We rely heavily on communications and information systems to conduct our business. Information security risks for financial institutions such as ours have increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, and terrorists, activists, and other external parties. As customer, public, and regulatory expectations regarding operational and information security have increased, our operating systems and infrastructure must continue to be safeguarded and monitored for potential failures, disruptions, and breakdowns. Our business, financial, accounting, and data processing systems, or other operating systems and facilities may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be electrical or telecommunication outages, natural disasters such as earthquakes, tornadoes, and hurricanes, disease pandemics, events arising from local or larger scale political or social matters, including terrorist acts, and as described below, cyber attacks.
As noted above, our business relies on our digital technologies, computer and email systems, software, and networks to conduct its operations. Although we have information security procedures and controls in place, our technologies, systems, networks, and our customers' devices may become the target of cyber attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss, or destruction of our or our customers' or other third parties' confidential information. Third parties with whom we do business or that facilitate our business activities, including financial intermediaries, or vendors that provide service or security solutions for our operations, and other unaffiliated third parties, could also be sources of operational and information security risk to us, including from breakdowns or failures of their own systems or capacity constraints.
While we have disaster recovery and other policies, plans and procedures designed to prevent or limit the effect of the failure, interruption or security breach of our information systems, there can be no assurance that any such failures, interruptions or security breaches will not occur or, if they do occur, that they will be adequately addressed. Our risk and exposure to these matters remains heightened because of the evolving nature of these threats. As a result, cybersecurity and the continued development and enhancement of our controls, processes, and practices designed to protect our systems, computers, software, data, and networks from attack, damage or unauthorized access remain a focus for us. As threats continue to evolve, we may be required to expend additional resources to continue to modify or enhance our protective measures or to investigate and remediate information security vulnerabilities. Disruptions or failures in the physical infrastructure or operating systems that support our businesses and clients, or cyber attacks or security breaches of the networks, systems or devices that our clients use to access our products and services could result in client attrition, regulatory fines, penalties or intervention, reputation damage, reimbursement or other compensation costs, and/or additional compliance costs, any of which could have a material effect on our results of operations or financial condition.