Table of Contents

4.Providers as a Business (“PaaB”):  Historically, ISG had targeted traditional service providers for these typesTable of services which included a combination of consulting and research solutions.  These services include market intelligence, client retention programs, pursuit effectiveness, satisfaction benchmarking, go-to-market consulting and health checks. The Alsbridge acquisition brought additional capabilities which include provider benchmarking.Contents

Expand “Recurring Revenue Streams.”  This includes Managed Services, Research,  software as a subscription, benchmarking as a subscription and the U.S. Public Sector. All are characterized by subscriptions (i.e., renewal‑centric as opposed to project centric revenue streams) or multi‑year contracts.  As companies begin to recognize the importance of managing the post‑sourcing‑transaction period, managed services has emerged as a revenue driver for us where our offerings are delivered through multi‑year managed services contracts. We believe that our experience with outsourcing transactions and software implementation initiatives make us uniquely equipped to provide research insights and direct support to help our clients manage their transformational projects or act as a third‑party administrator.  We will continue to pursue opportunities to leverage our experience to make research and managed services an even greater revenue generator for us. The U.S. public sector, particularly state governments, local municipalities, and higher education—presents a significant opportunity to ISG. Systems are typically outdated, maintenance is expensive, and the workforce charged with maintenance is ageing. There is a need to refurbish systems to reduce the cost of operations (particularly because governments’ tax revenues are under pressure). We are well-positioned as a third party, objective advisory group with no affiliation to the software providers.  ISG will continue to invest in the digitization of these services, driving up automation, greater profitability and even more value for our clients.

Consider Acquisition and Other Growth Opportunities.  The business services, information and advisory market is highly fragmented.  We believe we are well‑positioned to leverage our leading market positions and strong brand recognition to expand through acquisitions. Acquiring firms with complementary services and products allows us to further develop and broaden our service offerings and domain expertise.  We will consider and may pursue opportunities to enter into joint ventures and to buy or combine with other businesses.

Retool Our Resource and Delivery Model.  The goal is to evolve our workforce to achieve a more efficient distribution of resources globally and a more flexible staffing model. This will provide ISG’s clients with better value for their money while also improving ISG’s margins.

Our Proprietary Data Assets and Market Intelligence

One of our core assets is the information, data, analytics, methodologies and other intellectual property the Company possesses. This intellectual property underpins the independent nature of our operational assessments, strategy development, deal‑deal structuring, negotiation and other consulting services we provide to our clients.

With each engagement we conduct, we enhance both the quantity and quality of the intellectual property we employ on behalf of our clients, thus providing a continuous, evolving and unique source of information, data and analytics.

Table of Contents

Our employee base includes executive management, service leads, partners, directors, advisors, analysts, technical specialists and functional support staff.

We recruit advisors from service providers and consulting firms with direct operational experience. These advisors leverage extensive practical expertise derived from experiences in corporate leadership, consulting, research, financial analysis, contract negotiations and operational service delivery.

All employees are required to execute confidentiality, conflict of interest and intellectual property agreements as a condition of employment. There are no collective bargaining agreements covering any of our employees.

Our voluntary advisor turnover rate has ranged between 8%12% and 17%15% over the last three years.

Human Capital Management

ISG strives to employ the brightest, most innovative people in the industry, so that we can provide world-class solutions to our clients. Employees at ISG are anchored in our core values, which include trust, integrity, respect, diversity, passion, entrepreneurship, balance and mentorship.

Our more than 1,500 employees, located in over 20 countries with more than one-fourth in the United States, perform a variety of different roles. We are participants in the competitive research and advisory industries. Attracting, developing and retaining talented people in advisory, research and other positions is critical to executing on our strategy. Our ability to compete effectively depends upon a number of factors, including learning opportunities, compensation/benefits, work environment, career opportunities and a culture of inclusivity. To make this happen, we have certain programs, training, policies and practices in place, including the following:

Diversity/Inclusion

ISG believes a key to our success is our value of diverse backgrounds, experiences and cultures. Our employees function within a collaborative community that welcomes varied ideas and styles. These diverse perspectives produce enhanced results for our clients and result in a preferred place to work.

