We maintain information necessary to conduct our business in digital form, which is stored in data centers and on our networks and third-party cloud services, including confidential and proprietary information as well as personal information regarding our customers and employees. The secure maintenance of this information is critical to our operations. Data maintained in digital form is subject to the risk of intrusion, tampering and theft. We develop and maintain systems and processes at significant cost to prevent this from occurring, but these systems require ongoing monitoring and updating as technologies change and efforts to overcome security measures become more sophisticated. We experience non-material cybersecurity events each year that are escalated through our documented and tested Security Incident Response Plan, and although we have not experienced a significant breach in recent years, the possibility of intrusion, tampering and theft cannot be eliminated entirely. Our information technology and infrastructure are vulnerable to attacks by hackers or breaches due to employee error, malfeasance or other disruptions, and the threat landscape remains challenging with our digital business transformation, hybrid workforces, the increasing use of artificial intelligence, and interconnected supply chains expanding the risk of attack. We also perform cybersecurity due diligence and mitigate identified risks during our M&A due diligence process; however, there is still a risk that a recent or future acquisition experiences an event that could lead to a breach before risks are able to be mitigated.
Additionally, we provide confidential, proprietary and personal information to third parties when it is necessary to pursue business objectives. While we obtain written agreements and assurances that these third parties will protect this information and, where appropriate, assess the protections utilized by these third parties, we are aware of suppliers in our ecosystem who have experienced security events, and there is a risk the confidentiality of data held by third parties may be compromised.
Breaches or attacks can compromise our network, the network of a third party to whom we have disclosed confidential, proprietary or personal information, a data center where we have stored such information or a third-party cloud service provider, and the information stored there can be accessed, publicly disclosed, lost or stolen. Any access, disclosure or loss of information could disrupt our operations, result in legal claims or proceedings, damage our reputation, impair our ability to conduct business, or result in the loss or diminished value of profitable opportunities and the loss of revenue as a result of unlicensed use of our intellectual property. Contractual provisions with third parties, including cloud service providers, often substantially limit our ability to fully recover our losses. If the personal information of our customers or employees were to be misappropriated, we could incur costs to compensate our customers or employees or pay damages or fines as a result of litigation or regulatory actions and our reputation with our customers and employees could be injured, resulting in loss of business or decline in morale. Data privacy legislation and regulation have been increasing in recent years – including, for example, the General Data Protection Regulation in the EU, the Personal Information Protection Law in China, the General Data Protection Law in Brazil and the state of California's Privacy Rights Act – and although we have made reasonable efforts to comply with all applicable laws and regulations, there can be no assurance that we will not be subject to regulatory action in the event of a data privacy violation.
Cybersecurity risk and ransomware attacks on companies continue to significantly increase and there can be no assurance that we have fully protected our information, that third parties to whom we have disclosed such information or with whom we have stored such information (in data centers and in the cloud) are taking similar precautions, or that we will not experience hacking or intrusion attempts that could have a material adverse effect on our business. In addition to maintaining a robust set of endpoint, network, email and cloud security solutions, we continue to take steps to further improve the security of our networks and computer systems, including strengthening authentication; continuing to mature our zero trust architecture and strategy; furthering our advanced malware detection measures; further enhancing and testing our security incident response plan; upgrading legacy information technology systems to simplify and standardize business processes and applications; adopting a robust cloud security strategy across multiple platforms; continuously improving information technology project and portfolio management discipline; setting more aggressive key performance indicator targets and implementing appropriate mitigation measures; continuing to mature our data loss prevention framework to protect our critical data, network and site access controls; advancing our user access management program; limiting USB drive access across our company; increasing network segmentation; enhancing our focus on third party risk management; and improving our capabilities based on threat intelligence and the publicized incidents experienced by other companies, as well as ones that we have experienced despite their minimal operational or financial impact to date.