ECL: 10-K Risk Factor Changes

​ We rely to a large extent upon information technology systems and infrastructure to operate our business. The size and complexity of our information technology systems and those of strategic vendors make them vulnerable to failure, malicious intrusion and random attack. Acquisitions have resulted in further de-centralization of systems and additional complexity in our systems infrastructure. Likewise, data security breaches by employees or others with permitted access to our systems or to the systems of strategic vendors pose a risk that sensitive data may be exposed to unauthorized persons or to the public. Geopolitical tensions or conflicts, such as Russia’s invasion of Ukraine, may further heighten the risk of cybersecurity attacks. While we have continually matured our security program and capabilities and have had no material incidents to date, cyber threats continue to evolve, such as with the use of artificial intelligence, resulting in sophisticated new attack methods that are increasingly automated, targeted, and difficult to defend against, and there can be no assurance that our efforts will prevent cybersecurity attacks or breaches in our systems or in the systems of strategic vendors, including cloud providers, that could cause reputational damage, business disruption or legal and regulatory costs; could result in third-party claims; could result in compromise or misappropriation of our intellectual property, trade secrets or sensitive information; or could otherwise materially adversely affect our business, including our business strategy, results of operations, or financial condition. Certain of our customer offerings include digital components, such as remote monitoring of certain customer operations. A breach of those remote monitoring systems could expose customer data giving rise to potential third-party claims and reputational damage. Additionally, it may take considerable time for us to investigate and evaluate the full impact of cyber-attacks, particularly for sophisticated attacks, which may inhibit our ability to provide prompt, full, and reliable information about cybersecurity incidents to our customers, regulators, and the public. There may also be other related challenges and risks as we complete implementation of our ERP system upgrade, and businesses which we have acquired, or may in the future acquire, may have information technology system vulnerabilities which could increase our risk of cybersecurity attacks. Although we maintain insurance, our insurance coverage may not be sufficient in type or amount to prevent or recover losses resulting from cybersecurity attacks. ​