We exhibit our commitment to diversity and inclusion through our hiring practices, opportunities for learning and advancement and the distribution of rewards. Through efforts such as our Inclusion, Diversity, Equity and Awareness (IDEA) team and Women-In-Digital industry group, we are able to help in the identification and advancement of diverse talent. We strive to provide a culture where each employee is able to bring their whole self to work. While we have made progress in our workforce diversity representation, we seek to continually improve in this area.  

ISG WorkLife

We have also introduced ISG WorkLife, which is a series of progressive, best practice, Next-Gen HR offerings designed to improve the quality of our work-life experience, while helping us achieve our firm-wide objectives.  ISG believes this will help us attract and retain productive talent.  Some of the key offerings here include:

​

We understand that employees have varied interests both in and outside of the workplace. These programs, and others under ISG WorkLife, provide employees with the opportunity to pursue these activities. This allows us to attract and retain productive employees and enhance diverse perspectives.

Environmental Social and Governance (ESG)

The ISG Environmental Social and Governance program was developed with corporate commitment and accountability on a global level in mind. The program has oversight and executive support to drive real, positive change in alignment with our value and policies, ultimately enabling us to maximize impact and value.

Our ISG Go Green program speaks to the Environmental pillar of ESG. This program seeks to reduce our carbon footprint via awareness and education initiatives that share green practices for ISG employees in both virtual and physical offices. Additionally, ISG is developing measurable carbon reduction best practices that align with our goals for sustainable business operations. Since 2021, we have offset the carbon generated by ISG employee travel and continue to seek ways to pivot to green energy for our physical locations. Our environmental work is centered around three core concepts: compliance with eco-friendly laws and best practices, prevention of waste, pollution and carbon emissions and continuous, measurable improvement.

The IDEA (Inclusion, Diversity, Equity and Awareness) program is the foundation for our Social pillar. Beyond our core Diversity, Equity and Inclusion (DEI) activities, ISG has sub-groups that devote focus to uplifting women in digital, maintaining equitable recruitment, building our supplier diversity and volunteering through our global ISG Cares team. At ISG, we do not just accept difference — we celebrate it, and we thrive on it for the benefit of our employees, our clients and our communities. We commit to building a team that represents a variety of backgrounds, perspectives and skills. ISG is proud to be an equal opportunity workplace, and we are committed to creating an inclusive environment for all employees. Our work in the social pillar is based on ISG values of trust, integrity, respect and diversity, made tangible in our business practices, modern slavery statement and fair labor policies.

For the Governance pillar, ISG has a well-established set of policies, governing bodies and independent validation measures. ISG is governed on a day-to-day basis by our internal international executive board, which meets weekly. ISG also receives governance and support from an external board of directors (“the Board of Directors”). We maintain procedures, policies and codes of conduct around ethical business practices, whistleblowing, suppliers, data protection, information security, privacy, confidentiality, employee comportment and travel. With regard to cybersecurity, we regularly provide training, reporting and scans in compliance with our ISO-27001 certifications and best practices. Every year, our employees attest to reviewing our global policies via digital signature, including in 2023 a new policy regarding the acceptable use of generative automated intelligence.

Learning

ISG’s success depends on the knowledge and productivity of its employees.  To that end, the Company invests a significant amount of time and money into providing development opportunities. Our ISG Academy is robust in offering learning in such topics specific to the employee’s industry and functional areas, leadership and people management, certifications and software and technical skills, among others.  In 2023, most learning was virtual; there were over 1,200 digital certified professionals that participated in various sessions, devoting a total of more than 45,000 hours to learning and development.

