manner in which we operate our business in ways we cannot currently anticipate. For example, the SEC’s proposed climate disclosure rule would result in significant costs of compliance if final rules that are similar to the proposed rules are approved in the future. Our management and other personnel will need to devote a substantial amount of time to these compliance initiatives. Moreover, these rules and regulations will increase our legal and financial compliance costs and will make some activities more time consuming and costly. For example, we expect these rules and regulations to make it more difficult and more expensive for us to obtain director and officer liability insurance and we may be required to incur substantial costs to maintain our current levels of such coverage.
Our information technology systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer security breaches and geopolitical tensions or conflicts, such as the ongoing war in Ukraine or conflicts in the Middle East, may create a heightened risk of cyberattacks.
We collect and maintain information in digital form that is necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business. In the ordinary course of our business, we collect, store and transmit large amounts of confidential information, including intellectual property, proprietary business information, preclinical and clinical trial data, and personal information (collectively, “Confidential Information”) of customers and our employees and contractors. It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such Confidential Information.
Despite the implementation of security measures, our information technology systems as well as those of our third-party collaborators, consultants, contractors, suppliers, and service providers, may be vulnerable to damage from physical or electronic break-ins, computer viruses, misconfigurations, “bugs” or other vulnerabilities, “phishing” attacks, malware, ransomware, denial of service and other cyberattacks or disruptive incidents that could result in unauthorized access to, use or disclosure of, corruption of, or loss of Confidential Information and could subject us to significant liabilities and regulatory and enforcement actions, and reputational damage. In addition, geopolitical tensions or conflicts, such as the war between Russia and Ukraine or conflicts in the Middle East, may create a heightened risk of cyberattacks. We have also outsourced elements of our information technology infrastructure, and as a result a number of third-party vendors may or could have access to our Confidential Information. If we or any of our third-party collaborators or service providers were to experience any material failure or security breach, it could result in a material disruption of our development programs, reputation, and business operations. For example, the loss of clinical study data from completed or ongoing clinical studies could result in delays in any regulatory approval or clearance efforts and significantly increase our costs to recover or reproduce the data, and subsequently commercialize the product.
We and certain of our service providers are from time to time subject to cyberattacks and security incidents. While we do not believe that we have experienced any significant system failure, accident or security breach to date, if we or our third-party collaborators, consultants, contractors, suppliers, or service providers were to suffer an attack or breach, for example, that resulted in the unauthorized access to or use or disclosure of Confidential Information, we may have to notify individuals, collaborators, government authorities, and the media, and may be subject to investigations, civil penalties, administrative and enforcement actions, and litigation, any of which could harm our business and reputation. Likewise, we rely on our third-party CROs and other third parties to conduct clinical studies, and similar events relating to their computer systems could also have a material adverse effect on our business. There can also be no assurance that our and our service providers’ cybersecurity risk management program and processes, including policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems, networks and Confidential Information.
Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. Further, the continued hybrid working environment has generally increased the attack surface available to criminals, as more companies and individuals work online and work remotely, and as such, the risk of a cybersecurity incident potentially occurring, and our investment in risk mitigations against such an incident, is increasing. Because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence.
To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or systems, or inappropriate or unauthorized access to or disclosure or use of Confidential Information, we could incur liability and suffer reputational harm, and the development and commercialization of our products could be delayed. Federal, state and international laws and regulations can expose us to enforcement actions and investigations by regulatory authorities, and potentially result in regulatory penalties, fines and significant legal liability, if our information technology security efforts fail. We may also be exposed to a risk of loss or litigation and potential liability, which could materially and adversely affect our business, results of operations or financial condition. Our insurance policies may not be