IRM: 10-K Risk Factor Changes

Table of ContentsPart I Table of Contents Part I Our customers continue to evolve the way they store records, which could impact our storage revenue. We derive substantial revenues from rental fees for the storage of physical records and computer backup media and from storage related services. Volume in and demand for our traditional storage related services has evolved as our customers adopt alternative storage technologies or as retention requirements change, which may require significantly less space than traditional physical records and tape storage; however, volumes in our Global RIM Business segment were relatively steady in 2025 and we expect them to remain relatively consistent in the near term. We can provide no assurance that our customers will continue to store most or a portion of their records as paper documents or as tapes, or that the paper documents or tapes they do store with us will require our storage related services at the same levels as they have in the past. A significant shift by our customers to storage of data through non-paper or non-tape-based technologies, whether now existing or developed in the future, could adversely affect our businesses. In addition, the digitization of records may shift our revenue mix from the more predictable storage revenue to service revenue, which is inherently more volatile. We and our customers are subject to laws and governmental regulations, including laws relating to data privacy and cybersecurity, and our customers’ demands in this area are increasing. This may cause us to incur significant expenses and non-compliance with such regulations and demands could harm our business. Our business is subject to regulation under a wide variety of laws and regulations in the jurisdictions which we operate. Although we have policies and procedures designed to comply with applicable laws and regulations, failure to comply with the various laws and regulations may result in civil and criminal liability, fines and penalties and increased costs of compliance. We and our customers are subject to numerous laws and regulations relating to data privacy and cybersecurity. These regulations are complex, change frequently and have tended to become more stringent over time. In addition, a growing number of regulatory bodies have adopted data breach notification requirements and increased enforcement of regulations regarding the use, access, accuracy and security of personal information. Finally, as a result of the continued emphasis on information security and instances in which personal information has been compromised, our customers are requesting that we take increasingly sophisticated measures to enhance security and comply with cybersecurity and data privacy regulations and that we assume higher liability under our contracts. We have an established global privacy compliance program and devote substantial resources, and may in the future have to devote significant additional resources, to facilitate compliance with global laws and regulations, our customers’ data privacy, data residency and security demands, and to investigate, defend or remedy actual or alleged violations or breaches. Any failure by us to comply with, or remedy any violations or breaches of, laws and regulations or customer requirements could negatively impact our operations, result in the imposition of fines and penalties, contractual liability and litigation, significant costs and expenses and reputational harm. Expansion into Global Digital Solutions and ALM services means that our data privacy and security risk profile is increasing. In particular, we are hosting increasing volumes of customer digital data, including sensitive and confidential data, and disposing of customer data-bearing devices. This may result in increased regulatory exposure, contractual liability and security expectations from customers. Finally, emerging AI technology, such as AI and generative AI systems, have become subject to regulation under new laws and new applications of prior existing laws which require additional resources and increase compliance risks as we integrate AI into our services. Attacks on our internal IT systems could damage our reputation, cause us to lose revenues and adversely affect our business, financial condition and results of operations. Our reputation for providing secure information storage to customers is critical to the success of our business. Our reputation or brand, and specifically, the trust our customers place in us, could be negatively impacted in the event of perceived or actual failures by us to store information securely. Although we seek to prevent and detect attempts by unauthorized users to gain access to our IT systems, and incur significant costs to do so, our IT and network infrastructure has in the past been and may in the future be vulnerable to cyberattacks and security incidents, including by state-sponsored organizations with significant financial and technological resources, breaches due to employee or contractor error, fraud or malice or other disruptions (including, but not limited to, computer viruses and other malware, denial of service and ransomware), which may involve a breach requiring us to notify regulators, clients or employees and enlist identity theft protection. Recent developments in the cybersecurity threat landscape include the use of AI and machine learning, as well as an increased number of cyber extortion and ransomware attacks. As techniques used to breach security change frequently and are generally not recognized until launched against a target, we may not be able to promptly detect that a cyber breach has occurred, or implement security measures in a timely manner or, if and when implemented, we may not be able to determine the extent to which these measures could be circumvented. Moreover, until we have migrated businesses we acquire onto our IT systems or ensured compliance with our information technology security standards, we have in the past and may in the future face additional risks because of the continued use of predecessor IT systems. We utilize remote work arrangements and outsource certain support services, including cloud storage systems and cloud computing services, to third parties, which has in the past and may in the future subject our IT and other sensitive information to additional risk. A successful breach of the security of our IT systems could lead to theft or misuse of our customers’ proprietary or confidential information or our employees’ personal information and result in third party claims against us, regulatory penalties and reputational harm. Although we maintain insurance coverage for various cybersecurity risks, there is no guarantee that all costs or losses incurred will be fully insured. Damage to our reputation could make us less competitive, which could negatively impact our business, financial condition and results of operations.

