Failure to protect our information technology infrastructure against cyber incidents, network security breaches, service interruptions, or data corruption could materially disrupt our operations and adversely affect our business, operating results, or the effectiveness of our internal controls over financial reporting.
The efficient operation of our global business depends on our information technology systems, including telecommunications, the internet, network communications, email and various computer hardware and software applications. We rely on our information technology systems to effectively manage sales and marketing data, accounting and financial functions, inventory management, product development tasks, clinical data, customer service and technical support functions. Our information technology systems are vulnerable to damage or interruption from earthquakes, fires, floods and other natural disasters, terrorist attacks, power losses, computer system or data network failures, data corruption and security breaches or other cyber-based incidents, which we have experienced and which we continue to monitor. Cyber incidents can include ransomware, computer denial-of-service attacks, worms, and other malicious software programs introduced to our computers and networks, including intrusions that are disguised and evade detection for an extended period of time, phishing attacks, impersonation of authorized users, and efforts to discover and exploit any design flaws, bugs, security vulnerabilities or security weaknesses, as well as intentional or unintentional acts by employees or other insiders with access privileges, intentional acts of vandalism or fraud by third parties and sabotage. While none of the cyber incidents or service interruptions that we have experienced to date have had a material adverse impact on our business, financial condition or operations, we cannot assure that future incidents will not materially and adversely impact us. In addition, a variety of our software systems are cloud-based data management applications, hosted by third-party service providers whose security and information technology systems are subject to similar risks. The failure to protect either our or our service providers’ information technology infrastructure could disrupt our entire operation or result in decreased sales, increased overhead costs, product shortages, loss or misuse of proprietary or confidential information, intellectual property or sensitive or personal information, all of which could have a material adverse effect on our reputation, business, financial condition and operating results.
Our enterprise resource planning (“ERP”) system, which was implemented in 2020, is integral to our ability to accurately and efficiently maintain our books and records, record transactions, and prepare our financial statements. Any disruptions or difficulties that may occur in connection with our ERP system (whether in connection with the regular operation, periodic enhancements or upgrades of such systems, or due to cyber incidents) could adversely affect our ability to provide services, fulfill contractual obligations, file reports with the SEC in a timely manner, operate our business or otherwise affect our controls environment. If our independent registered public accounting firm determines that we have a material weakness in our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by the New York Stock Exchange, the SEC, or other regulatory authorities. Any of these events could have an adverse effect on our business, operating results and financial condition.
Failure to comply with data privacy and security laws could have a material adverse effect on our business.
We are subject to state, federal and foreign laws relating to data privacy and security in the conduct of our business, including state breach notification laws, the Health Insurance Portability and Accountability Act, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, the European Union’s General Data Protection Regulation (GDPR), the U.K. Data Protection Act and the U.K. GDPR, and the California Consumer Privacy Act (CCPA), among others. These laws affect how we collect and use data of our employees, consultants, customers and other parties. These laws, as well as similar laws being enacted by other states and countries, impose substantial requirements that involve the expenditure of significant resources and the investment of significant time and effort to comply. We also rely on third parties to host or otherwise process some of this data. In some instances, these third parties have experienced failures to protect data privacy. Any failure by a third party to prevent security breaches could have adverse consequences for us. Our failure to comply with these laws or prevent security breaches of such data could result in significant liability under applicable laws, cause disruption to our business, harm our reputation and have a material adverse effect on our business.
We cannot be certain that our net operating loss tax carryforwards will be available to offset future taxable income.
At December 31, 2021, we had approximately $491.4 million, $328.4 million and $12.3 million of net operating loss (NOL) carryforwards for federal, state and foreign purposes, respectively. Federal NOL carryforwards incurred prior to 2018 begin to expire in 2024, while federal NOL carryforwards of $239.2 million will not expire but can only be used to offset 80 percent of future taxable income. The state and foreign NOL carryforwards begin to expire in 2022. At