recovery plans may prove to be inadequate. We may be subject to system failures and outages that might impact our revenues and relationships with clients. In addition, we will be subject to risk in the event that systems of our clients, business partners, vendors and other third parties are subject to failures and outages.
We rely on third-party service providers for certain aspects of our business, including for certain information systems, stockholder services, technology and administration. Our systems, or those of our third-party providers, may fail or operate slowly, causing one or more of the following, which may not in all cases be covered by insurance:
| • | | unanticipated disruptions in service to our clients; |
| • | | litigation or other client claims; and |
We may experience additional systems failures in the future from power or telecommunications failures, acts of God or war, weather-related events, terrorist attacks, human error, natural disasters, fire, power loss, sabotage, cyber-attacks, hardware or software malfunctions or defects, computer viruses, intentional acts of vandalism and similar events. Any system failure that causes an interruption in service or decreases the responsiveness of our service could damage our reputation, business and brand name.
Malicious cyber-attacks and other adverse events affecting our operational systems or infrastructure, or those of third parties, could disrupt our business, result in the disclosure of confidential information, damage our reputation and cause losses or regulatory penalties.
Developing and maintaining our operational systems and infrastructure is challenging, particularly as a result of rapidly evolving legal and regulatory requirements and technological shifts. Our financial, accounting, data processing or other operating and compliance systems and facilities may fail to operate properly or become disabled as a result of events that are wholly or partially beyond our control, such as a malicious cyber-attack or other adverse events, which may adversely affect our ability to provide services.
In addition, our operations rely on the secure processing, storage and transmission of confidential and other information on our computer systems and networks. Although we take protective measures such as software programs, firewalls and similar technology, to maintain the confidentiality, integrity and availability of our and our clients’ information, and endeavor to modify these protective measures as circumstances warrant, the nature of cyber threats continues to evolve. As a result, our computer systems, software and networks may be vulnerable to unauthorized access, loss or destruction of data (including confidential client information), account takeovers, unavailability or disruption of service, computer viruses, acts of vandalism, or other malicious code, cyber-attack and other adverse events that could have an adverse security impact. Despite the defensive measures we have taken, these threats may come from external factors such as governments, organized crime, hackers, and other third parties such as outsource or infrastructure-support providers and application developers, or may originate internally from within us.
We also face the risk of operational disruption, failure, termination or capacity constraints of any of the third parties that facilitate our business activities. Such parties could also be the source of a cyber-attack on or breach of our operational systems, data or infrastructure.
There have been an increasing number of cyber-attacks in recent years in various industries, and cyber-security risk management has been the subject of increasing focus by our regulators. If one or more cyber-attacks occur, it could potentially jeopardize the confidential, proprietary and other information processed and stored in, and
58