Information Services Group (III) Risk Analysis

Our future success will depend in part on our ability to offer new services and products. To maintain our competitive position, we must continue to enhance and improve our services and products, develop or acquire new services and products in a timely manner and appropriately position and price new services and products relative to the marketplace and our costs of producing them. These new services and products must successfully gain market acceptance by addressing specific industry and business sectors and by anticipating and identifying changes in client requirements. The process of researching, developing, launching and gaining client acceptance of a new service or product, or assimilating and marketing an acquired service or product, is risky and costly. We may not be able to introduce new, or assimilate acquired, services and products successfully. Any failure to achieve successful client acceptance of new services and products could have an adverse effect on our business results.

A significant portion of our business is conducted over the internet, and we rely on the secure processing, storage and transmission of confidential, sensitive, proprietary and other types of information relating to our business operations and confidential and sensitive information about our clients and employees in our computer systems and networks, and in those of our third-party vendors. Individuals, groups, state-sponsored organization, and actors utilizing AI may take steps that pose threats to our operations, our computer systems, our employees, and our clients. The cybersecurity risks we face range from cyberattacks common to most industries, such as the development and deployment of malicious software to gain access to our networks and attempt to steal confidential information, launch distributed denial of service attacks or attempts at other coordinated disruptions, to more advanced threats that target us because of our prominence in the global research and advisory field. Ransomware risk has increased significantly in recent years and presents a significant risk of financial extortion and loss of data. Our operating model allows employees to continue to work remotely or on a hybrid basis, which magnifies the importance of the integrity of our remote access security measures. We have robust measures in place to address and mitigate cyber-related risks. Notwithstanding this, we continue to experience attack attempts against our environment. We have and continue to expect to invest in the security and resiliency of our networks and products and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure and the information they contain. These include timely detection of incidents through monitoring, training, incident response capabilities and mitigating cyber and security risks to our data, systems, products and services. However, given the complex, continuing and evolving nature of cyber and other security threats, these efforts may not be fully effective, particularly against previously unknown vulnerabilities that could go undetected for an extended period. We also face risks related to our use of third-party suppliers, with whom we may share data and operational systems. If such suppliers are affected by a cybersecurity threat or incident, it could result in not only a reduction in or loss of their ability to service us (which could be a significant component of our services to clients) but also the exposure of ISG or client data or a potential backdoor into ISG's systems and network.

Clients' failure or inability to pay for our services, whether on a timely basis or at all, could materially, adversely affect our results of operations and financial condition. As further described in Note 2 to the Consolidated Financial Statements, "Summary of Significant Account Policies – Accounts Receivable, Contract Assets and Allowance for Doubtful Accounts," the Company has been engaged in litigation with certain clients who have either failed to make payments as per the contracted payment schedule or have disputed account receivable balances for services rendered. While we maintain an allowance for doubtful accounts for estimated losses resulting from the inability of clients to pay fees or for disputes that affect our ability to fully collect billed accounts receivable, our actual experience may vary from these estimates, and there is no guarantee that such allowance will ultimately be sufficient. We may be required to record additional allowances or write offs in future periods, which, in turn, could adversely impact our financial condition and results of operation. Moreover, while the Company continues to aggressively pursue legal action and/or collection against clients who dispute charges or fail to make payments, there is no guarantee that the Company's legal actions will be successful, that actual collections from clients will reflect the Company's estimate of amounts owed, and/or that the Company will be able to recoup legal fees expended on such actions.

Our business is dependent upon continued growth in sourcing activity, the use of technology in business by our clients and prospective clients and the continued trend towards sourcing of complex information technology and business process tasks by large and small organizations. If sourcing diminishes as a management and operational tool, the growth in the use of technology slows down or the cost of sourcing alternatives rises, our business could suffer. Companies that have already invested substantial resources in developing in-house information technology and business process functions may be particularly reluctant or slow to move to a sourcing solution that may make some of their existing personnel and infrastructure obsolete.

We may choose from time to time to develop new service offerings because of market opportunities or client demands. Developing new service offerings involves inherent risks, including: - a lack of market understanding;- competition from more established market participants;- any inability to estimate demand for the new service offerings; and - unanticipated expenses to hire qualified consultants and to market our new service offerings. If we cannot manage the risks associated with new service offerings effectively, we are unlikely to be successful in these efforts, which could harm our ability to sustain profitability.

