We rely on information technology systems that allow us to create, store, retain, transmit and otherwise process proprietary and sensitive or confidential information, including our business and financial information, and personal information regarding our employees and third-parties. We also rely on our operational technology systems to manufacture equipment for our energy projects, operate our power plants and provide our services. In addition, we often rely on third-party vendors to host, maintain, modify and update our systems.
Our and our third-party vendors' technology systems can be damaged by malicious events such as cyber and physical attacks, computer viruses, malicious and destructive code, phishing attacks, denial of service or information, as well as security breaches, natural disasters, fire, power loss, telecommunications failures, employee misconduct, human error, and third parties such as traditional computer hackers, persons involved with organized crime or foreign state or foreign state-supported actors. Furthermore, our disaster recovery planning may not be sufficient for all situations. Any failure, disruptions to or decrease in the functionality of our or our third-party vendors' operational and information technology networks could impact our ability to maintain effective internal controls over financial reporting, cause harm to the environment, the public or our employees, and significantly disrupt and damage our assets and operations or those of third parties.
We and our third-party vendors have been, and may in the future be, subject to breaches and attempts to gain unauthorized access to our information technology systems or sensitive or confidential data, or to disrupt our operations. To date, none of these breaches or attempts has, individually or in the aggregate, resulted in a security incident with a material effect on our operations or our financial condition, results of operations, liquidity, or cash flows. Despite implementation of security and control measures, we and our third-party vendors have not always been able to, and there can be no assurance that we or our third-party vendors will be able to in the future, anticipate or prevent unauthorized access to our or our third-party vendors' operational technology networks, information technology systems or data, or the disruption of our or our third-party vendors' operations. The techniques used to obtain unauthorized access to our and our third-party vendors' operational technology networks, information technology systems or data are constantly evolving and have become increasingly complex and sophisticated. Furthermore, such techniques change frequently and are often not detected until after they have been launched against a target. Therefore, we may be unable to anticipate these techniques and may not become aware in a timely manner of such a security breach, which could exacerbate any damage we experience. Such events could cause interruptions in the operation of our business, damage our operational technology networks and information technology systems, subject us to significant expenses, remediation costs, litigation, disputes, claims by third parties and regulatory actions or investigations that could result in damages, material fines and penalties, and harm to our reputation, any of which could have a material adverse effect on our financial condition, results of operations, liquidity, and cash flows. We may maintain cyber liability insurance that covers certain damages caused by cyber incidents. However, there is no guarantee that adequate insurance will continue to be available at rates that we believe are reasonable or that the costs of responding to and recovering from a cyber incident will be covered by insurance or recoverable in rates.
In addition, we are subject to various legislation, regulations, directives and guidelines from federal, state, local and foreign agencies, such as FERC, that are intended to strengthen cybersecurity measures required for information and operational technology and critical energy infrastructure and that apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal information. In California, for example, the California Consumer Privacy Act (the "CCPA") imposes obligations on businesses to be transparent with their data privacy practices and vests consumers with rights to access and delete the personal information held by businesses. These requirements will become even more robust under the California Privacy Rights Act (the "CPRA") which amends the CCPA to, among other things, extend consumer rights and business obligations to employees, and will become effective on January 1, 2023. These cybersecurity, data protection and privacy law regimes continue to evolve and may result in ever-increasing public scrutiny and escalating levels of capital expenditures, regulatory enforcement, sanctions and fines and increased costs for compliance. We have instituted security measures and safeguards to protect our operational systems and information technology assets, including certain safeguards required by FERC. Despite our implementation of security measures and safeguards, any failure to comply with FERC or any of these legal requirements could result in enforcement action against us, including fines, imprisonment of company officials and public censure, any of which could harm our reputation and have a material adverse effect on our financial condition, results of operations, liquidity, and cash flows.