9 Table of ContentsPart I Table of Contents Part I Our customers continue to evolve the way they store records, which could impact our storage revenue. We derive substantial revenues from rental fees for the storage of physical records and computer backup media and from storage related services. Volume in and demand for our traditional storage related services has evolved as our customers adopt alternative storage technologies or as retention requirements change, which may require significantly less space than traditional physical records and tape storage; however, volumes in our Global RIM Business segment were relatively steady in 2024 and we expect them to remain relatively consistent in the near term. We can provide no assurance that our customers will continue to store most or a portion of their records as paper documents or as tapes, or that the paper documents or tapes they do store with us will require our storage related services at the same levels as they have in the past. A significant shift by our customers to storage of data through non-paper or non-tape-based technologies, whether now existing or developed in the future, could adversely affect our businesses. In addition, the digitization of records may shift our revenue mix from the more predictable storage revenue to service revenue, which is inherently more volatile. We and our customers are subject to laws and governmental regulations relating to data privacy and cybersecurity, and our customers’ demands in this area are increasing. This may cause us to incur significant expenses and non-compliance with such regulations and demands could harm our business. We and our customers are subject to numerous laws and regulations relating to data privacy and cybersecurity. These regulations are complex, change frequently and have tended to become more stringent over time. In addition, a growing number of regulatory bodies have adopted data breach notification requirements and increased enforcement of regulations regarding the use, access, accuracy and security of personal information. Finally, as a result of the continued emphasis on information security and instances in which personal information has been compromised, our customers are requesting that we take increasingly sophisticated measures to enhance security and comply with cybersecurity and data privacy regulations and that we assume higher liability under our contracts. We have an established global privacy compliance program and devote substantial resources, and may in the future have to devote significant additional resources, to facilitate compliance with global laws and regulations, our customers’ data privacy, data residency and security demands, and to investigate, defend or remedy actual or alleged violations or breaches. Any failure by us to comply with, or remedy any violations or breaches of, laws and regulations or customer requirements could negatively impact our operations, result in the imposition of fines and penalties, contractual liability and litigation, significant costs and expenses and reputational harm. Expansion into Global Digital Solutions and ALM services means that our privacy and security risk profile is increasing. In particular, we are hosting increasing volumes of customer digital data, including sensitive and confidential data, and disposing of customer data-bearing devices. This may result in increased regulatory exposure, contractual liability and security expectations from customers. Finally, emerging AI regulations, increasing use of AI and generative AI tools and their integration into our businesses may require additional resources and create additional compliance and cybersecurity risks. Attacks on our internal IT systems could damage our reputation, cause us to lose revenues and adversely affect our business, financial condition and results of operations. Our reputation for providing secure information storage to customers is critical to the success of our business. Our reputation or brand, and specifically, the trust our customers place in us, could be negatively impacted in the event of perceived or actual failures by us to store information securely. Although we seek to prevent and detect attempts by unauthorized users to gain access to our IT systems, and incur significant costs to do so, our IT and network infrastructure has in the past been and may in the future be vulnerable to attacks by hackers, including state-sponsored organizations with significant financial and technological resources, breaches due to employee error, fraud or malice or other disruptions (including, but not limited to, computer viruses and other malware, denial of service and ransomware), which may involve a breach requiring us to notify regulators, clients or employees and enlist identity theft protection. Moreover, until we have migrated businesses we acquire onto our IT systems or ensured compliance with our information technology security standards, we have in the past and may in the future face additional risks because of the continued use of predecessor IT systems. We utilize remote work arrangements and outsource certain support services, including cloud storage systems and cloud computing services, to third parties, which has in the past and may in the future subject our IT and other sensitive information to additional risk. A successful breach of the security of our IT systems could lead to theft or misuse of our customers’ proprietary or confidential information or our employees’ personal information and result in third party claims against us, regulatory penalties and reputational harm. Although we maintain insurance coverage for various cybersecurity risks, there is no guarantee that all costs or losses incurred will be fully insured. Damage to our reputation could make us less competitive, which could negatively impact our business, financial condition and results of operations. Failure to successfully integrate acquired businesses could negatively impact our balance sheet and results of operations. Strategic acquisitions are an important element of our growth strategy and the success of any acquisition we make depends in part on our ability to integrate the acquired business and realize anticipated synergies. The process of integrating acquired businesses, particularly in new markets or for new offerings, may involve difficulties and may require a disproportionate amount of our management’s attention and our financial and other resources.