​

Available Information

Our Internet address is www.isg‑one.comwww.isg-one.com. The content on our website is available for informationinformational purposes only. It should not be relied upon for investment purposes, nor is it incorporated by reference into this Form 10‑K10-K or any other filings. We make available through our Internet website under the heading “Investor Relations,”link titled “Investors” our annual report on Form 10‑K,10-K, quarterly reports on Form 10‑Q,10-Q and current reports on Form 8‑K8-K, including any amendments or exhibits thereto, as soon as reasonably practicable after we electronically file any such materials with the Securities and Exchange Commission.Commission (the “SEC”). Copies of our key corporate governance documents, including our Code of Ethics and Business Conduct for Directors, Officers and Employees, Corporate Governance Guidelines and charters for our Audit Committee, our Nominating and Corporate Governance Committee and our Compensation Committee, are also on our website. Stockholders may request free copies of these documents, including our Annual Report to Stockholders, by writing to Information Services Group, Inc., Two Stamford Plaza, 281 Tresser Boulevard,2187 Atlantic Street, Stamford, CT 06901,06902, Attention: David E. Berger,Michael A. Sherrick, or by calling (203) 517‑3100.517-3100.

Our annual and quarterly reports and other information statements are also available to the public through the SEC’s website at www.sec.gov. In addition, the Notice

Table of Annual Meeting of Stockholders, Proxy Statement and 2017 Annual Report to Stockholders are available free of charge at www.proxyvote.com.Contents

Item 1A.  Risk Factors

We operate in a highly competitive and rapidly changing environment that involves numerous risks and uncertainties, some of which are beyond our control. In addition, we and our clients are affected by global economic conditions and trends. The following sections address significant factors, events and uncertainties that make an investment in our securities risky. We urge you to consider carefully the factors described below and the risks that they present for our operations, as well as the risks addressed in other reports and materials that we file with the SEC and the other information included or incorporated by reference in this Form 10-K. When the factors, events and contingencies described below or elsewhere in this Form 10-K materialize, there could be a material adverse impact on our business, prospects, results of operations, financial condition and cash flows, any of which could have a potential negative effect on the trading price of our common stock. Additional risks not currently known to us or that we now deem immaterial may also harm us and negatively affect your investment. In addition to the effects of the global economic and geopolitical climate on our business and operations discussed in Item 7 of this Form 10-K and in the risk factors below, additional or unforeseen effects from the global economic and geopolitical climate may give rise to or amplify many of these risks discussed below. Risks in this section are grouped in the following categories: (1) risks related to outstanding debt; (2) risks related to acquisitions; (3) strategy and operation risks; (4) risks related to management and employees; (5) macroeconomic risks; (6) risks related to data, cybersecurity and confidential information; and (7) general risk factors. Many risks affect more than one category, and the risks are not in order of significance or probability of occurrence because they have been grouped by categories.

Risks Related to Outstanding Debt

We have a substantial amount of debt outstanding, which may limit our ability to fund general corporate requirements and obtain additional financing, limit our flexibility in responding to business opportunities and competitive developments and increase our vulnerability to adverse economic and industry conditions and changes in our debt rating.

On December 1, 2016,February 22, 2023, the Company entered into an amended and restated its senior secured credit facility comprised of a $110.0 million term loanto increase the revolving commitments per the revolving facility and a $30.0 million revolving credit facility, amending and restating the senior secured credit facility entered into on May 3, 2015 (“Amended and Restated(the “2023 Credit Agreement”).  Each of the from $54.0 million to $140.0 million and eliminate its term loan facility and revolving credit facility has a maturity date of December 1, 2021 (“Maturity Date”).  The Term Loan is repayable in four consecutive quarterly installments of $1,375,000 each, commencing March 31, 2017, followed by eight consecutive quarterly installments in the amount of $2,062,500 each, commencing March 31, 2018, followed by seven consecutive quarterly installments of $2,750,000 each, commencing March 31, 2020 and a final payment of the outstanding principal amount of the Term Loan on the Maturity Date.loan. As a result of the substantial fixedvariable costs associated with the debt obligations, we expect that:

a decrease in revenues will result in a disproportionately greater percentage decrease in earnings;

we may not have sufficient liquidity to fund all of these fixed costs if our revenues decline or costs increase;

we may have to use our working capital to fund these fixed costs instead of funding general corporate requirements, including capital expenditures;

we may not have sufficient liquidity to respond to business opportunities, competitive developments and adverse economic conditions; and

Table of Contents

If our lenders were unwilling to enter into an amendment or provide a waiver, all amounts outstanding under our credit facility would become immediately due and payable.

