We collect, use, store and transmit sensitive and confidential business information and personal information of our customers, employees, suppliers and others as an ongoing part of our business operations, and we are regularly subject to attempts by attackers to gain unauthorized access to our networks, systems and data, or to obtain, change or destroy confidential information. Cybersecurity attacks continue to become increasingly sophisticated, and threat actors are continuously deploying new techniques, including through the use of artificial intelligence, to attempt to penetrate our network security and misappropriate or compromise our assets or disrupt our systems. In addition, customers may use devices or software that are beyond our control environment to purchase our products, which may provide additional avenues for attackers to gain access to confidential information. Additionally, the security systems of businesses that we acquire could pose additional risks to us, such as those related to the collection, use, maintenance and disclosure of data, or present other cybersecurity vulnerabilities.
Despite our implementation of security measures, if an actual or perceived data security breach occurs, whether as a result of cybersecurity attacks, computer viruses, vandalism, ransomware, human error or otherwise, or if there are perceived vulnerabilities in our systems, the image of our brands and our reputation and credibility could be damaged, and, in some cases, our continued operations may be impaired or restricted. Ongoing and increasing costs to enhance cybersecurity protection and prevent, eliminate or mitigate vulnerabilities are significant. Although we have business continuity plans and other safeguards in place, our operations may be adversely affected by an actual or perceived data security breach. Costs to resolve any litigation or to investigate and remediate any actual or perceived breach could result in significant financial losses and expenses, as well as lost sales, and there is no assurance that our existing cyber liability insurance policies will provide coverage for all losses that may result from a data security breach or that sufficient coverage will continue to be available in the future. For example, the SEC recently adopted rules requiring the disclosure of cybersecurity incidents that we determine to be "material," to be made within four business days of such determination, which can be complex, requiring a number of assumptions based on several factors. It is possible that the SEC may not agree with our determinations, which could result in fines, civil litigation or damage to our reputation.While we continue to evolve and modify our business continuity plans, there can be no assurance in an escalating threat environment that they will be effective in avoiding disruption and business impacts.
As part of our routine operations, we also contract with third party service providers, including cloud service providers, to store, process and transmit personal information of our customers and employees. Although we may contractually require that these providers implement reasonable security measures, we cannot guarantee that a security breach will not occur at their location or within their systems. Breaches of confidential information stored or used by our third party service providers or disruptions in their systems may expose us to the same risks as a breach of our own systems, including negative publicity, potential out-of-pocket costs and adverse effects on our business and customer relationships.
In addition, the regulatory environment governing our use of individually identifiable data is complex, and compliance with new and modified state, federal and international privacy and security laws may require us to modify our operations and/or incur costs to make necessary systems changes and implement new administrative processes, which may include deploying additional personnel and protection technologies, training employees and engaging third party experts and consultants. In addition, because we process and transmit payment card information, we are subject to the payment card industry data security standard and card brand operating rules, which provide for a comprehensive set of rules relating to the retention and/or transmission of payment card information. If we or our third party service providers do not comply with the applicable standards, we may be subject to fines or restrictions on our ability to accept payment cards, which could have a material adverse effect on our operations.