We operate in a number of international areas which exposes us to significant foreign currency exchange rate risk.
We have significant international revenue, which is predominantly collected in local currency. It is expected that our international revenues will continue to grow as European and Asian Pacific markets adopt sourcing solutions. The translation of our revenues into U.S. dollars, as well as our costs of operating internationally, may adversely affect our business, results of operations and financial condition.
Risks Related to Data, Cybersecurity and Confidential Information
Data protection laws and self-regulatory codes may restrict our activities and increase our costs.
Various statutes and rules regulate conduct in areas such as privacy and data protection that may affect our collection, use, storage, and transfer of information both abroad and in the United States. Compliance with these laws and self-regulatory codes may require us to make certain investments or may dictate that we not offer certain types of services or only offer such services after making necessary modifications. Failure to comply with these laws and self-regulatory codes may result in, among other things, civil and criminal liability, negative publicity, restrictions on further use of data and/or liability under contractual warranties.
In addition, there is an increasing public concern regarding data and consumer protection issues, with the result that the number of jurisdictions with data protection laws continues to increase and the scope of existing privacy laws and the data considered to be covered by such laws keep expanding. Changes in these laws (including newly released interpretations of these laws by courts and regulatory bodies) may limit our client data access, use and disclosure, and may require increased expenditures by us or may dictate that we may not offer certain types of services.
As a global firm, ISG must comply with various international and domestic data privacy regulations such as (i) the EU and UK General Data Protection Regulation (“GDPR”), which has extra-territorial scope and substantial fines for breaches (up to 4% of global annual revenue or €20 million, whichever is greater), (ii) the California Consumer Privacy Act, which, unlike data privacy provisions enacted by other US states, covers individuals acting in a commercial or employment context not just as consumers, and (iii) the Australian Privacy Act, among others. In addition, the new India Digital Personal Data Protection Act 2023 (“DPDP”) is likely to come into force in 2024. Like the GDPR, the DPDP has extra-territorial reach. The DPDP shares many provisions with existing privacy laws, and ISG therefore anticipates that its existing processes already broadly align with the new law. However, like the GDPR, failure to comply with the DPDP may lead to substantial fines. ISG is continuing to monitor the development of the EU’s ePrivacy Regulation proposal and industry response and will determine whether to take further action, as needed, if it is adopted.
To mitigate the risk and negative exposure of data outside ISG, we have put in place a data protection framework that includes policies, procedures, guidance, and records. This includes policies and procedures for rights and usage of personal and client data.
We are exposed to risks related to cybersecurity.
A significant portion of our business is conducted over the internet, and we rely on the secure processing, storage, and transmission of confidential, sensitive, proprietary and other types of information relating to our business operations and confidential and sensitive information about our clients and employees in our computer systems and networks, and in those of our third-party vendors. Individuals, groups, and state-sponsored organizations may take steps that pose threats to our operations, our computer systems, our employees, and our clients. The cybersecurity risks we face range from cyberattacks common to most industries, such as the development and deployment of malicious software to gain access to our networks and attempt to steal confidential information, launch distributed denial of service attacks, or attempt other coordinated disruptions, to more advanced threats that target us because of our prominence in the global research and advisory field. Ransomware risk has increased significantly in recent years and presents a significant risk of financial extortion and loss of data. Our operating model allows employees to continue to work remotely or on a hybrid basis, which magnifies the importance of the integrity of our remote access security measures.
We have robust measures in place to address and mitigate cyber-related risks. Notwithstanding this, we continue to experience attack attempts against our environment. We have and continue to expect to invest in the security and resiliency of our networks and products and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure and the information they contain. These include timely detection of incidents through monitoring, training, incident response capabilities, and mitigating cyber and security risks to our data, systems, products, and services. However, given the complex, continuing and evolving nature of cyber and other security threats, these efforts may not be fully effective, particularly against previously unknown vulnerabilities that could go undetected for an extended period.
We also face risks related to our use of third-party suppliers if such suppliers are affected by a cybersecurity threat or incident, which could result in a reduction in or loss of their ability to service us (which could be a significant component of our services to clients), the exposure of ISG or client data or a potential backdoor into ISG’s systems and network.