DuPont de Nemours (DD) Risk Analysis

DuPont relies on centralized and local information technology and physical networks and systems, some of which are managed or accessible by third parties, to process, transmit and store electronic information, and to otherwise manage or support its business. Additionally, the Company collects, stores, processes, uses and has access to certain data, including proprietary business and personal information or data that is subject to privacy and security laws, regulations, orders and controls or rules imposed by customer or other contracts. The processing and storage of personal information is increasingly subject to privacy and data security regulations, and many such regulations are country- or territory-specific. The interpretation and application of data protection laws in the U.S., Europe, including the EU General Data Protection Regulation, Asia Pacific, Latin America and elsewhere are continuing to evolve and may be different across these jurisdictions. The Company seeks to implement these requirements in a compliant manner. Violations of these laws or standards could result in criminal or civil sanctions, investigations, or enforcement actions. Even the mere allegation of such violations could harm the Company's ability to do business, its results of operations, financial position and reputation. Information technology system and/or network disruptions, whether caused by acts of sabotage, employee error, malfeasance or other actions, could have an adverse impact on the Company's operations as well as the operations of the Company's customers and suppliers. Other business disruptions may also be caused by security breaches, which could include, for example, attacks on information technology and infrastructure by hackers, viruses, breaches due to employee error, malfeasance or other actions or other disruptions. DuPont and/or the Company's suppliers may fail to effectively prevent, detect and recover from these or other security breaches and, therefore, such breaches could result in misuse of the Company's assets, loss of property including trade secrets and confidential or personal information, some of which is subject to privacy and security laws, and other business disruptions. As a result, DuPont may be subject to legal claims or proceedings, reporting errors, processing inefficiencies, negative media attention, loss of sales, interference with regulatory compliance which could result in sanctions or penalties, liability or penalties under privacy laws, disruption in the Company's operations, and damage to the Company's reputation, which could adversely affect the Company's business, results of operations, financial condition and cash flows. Like other major corporations, DuPont is the target of cyber-attacks, from time to time, which include phishing, spam emails, hacking, social engineering, industrial espionage and malicious software. DuPont has determined that these attacks have resulted, and could result in the future, in unauthorized parties gaining access to certain confidential business information. However, risks from previous cybersecurity incidents have not materially affected the Company, including its strategy, results of operations or financial condition. Although, there can be no assurance that DuPont will not suffer such losses in the future. DuPont has engaged and expects to continue to engage in merger and acquisition activity. As part of preparatory and post-closing integration activities, the Company: (i) conducts a cybersecurity risk threat assessment and when evidence of a breach is uncovered, conducts additional due diligence; (ii) based on the assessment, the Company develops and implements risk mitigation plans if needed and brings the acquisition under the Company's cyber-attack/breach detection and response programs; and (iii) conducts an internal controls risk and compliance assessment and creates, as needed, responsive action plans intended to mitigate and remediate identified weaknesses in the control environment. DuPont seeks to actively manage the risks within the Company's control that could lead to business disruptions and security breaches. As these threats continue to evolve, particularly around cybersecurity, DuPont may be required to expend significant resources to enhance the Company's control environment, processes, practices and other protective measures. Despite these efforts, such events could have a material adverse effect on the Company's business, results of operations, financial condition and cash flows.