We rely extensively on our information technology systems, some of which are managed by third-party service providers, to manage the data, communications and business processes for all of our functions, including our marketing, sales (including e-commerce), manufacturing, logistics, customer service, accounting and administrative functions. These systems include programs and processes relating to internal communications and communications with other parties, ordering and managing materials from suppliers, converting materials to finished products, marketing and selling products to customers (including through e-commerce channels), customer order entry and order fulfillment, shipping product to customers, billing customers and receiving and applying payment, processing transactions, summarizing and reporting results of operations, complying with regulatory, legal and tax requirements, collecting and storing customer, consumer, employee, investor, and other stakeholder information and personal data, and other processes necessary to manage the Company's business.
We, and certain of our suppliers, have been, and likely will continue to be, subject to malware, computer viruses, computer hacking, attempted acts of data theft, phishing, other cyber-attacks and employee error or malfeasance related to our information technology systems. We do not believe that any of these attacks or events has had a material adverse impact on our business, but future attacks could result in a serious information security breach and have a material adverse impact on our business, results of operations or financial condition.
Increased information technology security threats and more sophisticated computer crime, including advanced persistent threats, pose a potential risk to the security of the information technology systems, networks, and services of the Company, its customers and business partners, as well as the confidentiality, availability, and integrity of the data of the Company, its customers and business partners. As a result, the Company's information technology systems, networks or service providers could be damaged or cease to function properly or the Company could suffer a loss or disclosure of business, personal or stakeholder information, due to any number of causes, including system disruptions, catastrophic events, power outages, cyber-attacks and security breaches. To help guard against these possibilities, the Company provides quarterly employee security training and maintains a compliance program with updated security policies to help evaluate and address potential threats and attacks. The Company has also conducted regular security audits by an outside firm based on the National Institute of Standards and Technology ("NIST") standards to address any potential service interruptions or vulnerabilities. Management regularly reports to the Company's Board on information security risks and audit results. Further, the Company has implemented continuity and recovery plans in the event of a disruption. However, if these plans do not provide effective protection, the Company may suffer interruptions in its ability to manage or conduct its operations, including in all of the Company's functions described above, which may adversely affect its business and results of operations. The Company maintains security risk insurance in the event of a cybersecurity breach or incident; however, the coverage may not be sufficient to cover all losses. The Company may need to expend additional resources in the future to continue to protect against, or to address problems caused by, any business interruptions or data security breaches.
Any breach of our data security, including the failure to maintain the security of confidential data and information or the misappropriation of such confidential data and information, could result in an unauthorized release or transfer of customer, consumer, user or employee information, or the loss of valuable business data or cause a disruption in our business. These events could give rise to unwanted media attention, damage our reputation, damage our customer, consumer or user relationships, and result in lost sales, fines, lawsuits, remediation costs, or otherwise adversely impact the Company's results of operations and financial condition. We may also be required to expend significant capital and other resources to protect against or respond to or alleviate problems caused by a security breach.
As we conduct our operations, we move data across national borders, and consequently we are subject to a variety of continuously evolving and developing laws and regulations in the United States and abroad regarding privacy, data protection and data security. The scope of the laws that may be applicable to us is often uncertain and may be conflicting, particularly with respect to foreign laws. For example, the European Union's General Data Protection Regulation (the "GDPR"), greatly increases the jurisdictional reach of European Union law and adds a broad array of requirements for handling personal data, including the public disclosure of significant data breaches. In addition, several U.S. states have enacted data privacy laws applicable to entities serving or employing residents and other states are doing the same. We may not be able to comply with all of these evolving compliance and operational requirements and to do so may impose significant costs that are likely to increase over time.