Norfolk Southern (NSC) Risk Factors

The nature of our business exposes us to the potential for various claims and litigation related to labor and employment, personal injury, commercial disputes, freight loss and other property damage, and other matters. Job-related personal injury and occupational claims are subject to the Federal Employer's Liability Act (FELA), which is applicable only to railroads. FELA's fault-based tort system produces results that are unpredictable and inconsistent as compared with a no-fault worker's compensation system. The variability inherent in this system could result in actual costs being different from the liability recorded. A catastrophic rail accident, whether on our lines or another carrier's, involving any or all of release of hazardous materials, freight loss, property damage, personal injury, and environmental liability could compromise critical parts of our rail network. Losses associated with such an accident involving us could exceed our insurance coverage, resulting in a material adverse effect on our liquidity. Any material changes to current litigation trends could also have a material adverse effect on our liquidity to the extent not covered by insurance. We have obtained insurance for potential losses for third-party liability and first-party property damages; however, insurance is available from a limited number of insurers and may not continue to be available or, if available, may not be obtainable on terms acceptable to us. We are incurring significant expenditures as a result of claims and lawsuits arising from the Incident and the related Incident Proceedings, as described in "Incident Risks" above.

Negative changes in domestic and global economic conditions, including reduced import and export volumes, could affect the producers and consumers of the freight we carry. Economic conditions could also result in bankruptcies of one or more large customers.

We rely on the capital markets to provide some of our capital requirements, including the issuance of debt instruments and the sale of certain receivables. Significant instability or disruptions of the capital markets, including the credit markets, or deterioration of our financial position due to internal or external factors could restrict or eliminate our access to, and/or significantly increase the cost of, various financing sources, including bank credit facilities and issuance of corporate bonds. Instability or disruptions of the capital markets and deterioration of our financial position, alone or in combination, could also result in a reduction of our credit rating to below investment grade, which could prohibit or restrict us from accessing external sources of short- and long-term debt financing and/or significantly increase the associated costs.

If we fail to develop, acquire or implement new technology, or otherwise fail to maintain, protect or integrate our information technology systems, we may suffer a competitive disadvantage within the rail industry and with companies providing alternative modes of transportation service.

To conduct business, we extensively rely on information and operational technology systems, and improvements in those technologies, in all aspects of our business. The threat landscape is vast and includes hobbyists, cybercriminals, nation-states and state-sponsored activities. Attacks from these entities include, but is not limited to, denial of service, unauthorized access, theft of money, and data and extortion. System upgrades, redundancy and other continuity measures may be ineffective or inadequate, and our business continuity and disaster recovery planning may not be sufficient for all eventualities. Regardless of the cause, significant disruption or failure of one or more of information or operational technology systems operated by us or under control of third parties, including computer hardware, software, cloud services and communications equipment, can result in us experiencing a service interruption, data breach, or other operational difficulties. Such failures or disruptions can adversely impact our business by, among other things, preventing intercompany communications and disrupting operations that may result in direct or indirect monetary losses, damage to equipment or property, or loss of confidence in corporate competency. These events could have a materially adverse effect on our business, reputation, results of operations and financial condition. Although we maintain comprehensive security programs designed to protect our information technology systems, including our risk-based approach to cybersecurity, our reliance on the Framework for Improving Critical Infrastructure Cybersecurity drafted by the U.S Department of Commerce's National Institute of Standards and Technology (NIST CSF) and our layered defense system, we are continually targeted by threat actors attempting to access our networks and we may be unable to detect or prevent a breach of our systems or disruption to our service in the future. While we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation or financial results. These potentially impactful future events could include service disruptions, unauthorized access to our systems, viruses, ransomware, and/or compromise, acquisition, or destruction of our data. We also could be impacted by cybersecurity events targeting third parties that we rely on for business operations, including third party vendors that have access to our systems or data and third parties who provide services and are in our supply chain. Such a direct or indirect cybersecurity incident could interrupt our service, cause safety failures or operational difficulties, decrease revenues, increase operating costs, impact our efficiency, damage our corporate reputation, and/or expose us to litigation or government action or increased regulation, which could result in penalties, fines or judgments. In addition, our failure to comply with or adhere to privacy-related or data protection laws and regulations could result in government investigations and proceedings against us, or litigation, resulting in adverse reputational impacts, penalties, and legal liability.