The cybersecurity risks we face range from cyberattacks common to most industries, such as the development and deployment of malicious software to gain access to our networks and attempt to steal confidential information, launch distributed denial of service attacks, or attempt other coordinated disruptions, to more advanced threats that target us because of our prominence in the global research and advisory field. Given that our employees work remotely, at least some of the time, which magnifies the importance of the integrity of our remote access security measures.
Like many multinational corporations, we, and some third parties upon which we rely, have experienced cyberattacks on our computer systems and networks in the past and may experience them in the future, likely with more frequency and sophistication and involving a broader range of devices and modes of attack, all of which will increase the difficulty of detecting and successfully defending against them. To date, none have resulted in any material adverse impact to our business, operations, products, services, or customers. Wiley has invested heavily in cybersecurity tools and resources to keep our systems safe. We have implemented various security controls to meet our security obligations, while also defending against constantly evolving security threats. Our security controls help to secure our information systems, including our computer systems, intranet, proprietary websites, email and other telecommunications and data networks, and we scrutinize the security of outsourced website(s) and service providers prior to retaining their services. However, the security measures implemented by us or by our outside service providers may not be effective, and our systems (and those of our outside service providers) may be vulnerable to theft, loss, damage and interruption from a number of potential sources and events, including unauthorized access or security breaches, cyberattacks, computer viruses, power loss, or other disruptive events.
The security compliance landscape continues to evolve, requiring us to stay apprised of changes in cybersecurity, privacy laws and regulations, such as the following, but not limited to the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the Brazilian General Data Protection Law (LGPD), the Chinese Cybersecurity, Data Security and Personal Information Protection laws (PIPL). The United Kingdom ceased to be an EU Member State on January 31, 2020, but enacted the UK data protection law. It is unclear how UK data protection laws will continue to develop; however, contractual clauses have been established regulating data transfers to and from the United Kingdom. Some countries also are considering or have enacted legislation requiring local storage and processing of data that could increase the cost and complexity of delivering our services.
In addition to new and proposed data protection laws, we also stay apprised and adopt certain security standards required by our clients, such as International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST) and Center for Internet Security (CIS). Recent well-publicized security breaches at other companies have led to enhanced government and regulatory scrutiny of the measures taken by companies to protect against cyberattacks and may in the future result in heightened cybersecurity requirements, including additional regulatory expectations for oversight of vendors and service providers.
A cyberattack could cause delays in initiating or completing sales, impede delivery of our products and services to our clients, disrupt other critical client-facing or business processes, or dislocate our critical internal functions. Additionally, any material breaches or other technology-related catastrophe, or media reports of perceived security vulnerabilities to our systems or those of our third parties, even if no breach has been attempted or has occurred, could cause us to experience reputational harm, loss of customers and revenue, fines, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard our customers information, or financial losses that are either not insured against or not fully covered through any insurance maintained by us.
For more information regarding our process for identifying, assessing and managing material risks from cybersecurity threats, refer to Item 1C. Cybersecurity.