Our variable rate indebtedness will subject us to interest rate risk, which could cause our annual debt service obligations to increase significantly.

Borrowing under our credit facility bears interest at a rate per annum equal to either (i) the “Base Rate” (which is the highest of (a) the rate publicly announced from time to time by the administrative agent as its “prime rate,” (b) the Federal Funds Rate plus 0.5% per annum and (c) Term SOFR, plus 1.0%), plus the applicable margin (as defined below) or (ii) Term SOFR (which is the Term SOFR screen rate for the relevant interest period plus a credit spread adjustment of 0.10%) as determined by the administrative agent, plus the applicable margin. The applicable margin is adjusted quarterly based upon the Company’s consolidated leverage ratio. If interest rates increase, our debt service obligations on our variable rate indebtedness would increase even though the amount borrowed remained the same, and our cash flows could be adversely affected. An increase in debt service obligations under our variable rate indebtedness could affect our ability to make payments required under the terms of our credit facility.

Risks Related to Acquisitions

We have risks associated with acquisitions or investments.

Since our inception, we have expanded through acquisitions. In the future, we plan to pursue additional acquisitions and investments as opportunities arise.  We may not be able to successfully integrate businesses that we have acquired, or may acquire in the future without substantial expense, delays or other operational or financial problems. We may not be able to identify, acquire or profitably manage additional businesses.  If we pursue acquisition or investment opportunities, these potential risks could disrupt our ongoing business, result in the loss of key customers or personnel, increase expenses and otherwise have a material adverse effect on our business, results of operations and financial condition.

Difficulties in integrating businesses we have acquired, or may acquire in the future, may demand time and attention from our senior management.

Integrating businesses we have acquired, or may acquire in the future, may involve unanticipated delays, costs and/or other operational and financial problems. In integrating acquired businesses, we may not achieve expected economies of scale or profitability or realize sufficient revenue to justify our investment.  If we encounter unexpected problems as we try to integrate an acquired firm into our business, our management may

Table of Contents

Our engagements may be terminated, delayed or reduced in scope by clients at any time.

Our clients may decide at any time to abandon, postpone and/or to reduce our involvement in an engagement. Our engagements can be terminated, or the scope of our responsibilities may be diminished, with limited advance notice. If an engagement is terminated, delayed or reduced unexpectedly, the professionals working on the engagement could be underutilized until we assign them to other projects. Accordingly, the termination or significant reduction in the scope of a single large engagement, or multiple smaller engagements, could harm our business results.

Our operating results may fluctuate significantly from period to period as a result of factors outside of our control.

We expect ourOur revenues and operating results tomay vary significantly from accounting period to accounting period due to factors including:

●fluctuations in revenues earned on contracts;

●commencement, completion or termination of engagements during any particular period;

●additions and departures of key advisors;

●transitioning of advisors from completed projects to new engagements;

●seasonal trends;

Table of Contents

●our ability to maintain an appropriate level of consultants by forecasting the demand for our services.

We could lose money on our fixed‑feefixed-fee or capped-fee contracts.

As part of our strategy, from time to time, we enter into fixed feefixed-fee contracts, in addition to contracts based on payment for time and materials.materials with capped fees. Because of the complexity of many of our client engagements,

Table of Contents

We may be unable to protect important intellectual property rights.

