including those dealing with healthcare reform, product safety, consumer credit, privacy and information security and labor and employment, among others, or changes in existing laws and regulations, particularly those governing the sale of products and food safety and quality (including changes in labeling or disclosure requirements), federal or state wage requirements, employee rights, health care, social welfare or entitlement programs such as health insurance, paid leave programs, or other changes in workplace regulation, may result in significant added expenses or may require extensive system and operating changes that may be difficult to implement and/or could materially increase our cost of doing business. Untimely compliance or noncompliance with applicable regulations or untimely or incomplete execution of a required product recall can result in the imposition of penalties, including loss of licenses or significant fines or monetary penalties, class action litigation or other litigation, in addition to reputational damage. Additionally, changes in tax laws, the interpretation of existing laws, or our failure to sustain our reporting positions on examination could materially adversely affect our effective tax rate and could have a material adverse effect on our business, financial condition and results of operations.
Any disruptions to our information technology systems or breaches of our network security could disrupt or interrupt our operations, compromise our reputation, expose us to litigation, government enforcement actions and costly response measures and could have a material adverse effect on our business, financial condition and results of operations.
We rely on the integrity, security and successful functioning of our information technology systems and network infrastructure across our operations, including point-of-sale processing at our stores. In connection with sales, we transmit encrypted confidential credit and debit card information.
As of the end of 2017, we are compliant with the Payment Card Industry Data Security Standard (the “PCI Standard”) issued by the Payment Card Industry Security Standards Council. However, there can be no assurance that in the future we will be able to operate our facilities and our customer service and sales operations in accordance with PCI or other industry recommended or contractually required practices. We expect to incur additional expenses, and the time and effort of our information technology staff to maintain PCI compliance. Even though we are compliant with such standards, we still may not be able to prevent or timely detect security breaches.
We also have access to, collect or maintain private or confidential information regarding our customers, associates and suppliers, as well as our business. The protection of our customer, associate, supplier and company data is critical to us. The regulatory environment surrounding information security and privacy is increasingly demanding, with the frequent imposition of new and changing requirements across the many states in which we conduct our business. In addition, customers have a high expectation that we will adequately protect their personal information from cyber-attack or other security breaches. We have procedures in place to evaluate the integrity of our systems, and to safeguard such data and information. However, a significant breach of customer, employee, supplier, or company data could attract a substantial amount of negative media attention, damage our customer and supplier relationships and our reputation, and result in lost sales, fines and/or lawsuits.
An increasingly significant portion of our sales depends on the continuing operation of our information technology and communications systems, including, but not limited to, our point-of-sale system and our credit card processing systems. Our information technology, communication systems and electronic data may be vulnerable to damage or interruption from computer viruses, loss of data, unauthorized data breaches, usage errors by our associates or our contractors or other attempts to harm our systems, including cyber-security attacks or other breaches of cardholder data, earthquakes, acts of war or terrorist attacks, floods, fires, tornadoes, hurricanes, power loss and outages, computer and telecommunications failures. Some of our systems are not fully redundant, and our disaster recovery planning cannot account for all eventualities. The occurrence of intentional sabotage, unauthorized access, natural disaster, or other unanticipated problems could result in lengthy interruptions in our service. Any errors or vulnerabilities in our systems, or damage to or failure of our systems, could result in interruptions in our services, non-compliance with certain regulations, substantial remediation costs, and liability for lost or stolen information, any of which could have a material adverse effect on our business, financial condition and results of operations.
If we are unable to maintain or upgrade our information technology systems or if we are unable to convert to alternate systems in an efficient and timely manner, our operations may be disrupted or become less efficient.
We depend on a variety of information technology systems for the efficient functioning of our business. We rely on certain hardware, telecommunications and software vendors to maintain and periodically upgrade many of these systems so that we can continue to support our business. Various components of our information technology systems,