Public Storage: 10-K Risk Factor Changes

Our self-storage facilities are located in areas that may be subject to the direct impacts of climate change, such as increased destructive weather events like floods, fires, drought, and prolonged periods of extreme temperature or other extreme weather, which could result in significant damage to our facilities, increased capital expenditures, increased expenses, reduced revenues, or reduced demand for our facilities. Indirect impacts of climate change could also adversely impact our business, including through increased costs, such as insurance costs or regulatory compliance costs. In addition, the ongoing transition to a low-carbon economy presents certain risks for us and our customers, including stranded assets, increased costs, lower profitability, lower property values, lower household wealth, and macroeconomic risks related to high energy costs and energy shortages, among other things. Governmental, political, and societal pressures, including expectations of institutional and activist investors and other interest groups, could require us to accelerate our initiatives and, with it, the costs of their implementation. These same potential governmental, political, and social pressures could in the future result in (i) costly changes to newly developed facilities or retrofits of our existing facilities to reduce carbon emissions through multiple avenues, including changes to insulation, space configuration, lighting, heating, and air conditioning, (ii) increased energy costs as a result of transitioning to less carbon-intensive, but more expensive, sources of energy to operate our facilities, and (iii) consumers reducing their individual carbon footprints by owning fewer durable material consumer goods and other such items requiring storage, resulting in a reduced demand for our self-storage space. For example, beginning in 2026, we expect to be required to disclose our Scope 1, 2, and 3 emissions data and certain climate-related risk matters under California SB 253 and SB 261, which we expect to result in increased compliance costs. In addition, our reputation and investor relationships could be damaged as a result of our involvement with activities perceived to be causing or exacerbating climate change, as well as any decisions we make to continue to conduct or change our activities in response to considerations relating to climate change.

Our self-storage facilities are located in areas that may be subject to the direct impacts of climate change, such as increased destructive weather events like floods, fires, and drought, which could result in significant damage to our facilities, increased capital expenditures, increased expenses, reduced revenues, or reduced demand for our facilities. Indirect impacts of climate change could also adversely impact our business, including through increased costs, such as insurance costs or regulatory compliance costs. In addition, the ongoing transition to a low-carbon economy presents certain risks for us and our customers, including stranded assets, increased costs, lower profitability, lower property values, lower household wealth, and macroeconomic risks related to high energy costs and energy shortages, among other things. Consistent with our commitment to sustainability in our business operations, we have undertaken a number of initiatives to reduce emissions and energy consumption, water usage, and waste, including through our Property of Tomorrow program, pursuant to which we are upgrading all of our older properties by the end of 2025, which has already resulted in investment of approximately $370 million in improvements through December 31, 2022. In addition, we have made investments in LED lighting and the installation of solar panels of approximately $100 million since 2021 through December 31, 2022. Governmental, political, and societal pressures, including expectations of institutional and activist investors and other interest groups, could require us to accelerate our initiatives and, with it, the costs of their implementation. These same potential governmental, political, and social pressure could in the future result in (i) costly changes to newly developed facilities or retrofits of our existing facilities to reduce carbon emissions through multiple avenues, including changes to insulation, space configuration, lighting, heating, and air conditioning, (ii) increased energy costs as a result of transitioning to less carbon-intensive, but more expensive, sources of energy to operate our facilities, and (iii) consumers reducing their individual carbon footprints by owning fewer durable material consumer goods, collectibles, and other such items requiring storage, resulting in a reduced demand for our self-storage space. In addition, our reputation and investor relationships could be damaged as a result of our involvement with activities perceived to be causing or exacerbating climate change, as well as any decisions we make to continue to conduct or change our activities in response to considerations relating to climate change.

