We rely on our information technology systems, some of which are managed by third parties, to support, manage and maintain the day-to-day operations and activities of our business, including our manufacturing plants, customer and vendor transactions, and financial, accounting, and business records. In addition, we collect and store certain data, including proprietary business information, and may have access to confidential or personal information that is subject to privacy and security laws and regulations.
The secure processing, storage, and transmission of sensitive, confidential, and personal data is critical to our operations and business strategy. We have instituted a system of security policies, procedures, capabilities, internal controls and audits aligned with our ISO 27001 certification, designed to protect this information. Additionally, we engage third-party threat detection, penetration testing, and monitoring services which includes a global cybersecurity incident response team. Despite our security architecture and controls, and those of our third-party providers, we may be vulnerable to cyber-attacks, computer viruses, security breaches, ransomware attacks, inadvertent or intentional employee actions, system failures, and other risks that could potentially lead to the compromising of sensitive, confidential or personal data, improper use of our, or our third-party provider systems, solutions or networks, unauthorized access, use, disclosure, modification or destruction of information, and operational disruptions. Further, the widespread availability, adoption and rapid evolution of artificial intelligence ("AI") technologies may increase our cybersecurity risk, including the use of generative artificial intelligence to augment existing or to create new malware, and additional vulnerabilities may be introduced from the use of artificial intelligence by our customers or third parties. We also maintain an information security risk insurance policy to help mitigate the financial consequences of these risks, however, there is no guarantee that such a policy will be sufficient to address such costs. In addition, the global regulatory environment pertaining to information security and privacy is increasingly complex, with new and changing requirements, such as the European Union's General Data Protection Regulation ("GDPR"), California Consumer Privacy Act ("CCPA"), and the China Cybersecurity Law and Personal Information Protection Law. GDPR, which applies to the collection, use, retention, security, processing, and transfer of personally identifiable information of residents of EU countries, mandates new compliance obligations and imposes significant fines and sanctions for violations. CCPA requires companies to provide new data disclosure, access, deletion, and opt-out rights to consumers in California. Implementing and complying with these laws and regulations may be more costly or take longer than we anticipate, or could otherwise affect our business operations. Information security breaches, cyber incidents, and disruptions, or failure to comply with laws and regulations related to information security or privacy, could result in legal claims or proceedings against us by governmental entities or individuals, significant fines, penalties or judgements, disruption of our operations, remediation requirements, changes to our business practices, and damage to our reputation, which could adversely affect our business, financial condition or results of operations.