example, the SEC’s proposed climate disclosure rule would result in significant costs of compliance if final rules that are similar to the proposed rules are approved in the future. Our management and other personnel will need to devote a substantial amount of time to these compliance initiatives. Moreover, these rules and regulations will increase our legal and financial compliance costs and will make some activities more time consuming and costly. For example, we expect these rules and regulations to make it more difficult and more expensive for us to obtain director and officer liability insurance and we may be required to incur substantial costs to maintain our current levels of such coverage.
Our information technology systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer security breaches and geopolitical tensions or conflicts, such as the ongoing war in Ukraine or conflicts in the Middle East, may create a heightened risk of cyberattacks.
We collect and maintain information in digital form that is necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business. In the ordinary course of our business, we collect, store and transmit large amounts of confidential information, including intellectual property, proprietary business information, preclinical and clinical trial data, and personal information (collectively, “Confidential Information”) of customers and our employees and contractors. It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such Confidential Information.
Despite the implementation of security measures, our information technology systems as well as those of our third-party collaborators, consultants, contractors, suppliers, and service providers, may be vulnerable to damage from physical or electronic break-ins, computer viruses, misconfigurations, “bugs” or other vulnerabilities, “phishing” attacks, malware, ransomware, denial of service and other cyberattacks or disruptive incidents that could result in unauthorized access to, use or disclosure of, corruption of, or loss of Confidential Information, and could subject us to significant liabilities and regulatory and enforcement actions, and reputational damage. In addition, geopolitical tensions or conflicts, such as the war between Russia and Ukraine or the conflicts in the Middle East, may create a heightened risk of cyberattacks. We have also outsourced elements of our information technology infrastructure, and as a result a number of third-party vendors may or could have access to our Confidential Information. If we or any of our third-party collaborators or service providers were to experience any material failure or security breach, it could result in a material disruption of our development programs, reputation, and business operations. For example, the loss of clinical study data from completed or ongoing clinical studies could result in delays in any regulatory approval or clearance efforts and significantly increase our costs to recover or reproduce the data, and subsequently commercialize the product.
We and certain of our service providers are from time to time subject to cyberattacks and security incidents. While we do not believe that we have experienced any significant system failure, accident or security breach to date, if we or our third-party collaborators, consultants, contractors, suppliers, or service providers were to suffer an attack or breach, for example, that resulted in the unauthorized access to or use or disclosure of Confidential Information, we may have to notify individuals, collaborators, government authorities, and the media, and may be subject to investigations, civil penalties, administrative and enforcement actions, and litigation, any of which could harm our business and reputation. Likewise, we rely on our third-party CROs and other third parties to conduct clinical studies, and similar events relating to their computer systems could also have a material adverse effect on our business. There can also be no assurance that our and our service providers’ cybersecurity risk management program and processes, including policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems, networks and Confidential Information.
Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. Further, the continued hybrid working environment has generally increased the attack surface available to criminals, as more companies and individuals work online and work remotely, and as such, the risk of a cybersecurity incident potentially occurring, and our investment in risk mitigations against such an incident, is increasing. Because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or