We rely on copyright and trademark laws, as well as nondisclosure and confidentiality arrangements, to protect our proprietary rights in our methods of performing our services, our data and our tools for analyzing financial and other information. There can be no assurance that the steps we have taken to protect our intellectual property rights will be adequate to deter misappropriation of our rights or that we will be able to detect unauthorized use and take timely and effective steps to enforce our rights. If substantial and material unauthorized uses of our proprietary methodologies, data and analytical tools were to occur, we may be required to engage in costly and time‑consumingtime-consuming litigation to enforce our rights. There can be no assurance that we would

Table of Contents

We must also recruit staff globally to support our services and products. We face competition for the limited pool of these qualified professionals from, among others, technology companies, market research firms, consulting firms, financial services companies and electronic and print media companies, some of which have a greater ability to attract and compensate these professionals. Moreover, increasing wage inflation may affect our profit margin as we strive to provide compensation packages that are competitive. We face risks related to global labor shortages, and competitive markets have increased attrition throughout our sector. Some of the personnel that we attempt to hire may be subject to non‑competenon-compete agreements that could impede our short‑termshort-term recruitment efforts.  Any failure to retain key personnel or hire and train additional qualified personnel as required supporting the evolving needs of clients or growth in our business could adversely affect the quality of our products and services, and our future business and operating results.

We may have agreements with certain clients that limit the ability of particular advisors to work on some engagements for a period of time.

We provide services primarily in connection with significant or complex sourcing transactions and other matters that provide potential competitive advantage and/or involve sensitive client information. Our engagement by a client occasionally precludes us from staffing certain advisors on new engagements with other clients because the advisors have received confidential information from a client who is a competitor of the new client.  Furthermore, it is possible that our engagement by a client could preclude us from accepting engagements with such client’s competitors because of confidentiality concerns.

In many industries in which we provide advisory services, there has been a trend toward business consolidations and strategic alliances that could limit the pool of potential clients.Macroeconomic Risks

Consolidations and alliances reduce the number of potential clients for our services and products and may increase the chances that we will be unable to continue some of our ongoing engagements or secure new engagements. When companies consolidate, overlapping services previously purchased separately are usually purchased only once by the combined entity, leading to loss of revenue.  Other services that were previously purchased by one of the merged or consolidated entities may be deemed unnecessary or cancelled. If our clients consolidate with or are acquired by other entities that are not our clients, or that use fewer of our services, they may discontinue or reduce their use of our services. There can be no assurance as to the degree to which we may be able to address the revenue impact of such consolidation. Any of these developments could harm our operating results and financial condition.

We derive a significant portion of our revenues from our largest clients and could be materially and adversely affected if we lose one or more of our large clients.

Our 25 largest clients accounted for approximately 39% of revenue in 2017 and 38% in 2016. If one or more of our large clients terminate or significantly reduce their engagements or fail to remain a viable business, then our revenues could be materially and adversely affected.  In addition, sizable receivable balances could be jeopardized if large clients fail to remain a going concern.

We operate in a number of international areas which exposes us to significant foreign currency exchange rate risk.

We have significant international revenue, which is predominantly collected in local currency. It is expected that our international revenues will continue to grow as European and Asian Pacific markets adopt sourcing solutions.  The uncertainty surrounding the implementation and effecttranslation of Brexitour revenues into U.S. dollars, as well as our costs of operating internationally, may cause increased economic volatility, affectingadversely affect our business, results of operations and business.financial condition.

Given our operations in the United KingdomRisks Related to Data, Cybersecurity and Continental Europe, we face uncertainty surrounding the implementation and effects of the U.K.’s June 2016 referendum in which voters approved the United Kingdom’s exit from the European Union, commonly referred to as “Brexit.” It is possible that Brexit will cause increased regulatory and legal complexities and create uncertainty surrounding our business, including our relationships with existing and future clients, suppliers and employees, which could have an adverse effect on our business, financial results and operations.Confidential Information

Data protection laws and self-regulatory codes may restrict our activities and increase our costs.

Various statutes and rules regulate conduct in areas such as privacy and data protection whichthat may affect our collection, use, storage, and transfer of information both abroad and in the United States. Compliance with these laws and self-regulatory codes may require us to make certain investments or may dictate that we not offer certain types of services or only offer such services after making necessary modifications. Failure to comply with these laws and self-regulatory codes may result in, among other things, civil and criminal liability, negative publicity, restrictions on further use of data and/or liability under contractual warranties.

