Norfolk Southern (NSC) Risk Analysis

Because our business is dependent on the rail shipping needs of our customers, negative changes in domestic and global economic conditions,including reduced import and export volumes, could affect the producers and consumers of the freight we carry. Recessionary economic cycles and downturns in customers' business cycles, especially in market segments and industries where we have a significant concentration of customers, may substantially reduce our volumes, and lead to excess capacity in the industry, resulting in pressure on rates we are able to obtain for our services. Economic conditions could also result in bankruptcies of one or more of our customers. Changes in general economic conditions are beyond our control, and it may be difficult for us to adjust our business model. We are impacted by industrial production, inflation, unemployment, and consumer spending. We have been and may in the future be, materially impacted by adverse developments in these aspects of the economy.

The nature of our business exposes us to the potential for various claims and litigation related to labor and employment, personal injury, commercial disputes, freight loss and other property damage, and other matters. Job-related personal injury and occupational claims are subject to the Federal Employer's Liability Act (FELA), which is applicable only to railroads. FELA's fault-based tort system produces results that are unpredictable and inconsistent as compared with a no-fault worker's compensation system. The variability inherent in this system could result in actual costs being different from the liability recorded. A catastrophic rail accident, whether on our lines or another carrier's, involving any or all of release of hazardous materials, freight loss, property damage, personal injury, and environmental liability could compromise critical parts of our rail network. Losses associated with such an accident involving us could exceed our insurance coverage, resulting in a material adverse effect on our financial position or liquidity. Any material changes to current litigation trends could also have a material adverse effect on our financial position or liquidity to the extent not covered by insurance. We have obtained insurance for potential losses for third-party liability and first-party property damages; however, insurance is available from a limited number of insurers and may not continue to be available or, if available, may not be obtainable on terms acceptable to us. We are incurring significant expenditures as a result of claims and lawsuits arising from the Incident and the related Incident Proceedings, as described in "Incident Risks" above.

To conduct business, we extensively rely on information and operational technology systems. The threat landscape is vast, with potential attacks from cybercriminals, nation-states, state-sponsored actors and others including, but not limited to, service denials, unauthorized access, compromised equipment or rolling stock, extortion, or theft of data or money. As a result, our business continuity and disaster recovery plans and activities may not be sufficient for all eventualities, resulting in the potential for a data breach or significant service or operational disruption or failure involving one or more information or operational technology systems operated by us or under control of third parties, including computer hardware, software, cloud services and transportation and communications equipment. Such failures or disruptions can adversely impact our business by, among other things, preventing intercompany communications and disrupting operations that may result in direct or indirect monetary losses, damage to equipment or property, or loss of confidence in corporate competency. Any one or more of these events could have a material adverse effect on our results of operations, financial position, or operations. Although we maintain security programs designed to protect our information and operational technology systems, we are continually targeted by threat actors attempting to access our networks and we may be unable to detect or prevent a breach of our systems or disruption to our service in the future. In addition, while we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation or financial results. These potentially impactful future events could include service disruptions, unauthorized access to our systems, viruses, ransomware, and/or the compromise, acquisition, or destruction of our data. We also could be impacted by cybersecurity events targeting third parties that we rely on for business operations, including third party vendors that have access to our systems or data and third parties who provide services and are in our supply chain. Such a direct or indirect cybersecurity incident could interrupt our service, cause safety failures or operational difficulties, decrease revenues, increase operating costs, impact our efficiency, damage our corporate reputation, and/or expose us to litigation or government action or increased regulation, which could result in penalties, fines or judgments. In addition, our failure to comply with or adhere to privacy-related or data protection laws and regulations could result in government investigations and proceedings against us, or litigation, resulting in adverse reputational impacts, penalties, and legal liability.

We make significant investments in our railroad infrastructure, including railroad property, track infrastructure, locomotives, freight cars, intermodal equipment, technology, and other assets to support our network, much of which is costly and requires significant capital outlay. The amount and timing of capital investments depend on various factors, including expectations of future carload traffic. In many cases, we must make advance commitments to purchase or modify equipment prior to such equipment being needed. As a result, we must predict volume levels and other requirements and make commitments based on those projections. A significant variance in our expectations or projections could result in too much or too little equipment relative to our actual needs and volumes, thereby negatively impacting our operations or financial results.

Our growth strategy includes increasing the volume of shipments moving through our railway networks. We are reliant on the success of our strategic plans and initiatives to execute on this growth strategy, as well as to help offset increasing costs. These strategic plans include marketing, service, growth, and productivity initiatives. The timely and effective execution of our strategies are dependent upon, among other factors, (i) our ability to maintain satisfactory relations with our customers, employees, and other key stakeholders, (ii) our ability to effectively control costs, (iii) the progress and success of our safety programs and inspection technologies, and (iv) our ability to timely and effectively maintain and upgrade technology systems and other infrastructure for our railway networks. Our failure to successfully execute on our strategic initiatives may expose us to a number of risks, including, that our projected volume growth may differ from actual results, and prior capital investments based on our projections may contribute to excess capacity that could negatively impact our profitability.