Our business is subject to risks from public health and other crises like the COVID-19 pandemic, including, among others: •risk of illness or death of our employees or customers; •negative impacts on economic conditions in our markets, which may reduce the demand for self-storage; •risk that there could be an out-migration of population from major markets where we operate; •government restrictions that (i) limit or prevent use of our facilities, (ii) limit our ability to increase rent or otherwise limit the rent we can charge, (iii) limit our ability to collect rent or evict delinquent tenants, or (iv) limit our ability to complete development and redevelopment projects; •risk that we could experience a change in the move-out patterns of our long-term customers due to economic uncertainty and increases in unemployment, which could lead to lower occupancies and rent “roll down” as long-term customers are replaced with new customers at lower rates; and 11 11 11 •risk of negative impacts on the cost and availability of debt and equity capital, which could have a material impact upon our capital and growth plans.

Our business is subject to risks from public health and other crises like the COVID-19 Pandemic, including, among others: •risk of illness or death of our employees or customers; •negative impacts on economic conditions in our markets, which may reduce the demand for self-storage; •risk that there could be an out-migration of population from certain high-cost major markets; •government restrictions that (i) limit or prevent use of our facilities, (ii) limit our ability to increase rent or otherwise limit the rent we can charge, (iii) limit our ability to collect rent or evict delinquent tenants, or (iv) limit our ability to complete development and redevelopment projects; •risk that we could experience a change in the move-out patterns of our long-term customers due to economic uncertainty and increases in unemployment, which could lead to lower occupancies and rent “roll down” as long-term customers are replaced with new customers at lower rates; and •risk of negative impacts on the cost and availability of debt and equity capital, which could have a material impact upon our capital and growth plans.

In the ordinary course of our business we acquire and store sensitive data, including personally identifiable information of our prospective and current customers and our employees. The secure processing and maintenance of this information is critical to our operations and business strategy. Although we believe we have taken commercially reasonable steps to protect the security of our confidential information, information security risks have generally increased in recent years due to the rise in new technologies and the increased sophistication and activities of perpetrators of cyberattacks. Despite our security measures, we face cybersecurity threats, including system, network, or Internet failures; cyberattacks, ransomware, and other malware; social engineering; and phishing schemes. In these cases, our information technology and infrastructure could be vulnerable and our or our customers’ or employees’ confidential information could be compromised or misappropriated. Any such cybersecurity incident, including those impacting personal information, could result in serious and harmful consequences for us or our customers. A cybersecurity incident could also interfere with our ability to comply with financial reporting requirements. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and threats, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. 13 13 13 Our confidential information may also be compromised due to programming or human error, negligence, or fraud. Although we and our third-party service providers make efforts to maintain the security and integrity of our information, including the implementation of security measures, required employee awareness training, and the existence of a disaster recovery plan, there is no guarantee that they will be adequate to safeguard against all cybersecurity incidents or misuses of data. In addition, as the regulatory environment related to information security, data collection and use, and privacy becomes increasingly rigorous, with new and changing requirements applicable to our business from multiple regulatory agencies at the local, state, federal, or international level, compliance with those requirements could also result in additional costs, or we could fail to comply with those requirements due to various reasons. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations and the services we provide to customers, or damage to our reputation, any of which could adversely affect our results of operations, reputation, and competitive position. In addition, our customers could lose confidence in our ability to protect their personal information, which could cause them to discontinue leasing our self-storage facilities. Such events could lead to lost future revenues and adversely affect our results of operations, or result in remedial and other costs, fines, or lawsuits, which could exceed any available insurance that we have procured. We have identified and expect to continue to identify cyberattacks and cybersecurity incidents on our systems and those of third parties, but none of the cyberattacks and incidents we have identified to date has had a material impact on our business or operations. While we have purchased cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses. Moreover, as cyberattacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations. Further information relating to cybersecurity risk management is discussed in Item 1C. “Cybersecurity” in this report.