In addition, there is an increasing public concern regarding data and consumer protection issues, with the result that the number of jurisdictions with data protection laws continues to increase and the scope of existing privacy laws and the data considered to be covered by such laws iskeep expanding. Changes in these laws (including newly released interpretations of these laws by courts and regulatory bodies) may limit our client data access, use and disclosure, and may require increased expenditures by us or may dictate that we may not offer certain types of services.

The European Union’sAs a global firm, ISG must comply with various international and domestic data privacy regulations such as (i) the EU and UK General Data Protection Regulation (“GDPR”), which will take effect in May 2018, has extra-territorial scope and substantial fines for breaches (up to 4% of global annual revenue or €20 million, whichever is greater).    Additionally, compliance, (ii) the California Consumer Privacy Act, which, unlike data privacy provisions enacted by other US states, covers individuals acting in a commercial or employment context not just as consumers, and (iii) the Australian Privacy Act, among others. In addition, the new India Digital Personal Data Protection Act 2023 (“DPDP”) is likely to come into force in 2024. Like the GDPR, the DPDP has extra-territorial reach. The DPDP shares many provisions with existing privacy laws, and ISG therefore anticipates that its existing processes already broadly align with the new law. However, like the GDPR, is resulting in operational costsfailure to implement new procedures correspondingcomply with the DPDP may lead to new legal rights granted under the law, but has had little direct impact on ISG products.substantial fines. ISG is continuing to monitor the development of the EU’s ePrivacy Regulation proposal and industry response and will determine whether to take further action, as needed, following its final adoption.if it is adopted.

To mitigate the risk and negative exposure of data outside ISG, we have put in place a data protection framework that includes policies, procedures, guidance, and records. This includes policies and procedures for rights and usage of personal and client data.

We operateare exposed to risks related to cybersecurity.

A significant portion of our business is conducted over the internet, and we rely on the secure processing, storage, and transmission of confidential, sensitive, proprietary and other types of information relating to our business operations and confidential and sensitive information about our clients and employees in our computer systems and networks, and in those of our third-party vendors. Individuals, groups, and state-sponsored organizations may take steps that pose threats to our operations, our computer systems, our employees, and our clients. The cybersecurity risks we face range from cyberattacks common to most industries, such as the development and deployment of malicious software to gain access to our networks and attempt to steal confidential information, launch distributed denial of service attacks, or attempt other coordinated disruptions, to more advanced threats that target us because of our prominence in the global research and advisory field. Ransomware risk has increased significantly in recent years and presents a numbersignificant risk of international areasfinancial extortion and loss of data. Our operating model allows employees to continue to work remotely or on a hybrid basis, which exposes us to significant foreign currency exchange rate risk.magnifies the importance of the integrity of our remote access security measures.

We have significant international revenue, which is predominantly collectedrobust measures in local currency.  We do enter into forward contracts for hedging of specific transactions. All are settled priorplace to quarter end. It is expected that our international revenues willaddress and mitigate cyber-related risks. Notwithstanding this, we continue to grow as Europeanexperience attack attempts against our environment. We have and Asian markets adopt sourcing solutions.  The translationcontinue to expect to invest in the security and resiliency of our revenuesnetworks and products and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure and the information they contain. These include timely detection of incidents through monitoring, training, incident response capabilities, and mitigating cyber and security risks to our data, systems, products, and services. However, given the complex, continuing and evolving nature of cyber and other security threats, these efforts may not be fully effective, particularly against previously unknown vulnerabilities that could go undetected for an extended period.

We also face risks related to our use of third-party suppliers if such suppliers are affected by a cybersecurity threat or incident, which could result in a reduction in or loss of their ability to service us (which could be a significant component of our services to clients), the exposure of ISG or client data or a potential backdoor into U.S. dollars, as well as our costsISG’s systems and network.

Table of operating internationally, may adversely affect our business, results of operations and financial condition.Contents

We may be subject to claims for substantial damages by our clients arising out of disruptions to their businesses or inadequate service, and our insurance coverage may be inadequate.