Our success depends in part upon our ability to anticipate rapidly changing technologies and market trends and to adapt our advice, services and products to meet the changing sourcing advisory needs of our clients. Our clients regularly undergo frequent and often dramatic changes. That environment of rapid and continuous change presents significant challenges to our ability to provide our clients with current and timely analysis, strategies and advice on issues of importance to them. Meeting these challenges requires the commitment of substantial resources. Any failure to continue to respond to developments, technologies and trends in a manner that meets market needs could have an adverse effect on our business results.

We currently are, and may again in the future be, subject to employment-related claims in certain of the jurisdictions in which we operate, including claims of wage and hour violations. We incur a risk of liability for claims relating to employment-related matters, contractual obligations, government inquiries and other claims. Some or all of these claims may give rise to litigation or settlements, which may cause us to incur costs or have other material adverse impacts on our financial statements. Additionally, new employment and labor laws and regulations may be proposed or adopted in the jurisdictions in which we operate that may increase the potential exposure of employers to employment-related claims and litigation. Certain clients have negotiated broad indemnification provisions regarding the services we provide. In addition, we may have liability to our clients for the action or inaction of our consultants that may cause harm to our clients or third parties. In some cases, we must indemnify our clients for certain acts of our consultants or arising from our consultants' presence on the client's job site. We may also incur fines, penalties, and losses that are not covered by insurance or negative publicity with respect to these matters.

Various statutes and rules regulate conduct in areas such as privacy, data protection, and cybersecurity that may affect our collection, use, storage, and transfer of information both abroad and in the United States. Compliance with these laws and self-regulatory codes may require us to make certain investments or may dictate that we not offer certain types of services or only offer such services after making necessary modifications. Moreover, these laws and regulations impose operational requirements, including disclosures to consumers about personal data practices, opt-out and consent choices and required contractual terms with certain third parties, and obligations to provide notice to individuals, third parties, and/or regulators in the event of certain cybersecurity incidents involving personal data. Failure to comply with these laws and self-regulatory codes may result in, among other things, civil and criminal liability, negative publicity, restrictions on further use of data, fines,  and/or liability under contractual warranties. In addition, there is an increasing public concern regarding data and consumer protection issues, with the result that the number of jurisdictions with data protection laws continues to increase and the scope of existing privacy laws and the data considered to be covered by such laws keeps expanding. Changes in these laws (including newly released interpretations of these laws by courts and regulatory bodies)may limit our client data access, use and disclosure, and may require increased expenditures by us or may dictate that we may not offer certain types of services. As a global company, ISG must comply with various international and domestic data privacy regulations such as (i) the EU and UK General Data Protection Regulation ("GDPR"), which has extra-territorial scope and substantial fines for breaches (up to 4% of global annual revenue or €20 million, whichever is greater), (ii) the California Consumer Privacy Act, which, unlike data privacy provisions enacted by other US states, covers individuals acting in a commercial or employment context not just as consumers, and (iii) the Australian Privacy Act, among others. In addition, India's Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules 2025 (the "Rules") November 13, 2025, operationalizing the Digital Personal Data Protection Act 2023 ("DPDPA") enacted by the Parliament of India in August 2023. Companies operating in India must meet the DPDPA's core compliance obligations, which includes reporting data breaches within seventy-two hours, appointing consent managers and data protection officers, and implementing systems for express user permission, within a phased twelve-to-eighteen-month timeline. Like the GDPR, the DPDPA has extra-territorial reach. The DPDPA shares many provisions with existing privacy laws, and ISG therefore anticipates that its existing processes already broadly align with the law. However, like the GDPR, failure to comply with the DPDPA may lead to substantial fines. ISG is also continuing to monitor the development of and public guidelines regarding the EU's ePrivacy Regulation to determine whether further action is required. To mitigate the risk and negative exposure of data outside ISG, we have put in place a data protection framework that includes policies, procedures, guidance and records. This includes policies and procedures for rights and usage of personal and client data.