We are increasingly utilizing information technology systems, including with respect to administrative functions, financial and operational data, ordering, point-of-sale processing and payment and the management of our supply chain, to enhance the efficiency of our business and to improve the overall experience of our customers. We maintain confidential, proprietary and personal information about, or on behalf of, our potential, current and former customers, employees and other third parties in these systems or engage third parties in connection with storage and processing of this information. Such information includes employee, customer and third-party data, including credit card numbers, social security numbers, healthcare information and other personal information.
Our systems and the systems of our vendors and other third parties are subject to damage or interruption from power outages, computer or telecommunication failures, computer viruses, catastrophic events and implementation delays or difficulties, as well as usage errors by our employees or third-party service providers. These systems are also vulnerable to an increasing threat of rapidly evolving cyber-based attacks, including malicious software, attempts to deny access to systems or networks, attempts to gain unauthorized access to data, including through phishing emails, attempts to fraudulently induce employees or others to disclose information, the exploitation of software and operating vulnerabilities and physical device tampering/skimming at card reader units. The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently, may be difficult to detect for a long time and often are not recognized until after an attack is launched or occurs. As a result, we and such third parties may be unable to anticipate these techniques or to implement adequate preventative measures. In addition, we or such third parties may decide to upgrade existing information technology systems from time to time to support the needs of our business and growth strategy and the risk of system disruption is increased when significant system changes are undertaken.
We maintain a global cybersecurity program governed by an information security management system aligned with ISO27001 and mapped against NIST-800. The company's Chief Information Security Officer (CISO) is responsible for developing and managing the company's cybersecurity program and reporting cybersecurity matters to senior management, the Audit Committee, and the Board. We have established and maintain a cross-functional Cyber Governance Committee that is responsible for helping the CISO prioritize and manage evolving cyber risks.
We are subject to numerous laws and regulations in the United States and internationally as well as contractual obligations and other security standards, each designed to protect the personal information of customers, employees and other third parties that we collect and maintain. These laws and regulations are evolving to match changes in cyber-attacks and protection programs, which require us to review and amend the legal framework we have in place.
Because we accept debit and credit cards for payment from customers, we are also subject to various industry data protection standards and protocols, such as payment network security operating guidelines and the Payment Card Industry Data Security Standard (PCI - DSS). We are members of PCI, and we maintain a PCI certified Internal Security Assessor (ISA). In certain circumstances, payment card association rules and obligations make us liable to payment card issuers if information in connection with payment cards and payment card transactions that we hold is compromised, the liabilities for which could be substantial.
Cybersecurity related laws, regulations and obligations are increasing in complexity and number, change frequently and may be inconsistent across the various jurisdictions in which we operate. Additionally, the federal government and some states have adopted, are considering or in the future may adopt similar data protection laws. Our systems and the systems maintained or used by third parties and service providers to process data on our behalf may not be able to satisfy these changing legal and regulatory requirements, or may require significant additional investments or time to do so. If we fail to comply with these laws or regulations, we could be subject to significant litigation, monetary damages, regulatory enforcement actions or fines in one or more jurisdictions and we could experience a material adverse effect on our results of operations, financial condition and business.
During the normal course of business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition or results of operations. Any damage to, or compromise or breach of, our systems or the systems of our vendors could impair our ability to conduct our business, result in transaction errors, result in corruption or loss of accounting or other data, which could cause delays in our financial reporting, and result in a violation of applicable privacy and other laws, significant legal and financial exposure, reputational damage, adverse publicity and a loss of confidence in our security measures. Any such event could cause us to incur substantial costs, including costs associated with systems remediation, customer protection, litigation, lost revenue or the failure to retain or attract customers following an attack. The failure to properly respond to any such event could also result in similar exposure to liability. The occurrence of some or all of the foregoing could have a material adverse effect on our results of operations, financial condition, business and reputation.