Most of our service contracts with clients contain service level and performance requirements, including requirements relating to the quality of our services. Failure to consistently meet service requirements of a client or errors made by our employees in the course ofwhile delivering services to our clients could disrupt the client’s

Table of Contents

data. Our insurance coverage for breaches or mismanagement of such data may not continue to be available on reasonable terms or in sufficient amounts to cover one or more large claims against us.

We could have liability or our reputation could be damaged if we fail to protect client and/or our data from security breaches or cyberattacks.

We are dependentClient restrictions on information technology networks and systems to securely process, transmit and store electronic information and to communicate among our locations around the world and with our people, clients, alliance partners and vendors. As the breadth and complexity of this infrastructure continues to grow, including as a result of the use of mobile technologies, social mediaclient data could adversely affect our activities.

Most of the data we use to populate our databases comes from our client engagements. The insight sought by clients from us relates to the contractual data and cloud-based services,terms, including pricing and costs, to which we have access while assisting our clients in the risk of security breaches and cyberattacks increases. Such breaches could lead to shutdowns or disruptions of or damage to our systems and thosenegotiation of our sourcing agreements. Data is obtained through the course of our engagements with clients alliance partnerswho agree to contractual provisions permitting us to consolidate and vendors,utilize on an aggregate basis such information. If we were unable to utilize key data from previous client engagements, our business, financial condition, and unauthorized disclosureresults of sensitive or confidential information, including personal data.operations could be adversely affected.

Table of Contents

Item 1C.  Cybersecurity

ISG maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company’s enterprise risk management system and addresses both the corporate information technology environment and the Company’s client-facing products. We regularly assess the threat landscape, taking a holistic view of cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. 

The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology. ISG performs annual assessments, by two independent third parties, against the International Organization Standardization (“ISO”) 27001 Information Security Management System requirements for which we maintain certification. ISG also maintains certification across other cyber security frameworks, including the Trusted Information Security Assessment Exchange and UK Cyber Essentials, and is preparing for SOC2 attestation across our GovernX platforms.

The Company’s cybersecurity efforts are led by the Chief Information Security Officer (“CISO”), who reports to the Chief Information Officer (“CIO”) and has responsibilities that cover the management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has proven cyber operations and cyber risk management experience, having previously worked for UK law enforcement and leading organizations in the financial services, health and advertising sectors. Our CISO also holds relevant cyber management qualifications, such as being a Certified Information Systems Security Professional. The CISO manages a team of qualified cybersecurity professionals with broad experience and expertise across cyber security disciplines that provide ad-hoc reports to the CISO regarding cybersecurity threats and incidents. Cybersecurity risk is maintained and managed under our Information Security Management System framework with oversight through our internal Executive Board (“IEB”) and our Board of Directors, which has delegated responsibility for cybersecurity risk to our Information Security Committee (“ISC”).

Cybersecurity is an important area of focus for our Board of Directors. The Board of Directors reviews and discusses with our CIO the Company’s cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, any significant cybersecurity incidents and the emerging threat landscape. Our CIO discusses the same cybersecurity topics covered with the Board of Directors with the IEB. In addition, the IEB makes decisions on resourcing and project prioritization in support of our cybersecurity and compliance initiatives.  

Responsibility for cybersecurity risk has been delegated to the ISC, which consists of senior executives (including three IEB members), namely the Chief Financial Officer (IEB member), Chief Human Resources Officer (IEB member), Chief Information Officer, Chief Data and Analytics Officer (IEB member), Chief Information Security Officer, Legal Counsel, Director of Corporate Governance and Data Privacy Manager. The ISC oversees the management of processes for identifying and mitigating cybersecurity risks, material vulnerabilities and high rated incidents, to help align our risk exposure with our strategic objectives.  The ISC meets quarterly and receives additional ad-hoc briefings from the CISO as and when required.

In the event of a major security incident, certain members of the ISC form part of our Incident Management Team (“IMT”). The IMT follows our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership, the IEB and the Board of Directors, as appropriate.

