The Hackett Group (HCKT) Risk Analysis

We use information technology and security systems to process, transmit, and store electronic information in connection with the operation of our business. We also use such systems to protect proprietary and confidential information, including that of our customers, suppliers and employees. We face risks associated with cybersecurity incidents and other significant disruptions of such systems, including denial of service or other attacks on, or accidental or willful security breaches or other unauthorized access, to our facilities or information systems; unauthorized access to or acquisition of personal information, confidential information or other data we process or maintain; or viruses, loggers, or other malfeasant code, including ransomware, in our data or software. The consequences of such loss, possible misuse of our proprietary and confidential information, or operational disruptions could include, among other things, unfavorable publicity, damage to our reputation, difficulty marketing our products, customer allegations of breach-of-contract, claims and litigation by affected parties, investigations by and other proceedings involving governmental authorities and possible financial liabilities for damages, any of which could materially adversely affect our business, financial condition, reputation and relationships with customers and partners. These cybersecurity incidents or other significant disruptions could be caused by persons inside our organization, persons outside our organization with authorized access to systems inside our organization, or by individuals outside our organization. The risk of a cybersecurity incident or disruption, particularly through cyber-attack or cyber-intrusion, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Although the cybersecurity incidents that we have experienced to date, as well as those reported to us by our third-party partners, have not had a material effect on our business, financial condition or results of operations, such incidents could have a material adverse effect on us in the future. We also rely on a number of third-party service providers to host, store or otherwise process information for us, or to provide other facilities or infrastructure that we make use of, including "cloud-based" providers of corporate infrastructure services relating to, among other things, human resources, electronic communication services, financial functions, as well as proprietary digital technology platforms, and we are therefore dependent on the security systems of these providers. These third-party entities are subject to similar risks as it relates to cybersecurity, business interruption, and systems. Employee failures, cybersecurity incidents or other unauthorized access to, or disruptions of, our service-providers' systems or viruses, loggers, ransomware or other malfeasant code in their data or software, or unauthorized access to or acquisition of any data they process or otherwise maintain for us could expose us to information loss, corruption and unavailability, operational disruptions, and misappropriation of confidential information, and could have similar consequences to us as any incidents affecting our own systems or the data we process or maintain. We and our third parties face these threats from a variety of sources, including attacks from hackers, phishing and other forms of social engineering, and human error or employee or contractor malfeasance and such threats could have a material adverse effect on our business. Because the techniques used to obtain unauthorized access to or sabotage security systems change frequently and are often not recognized until after an attack, we and our third-party service providers may be unable to anticipate the techniques or implement adequate preventative measures, thereby exposing us to material adverse effects on our business, financial condition, results of operations and growth prospects. In order to address risks to our information systems, we continue to make investments in personnel, technologies and training. Data protection laws and regulations around the world often require "reasonable," "appropriate" or "adequate" technical and organizational security measures, and the interpretation and application of those laws and regulations are often uncertain and evolving; there can be no assurance that our security measures will be deemed adequate, appropriate or reasonable by a regulator or court. Moreover, even security measures that are deemed appropriate, reasonable, and/or in accordance with applicable legal requirements may not be able to protect the information we maintain. A cybersecurity incident or other significant disruption impacting us or our third-party service providers could require a substantial level of financial resources to rectify and otherwise respond to, may be difficult to identify or address in a timely manner, and may divert management's attention and require the expenditure of significant time and resources. Such cybersecurity incidents or other significant disruptions could result in claims, increased regulatory scrutiny, or investigations, and may cause us to incur substantial fines, penalties, or other liability and related legal and other costs. Any actual or perceived cybersecurity incident or significant disruption may also interfere with our ability to comply with financial reporting requirements and harm our reputation and market position, especially given that we handle sensitive customer information. Any of the foregoing matters could harm our operating results and financial condition. While we have purchased cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses. Moreover, as cyber-attacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations.