental reporting, and coordination with ports and customers. Disruptions or compromises of these systems could impair vessel operations, delay project execution, affect safety and environmental compliance, disrupt customer service, or impair financial and operational reporting.
Our systems may be affected by events beyond our control, such as power outages, natural disasters, catastrophic events, and network failures. They are also subject to evolving cybersecurity threats, including malware, ransomware, phishing, spoofing, unauthorized access attempts, supply chain compromises, data corruption, data exfiltration, denial-of-service attacks, zero-day vulnerabilities, and emerging attack techniques leveraging artificial intelligence. Threat actors may target both corporate IT systems and vessel-based or remote operational environments.
As a federal contractor, we are subject to cybersecurity and information security requirements under applicable federal standards, including those issued by National Institute of Standards and Technology ("NIST") cybersecurity framework and the Cybersecurity Maturity Model Certification framework. In addition, we operate vessels subject to U.S. Coast Guard jurisdiction and are required to comply with maritime cybersecurity regulations applicable to U.S.-flagged vessels, including requirements related to cybersecurity planning, designated accountability, incident reporting, system protection, and capabilities intended to detect, respond to, and recover from cybersecurity incidents affecting maritime operations. We also operate in jurisdictions with differing privacy, data protection, and cybersecurity laws, including cross-border data transfer restrictions such as those under the General Data Protection Regulation. Regulatory requirements and interpretations continue to evolve, and compliance may require operational, technical, and contractual adjustments.
A disruption or failure of our IT or OT systems, whether resulting from operational issues, cybersecurity incidents, regulatory non-compliance, third-party failures, or other causes, could materially adversely affect our operations and business performance. Potential impacts include vessel downtime, project delays, safety incidents, data loss, transaction errors, environmental compliance issues, increased remediation and recovery costs, litigation, penalties, operational restrictions, loss of customers or suppliers, reputational harm, increased insurance costs, and heightened regulatory scrutiny or enforcement actions.