Information technology and application systems can streamline many business processes and ultimately reduce the cost of operations, however, technology initiatives present certain risks. Our business is dependent upon our employees and outsources ability to perform, in an efficient and uninterrupted fashion, necessary business functions. Like all companies, our information technology systems are vulnerable to data breaches, interruptions or failures due to events that may be beyond our control, including, but not limited to, natural disasters, theft, terrorist attacks, computer viruses, hackers and general technology failures. Our information technology systems include the Internet and third-party hosted services. We use information systems to process financial information and results of operations for internal reporting purposes and for regulatory financial reporting, legal and tax requirements. We also use information systems for electronic communications with customers and our various locations.
A shutdown or inability to access one or more of our facilities, a power outage, a security breach, or a failure of one or more of our information technology, telecommunications or other systems could significantly impair our ability to perform such functions on a timely basis. These incidents could be caused by malicious or disruptive software, computer hackers, rogue employees, cyber-attacks, failures of telecommunications systems or other catastrophic events. If sustained or repeated, such a business interruption, system failure or service denial could result in a deterioration of our ability to write and process business, provide customer service, pay claims in a timely manner or perform other necessary business functions. Furthermore, a significant portion of the communications between our employees and our business, banking and investment partners depends on information technology and electronic information exchange. In addition, we may suffer financial and reputational damage because of lost or misappropriated confidential information belonging to us, and may become subject to legal action and increased regulatory oversight. We could also be required to spend significant financial and other resources to remedy any damage caused to repair or replace information systems.
We believe that we have established and implemented appropriate security measures, controls and procedures to safeguard our information technology systems and to prevent unauthorized access to such systems and any data processed and/or stored in such systems, and we periodically employ third parties to evaluate and test the adequacy of such systems, controls and procedures. In addition, we have established a business continuity plan which is designed to ensure that we are able to maintain all aspects of our key business processes functioning in the midst of certain disruptive events, including any disruptions to or breaches of our information technology systems. We continue to make investments in technologies, cyber-insurance and training. Our business continuity plans are tested and evaluated for adequacy. Despite these safeguards, disruptions to and breaches of our information technology systems are possible and may negatively impact our business.
Like most major corporations, the Company's information systems are a target of attacks. Although we have experienced no known material or threatened cases involving unauthorized access to our information technology systems and data or unauthorized appropriation of such data to date, we have no assurance that such technology breaches will not occur in the future.
Additionally, some of our subsidiaries collect, use, store, transmit, retrieve, retain and otherwise process confidential and personally identifiable information in their information systems in and across multiple jurisdictions, and they are subject to a variety of confidentiality obligations and privacy, data protection and information security laws, regulations, orders and industry standards in the jurisdictions in which they do business. The regulatory environment surrounding information security, data privacy and cybersecurity is evolving and increasingly demanding. A number of our subsidiaries are subject to numerous U.S. federal and state laws and non-U.S. regulations governing the protection of personally identifiable and confidential information of their customers and employees. On October 24, 2017, the NAIC adopted an Insurance Data Security Model Law, which requires licensed insurance entities to comply with detailed information security requirements. The NAIC model law has been adopted by certain states, including Vermont, which may raise compliance costs or increase the risk of noncompliance, and noncompliance could subject our insurance subsidiaries to regulatory enforcement actions and penalties, as well as reputational harm. Any such events could potentially have an adverse impact on our insurance subsidiaries' business, results of operations, financial condition and cash flows.
Because the interpretation and application of many privacy and data protection laws along with contractually imposed industry standards are uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our insurance subsidiaries' existing data management practices or the features of their services and platform capabilities. Any failure or perceived failure by our insurance subsidiaries, or any third parties with which they do business, to comply with their posted privacy policies, changing consumer expectations, evolving laws, rules and regulations, industry standards, or contractual obligations to which they or such third parties are or may become subject, may result in actions or other claims against our insurance subsidiaries by governmental entities or private actors, the expenditure of substantial costs, time and other resources or the incurrence of significant fines, penalties or other liabilities. In addition, any such action, particularly to the extent our insurance subsidiaries were found to be guilty of violations or otherwise liable for damages, would damage their reputation and adversely affect their business, financial condition and results of operations.