For the evaluation of our security controls, ISG engages third-parties services to conduct penetration testing, independent audits or provide consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of our security controls. We also share and receive threat intelligence which we utilize to bolster defenses against active threats. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, clients, employees, vendors, intellectual property and drive continuous improvement across the security domain.

ISG recognizes that if our third-party suppliers are affected by cyber security incidents, we could be indirectly impacted, including, the potential loss of service (which could be a significant component of our services to clients), exposure of ISG or client data or a potential backdoor into ISG systems or network. We maintain processes and procedures to continuously assess third-party cybersecurity risk and include security and privacy addendums to our contracts where applicable.  We seek to work directly with any suppliers to address potential deficiencies when identified. 

To mitigate the risk and negative exposure of personal data being breached or inadvertently shared outside of ISG, we maintain a data protection framework that includes policies, procedures, guidance and records. This includes policies and procedures regarding the rights and usage of personal and client data.  ISG employs a Data Privacy Manager who briefs the ISC on privacy matters as part of the quarterly ISC meetings. The Data Privacy Manager completes an internal audit annually and works with a specialist third party to complete an external Data Protection Compliance review.

We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.

Table of Contents

As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating cybersecurity threats or incidents, and such threats or incidents may have a material adverse effect on us. While ISG maintains cybersecurity insurance, the costs related to cybersecurity threats or service disruptions to both ISG and our clients may not be fully insured.

For more information regarding the risks we face from cybersecurity threats, see the risks identified under “Risks Related to Data, Cybersecurity and Confidential Information” found in “Part 1A, Risk Factors” of this Annual Report on Form 10-K.

Item 2.  Properties

We maintain our executive offices in Stamford, Connecticut. The current lease on our executive offices expires July 31, 2018, our new leases for our executive offices covers approximately eighteen thousand square feet and expires on August 31,September 30, 2025. The majority of our business activities are performed on client sites.sites or remotely. We do not own offices or properties. We have leased offices in the United States, Canada, Denmark, Switzerland, the Netherlands, Finland, Australia, France, Germany, India, Italy, Spain, Sweden and the United Kingdom.

Item 3.  Legal Proceedings

From time to time, in the normal course of business, we are a party to various legal proceedings. We are not aware of any asserted or unasserted legal proceedings or claims that we believe would have a material adverse effect on our financial condition, results of operations or cash flows.

Item 4.  Mine Safety Disclosures

Not applicable.

​

Table of Contents

Item 5.  Market for Registrant’s Common Equity,Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

The following table sets forth the high and low closing sales price of our common stock, as reported on The Nasdaq Stock Market LLC under the symbol “III” for the periods shown:

​

​

Table of Contents

⁽¹⁾  On August 5, 2023, the approximate dollar valueBoard of Directors approved a stock repurchase plan authorizing the Company to repurchase an aggregate of $25 million in shares of the common stock. On August 1, 2023, the Board of Directors approved a new stock that may yet be purchased underrepurchase plan authorizing the existing shareCompany to repurchase program is $15.2 million.

Securities Authorized for Issuance under Equity Compensation Plan

The following table lists information regarding outstanding options and shares reserved for future issuance under our Amended and Restated 2007 Equity and Incentive Award Plan and our Amended and Restated Employee Stock Purchase Plan asan aggregate of December 31, 2017. We have not issued anyan additional $25 million in shares of our common stock to employees as compensation under a plan that has not been approved by our stockholders.

(1)The weighted‑average exercise price includes outstanding options and RSUs, treating RSUs as stock awards with an exercise price of zero. The weighted‑average exercise price of the only outstanding awards that have a positive exercise price (i.e., SARs) is $3.18.

(2)Includes 652,740 shares available for future issuance under the Company’s Employee Stock Purchase Plan.  Also includes 5,614,838 shares that were available for grant under the Amended and Restated 2007 Equity and Incentive Award Plan as options and SARs and also for restricted stock, restricted stock units or other awards that could provide to the grantee an opportunity to earn the full value of an underlying share (in other words, such earning opportunity is not limited to the appreciation in value of our stock following the grant of the award).common stock.