Roper Technologies (ROP) Risk Factors

Our business operations are dependent upon information technology networks and systems to securely transmit, process, and store electronic information and to communicate among our locations around the world and with clients and suppliers. A shutdown of, or inability to access, one or more of our facilities, a power outage, or a failure of one or more of our information technology, telecommunications, or other systems could significantly impair our ability to perform such functions on a timely basis. Our compliance, cyber and data privacy programs, cybersecurity technology, and risk management cannot eliminate all system risk. Cyberattacks, configuration or human error, insider threat, and/or other external hazards could result in the misappropriation of assets or sensitive information, corruption of data, or operational disruption. We rely on third-party data centers and cloud platforms, such as Amazon Web Services, Google Cloud Platform, and Microsoft Azure to host certain enterprise and customer systems. Our ability to monitor such third parties' security measures and the full impact of the systemic risk is limited. If any cloud platform that we use is unavailable to us for any reason, our customers may experience service interruptions, which could significantly impact our operations, reputation, business, and financial results. Failure of our systems or those of our third-party service providers, may result in interruptions in our service and loss of data or processing capabilities, all of which may cause a loss in customers, refunds of product fees, and/or material harm to our reputation and operating results. Global cybersecurity threats are rapidly evolving and becoming increasingly more sophisticated and attacks to networks, platforms, systems, and endpoints can range from uncoordinated individual attempts to sophisticated and targeted measures known as advanced persistent threats, directed at the Company, its businesses, its customers, and/or its third-party service providers, including, but not limited to, cloud providers and providers of network management services. These may include such things as unauthorized access, phishing attacks, denial of service, data exfiltration and extortion, introduction of malware or ransomware, and other disruptive problems caused by threat actors. While we have experienced and expect to continue to experience these types of threats and incidents, none of them to date have been material to the Company. We seek to deploy measures to protect, detect, respond, and recover from cybersecurity threats, including identity and access controls, employee training, data protection, vulnerability management, incident response, secure product development, continuous monitoring of our networks, platforms, endpoints, and systems, and maintenance of ransomware resilient backup and recovery capabilities. Our customers are increasingly requiring cybersecurity protections and mandating cybersecurity standards in our products and services, and we may incur additional costs to comply with such demands. Despite these efforts, we can make no assurances that we will be able to mitigate, detect, prevent, timely and adequately respond, or fully recover from the negative effects of cyberattacks or other security compromises, and such cybersecurity incidents, depending on their nature and scope, could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data and confidential or proprietary information (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include financial loss, reputational damage, damage to our IT systems, data loss, litigation with third parties, theft of intellectual property, fines, customer attrition, diminution in the value of our investment in research and development, and increased cybersecurity protection and remediation costs due to the increasing sophistication and proliferation of threats, which in turn could adversely affect our competitiveness and results of operations. Any imposition of liability, particularly liability that is not covered by insurance or is in excess of insurance coverage, could materially harm our operating results and financial condition.

We are exposed to the risk that third parties to various arrangements who owe us money or goods and services, or who purchase goods and services from us, will not be able to perform their obligations or continue to place orders due to insolvency or financial distress. If third parties fail to perform their obligations under arrangements with us, we may be forced to replace the underlying commitments at current or above-market prices or on other terms that are less favorable to us. In such events, we may incur losses, or our results of operations, financial condition, or liquidity could otherwise be adversely affected.

If terrorist activity, armed conflict, directed cyberattacks, political instability, public health crises, such as epidemics or pandemics, or extreme weather events or other natural disasters occur in the U.S. or other locations, such events may negatively impact our operations, cause general economic conditions to deteriorate, or cause demand for our products to decline. A prolonged economic slowdown or recession could reduce the demand for our products, and therefore, negatively affect our future sales and profits. Any of these events could have a significant impact on our business, financial condition, or results of operations.

There has been, and likely will continue to be, increased regulation with respect to the collection, use, and handling of an individual's personal and financial information. Regulatory authorities around the world have passed or are considering legislative and regulatory proposals concerning data protection, privacy, and data security. In the U.S., the states of Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Delaware, Iowa, Tennessee, Indiana, and New Jersey have each passed comprehensive privacy legislation, and joined California (which further enhanced its existing privacy laws) in directly regulating the collection, use, and sharing of personal information. In addition, there has been an increased focus on industry-specific privacy laws, including in the financial, healthcare, and educational sectors. These statutes and regulations create civil penalties for violations, and in the case of California, creates a limited private right of action for data breaches, that increases the risk of data breach litigation. Absent a preemptive Federal privacy law, as more states pass privacy legislation, there is a strong possibility that we will be required to comply with a patchwork of inconsistent privacy regulations. Globally, personal information collected within the European Union and United Kingdom remains subject to the GDPR, which is a UK and European Union-wide legal framework that governs data collection, use, and sharing of an individual's personal data and creates a range of consumer privacy rights. GDPR provides significant penalties for non-compliance (up to 4% of global annual revenue) and EU data protection authorities have already issued significant fines. The interpretation and application of consumer and data protection laws and industry standards in the U.S., Europe, and elsewhere can be uncertain and currently is in flux. Cloud-based solutions may be subject to further regulation, including data localization requirements and other restrictions limiting the international transfer of data. The operational and cost impact of these cannot be fully known at this time. In addition to the possibility of fines, the application of these existing laws in a manner inconsistent with our current data and privacy practices requires that we change our data and privacy practices, which could have an adverse effect on our business and results of operations. Complying with these various laws could cause us to incur substantial costs or require us to change our business practices in a manner adverse to our business. Also, any new law or regulation imposing greater fees or taxes or restriction on the collection, use, or transfer of information or data internationally or over the Internet, could result in a decline in the use of our products and services and adversely affect our sales and results of operations. Finally, as we increasingly provide technological solutions, our customers and regulators will expect that we can demonstrate compliance with current data privacy and security regulations as well as new industry-developed standards, and our inability to do so may adversely impact sales of our solutions and services to certain customers. This is particularly true for customers in highly-regulated industries, such as the healthcare industry and government contractors, and could result in regulatory actions, fines, and legal proceedings as well as negative impacts to our brand, reputation, and business.