If a natural disaster, power outage or other event occurred that prevented us from using all or a significant portion of our headquarters or other facilities, that damaged our critical infrastructure or the critical infrastructure of our third-party suppliers, or that otherwise disrupted operations, it may be difficult or, in certain cases, impossible, for us to continue our business for a substantial period of time. The disaster recovery and business continuity plans we have in place currently are limited and are unlikely to prove adequate in the event of a serious disaster or similar event. We may incur substantial expenses as a result of the limited nature of our disaster recovery and business continuity plans, which, particularly when taken together with our lack of earthquake insurance, could have a material adverse effect on our business.
Furthermore, integral parties in our supply chain are similarly vulnerable to natural disasters or other sudden, unforeseen and severe adverse events. If such an event were to affect our supply chain, it could have a material adverse effect on our business.
We depend on our information technology systems, and any failure of these systems could harm our business. Any real or perceived security breaches, loss of data, and other disruptions or incidents could compromise the privacy, security, integrity or confidentiality of sensitive information related to our business or prevent us from accessing critical information and expose us to liability and reputational harm, which could adversely affect our business, results of operations and financial condition.
We collect and maintain data and information that is necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business, including systems infrastructure operated and maintained by our third party suppliers or providers. In the ordinary course of our business, we collect, store and transmit large amounts of confidential information, including intellectual property, proprietary business information and personal information. It is critical that we do so in a secure manner to maintain the privacy, security, confidentiality and integrity of such confidential information. We have established physical, electronic and organizational measures to safeguard and secure our systems and facilities to prevent an information compromise, and rely on commercially available systems, software, tools, and monitoring to provide security for our information technology systems and the processing, transmission and storage of digital information. We have also outsourced elements of our information technology infrastructure, and as a result a number of third-party vendors may or could have access to our confidential information. Our internal information technology systems and infrastructure, and those of our current and any future collaborators, contractors and consultants and other third parties on which we rely, are vulnerable to damage or unauthorized access or use resulting from computer viruses, malware, natural disasters, terrorism, war, telecommunication and electrical failures,denial-of-service attacks, cyber-attacks or cyber-intrusions over the Internet, hacking, phishing and other social engineering attacks, attachments to emails, persons inside our organization (including employees or contractors), lost or stolen devices, or persons with access to systems inside our organization.
The risk of a security breach or disruption or data loss, particularly through social engineering attacks, cyber-attacks or cyber-intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. In addition, the prevalent use of mobile devices that access confidential information increases the risk of data security breaches, which could lead to the loss of confidential information or other intellectual property. The costs to us to mitigate, investigate and respond to potential security incidents, breaches, disruptions, network security problems, bugs, viruses, worms, malicious software programs and security vulnerabilities could be significant, and while we have implemented security measures to protect our data security and information technology systems, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service and other harm to our business and our competitive position. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our product development programs. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Moreover, if a real or perceived security breach affects our systems (or those of our third party providers or suppliers) or results in the loss of or
32