In the ordinary course of business, the Corporation collects and stores sensitive data, including proprietary business information and personally identifiable information of our customers and employees, in systems and on networks, including those hosted by third-party vendors. The secure processing, maintenance and use of this information is critical to operations and the Corporation's business strategy. The Corporation has invested in information security technologies and continually reviews processes and practices that are designed to protect its networks, computers and data from damage or unauthorized access, including periodically those employed by third-party vendors that host the Corporation's data and applications. Despite these security measures, the Corporation's computer systems and infrastructure may be vulnerable to attacks by hackers or may be breached due to employee error, malfeasance or other disruptions. Security breaches, including cybersecurity incidents, identity theft and hacking events, have been experienced by several of the world's largest financial institutions that utilize sophisticated security tools to prevent such breaches, incidents and events. Any security breach that we experience could result in legal claims, regulatory penalties, disruption in operation, remediation expenses, costs associated with customer notification and credit monitoring services, increased insurance premiums, loss of customers and business partners and damage to the Corporation's reputation. We rely on customary security systems and procedures to provide the security and authentication necessary to effect secure collection, transmission and storage of sensitive data. These systems and procedures include but are not limited to (i) regular penetration testing of our network, (ii) regular employee training programs on sound security practices and awareness of security threats, (iii) deployment of tools to monitor our network including intrusion prevention and detection systems, electronic mail spam filters, anti-virus, anti-malware, anti-ransomware, resource logging and patch management, (iv) multifactor authentication for customers using treasury management tools and employees who access our network from outside of our premises, and (v) enforcement of security policies and procedures for the additions and maintenance of user access and rights to resources. However, because the techniques used to obtain unauthorized access, or to disable or degrade systems change frequently and are often not recognized until launched against a target, even with all reasonable security efforts, the Corporation may be unable to anticipate these techniques or to implement adequate protective measures.
Certain key applications, including our core data processing beginning in 2024, are outsourced to third party providers. If our third party providers encounter difficulties or if we have difficulty in communicating with such third parties, it will significantly affect our ability to adequately process and account for customer transactions, which would significantly affect our business operations and reputation. Additionally, in recent years banking regulators have focused on the responsibilities of financial institutions to supervise vendors and other third-party service providers. We may have to dedicate significant resources to manage risks and regulatory burdens presented by our relationship with vendors and third-party service providers, including our data processing and cybersecurity service providers.