In the ordinary course of our business we acquire and store sensitive data, including personally identifiable information of our prospective and current customers and our employees. The secure processing and maintenance of this information is critical to our operations and business strategy. Although we believe we have taken commercially reasonable steps to protect the security of our confidential information, information security risks have generally increased in recent years due to the rise in new technologies and the increased sophistication and activities of perpetrators of cyberattacks. Despite our security measures, we have experienced security breaches due to cyberattacks and additional breaches could occur in the future. In these cases, our information technology and infrastructure could be vulnerable and our or our customers’ or employees’ confidential information could be compromised or misappropriated. Any such breach could result in serious and harmful consequences for us or our tenants. Our confidential information may also be compromised due to programming or human error or malfeasance. We must continually evaluate and adapt our systems and processes to address the evolving threat landscape, and therefore there is no guarantee that they will be adequate to safeguard against all data security breaches or misuses of data. In addition, as the regulatory environment related to information security, data collection and use, and privacy becomes increasingly rigorous, with new and changing requirements applicable to our business from multiple regulatory agencies at the local, state, federal, or international level, compliance with those requirement could also result in additional costs, or we could fail to comply with those requirements due to various reasons such as not being aware of them. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations and the services we provide to customers, or damage our reputation, any of which could adversely affect our results of operations, reputation, and competitive position. In addition, our customers could lose confidence in our ability to protect their 15 15 15 personal information, which could cause them to discontinue leasing our self-storage facilities. Such events could lead to lost future revenues and adversely affect our results of operations, or result in remedial and other costs, fines, or lawsuits, which could be in excess of any available insurance that we have procured.

We have acquired self-storage facilities and self-storage operating companies in the past, and we expect to continue to do so in the future. We face significant competition for suitable acquisition properties and companies from other real estate investors, including operating companies and private equity funds. As a result, we may be unable to acquire the companies or additional properties we desire or the purchase price for desirable companies or properties may be significantly increased. Failures or unexpected circumstances in integrating facilities or companies that we acquire, or circumstances we did not detect or anticipate during due diligence, such as environmental matters, needed repairs or deferred maintenance, customer collection issues, assumed liabilities, turnover of critical personnel involved in acquired operating companies, or the effects of increased property tax following reassessment of a newly-acquired property, as well as the general risks of real estate investment and mergers and acquisitions, could jeopardize realization of the anticipated earnings from an acquisition.

We have acquired self-storage facilities and self-storage operating companies in the past, and we expect to continue to do so in the future. We face significant competition for suitable acquisition properties and companies from other real estate investors, including operating companies and private equity funds. As a result, we may be unable to acquire the companies or additional properties we desire or the purchase price for desirable companies or properties may be significantly increased. Failures or unexpected circumstances in integrating facilities or companies that we acquire, or circumstances we did not detect or anticipate during due diligence, such as environmental matters, needed repairs or deferred maintenance, customer collection issues, assumed liabilities, turnover of critical personnel involved in acquired operating companies, or the effects of increased property tax following reassessment of a newly-acquired property, as well as the general risks of real estate investment and mergers and acquisitions, could jeopardize realization of the anticipated earnings from an acquisition. On February 5, 2023, we disclosed that we have made a proposal to acquire all of the outstanding shares and units of Life Storage for consideration consisting of our common shares. Our public offer followed prior rebuffs by Life Storage of our attempts to negotiate privately, and on February 16, 2023, Life Storage announced it had rejected the offer. While we currently intend to engage in discussions with Life Storage, there can be no assurance that Life Storage will engage with us regarding our proposal or that we and Life Storage will agree to an acquisition transaction. Additionally, Life Storage can avail itself of various takeover defenses, including the ability unilaterally to classify its board of trustees under the Maryland Unsolicited Takeover Act (MUTA). Even if we reach an agreement with Life Storage, there can be no assurance that the conditions to closing such transaction would be satisfied in a timely manner or at all. Further, if a transaction is consummated, there can be no assurance that we will realize the benefits we hope to achieve through the transaction, and the complexities of combining the two companies may result in unknown liabilities and unforeseen increased expenses. If a transaction is not consummated, we nevertheless may incur significant costs associated with our pursuit of the transaction.

Our use of or inability to adopt and deliver new technological capabilities and enhancements in line with strategic objectives, including artificial intelligence and machine learning, may put us at a competitive disadvantage; cause us to miss opportunities to innovate, achieve efficiencies, or improve the customer experience; or adversely impact our business, reputation, results of operations, and financial condition. Legislative activity in the privacy area may also result in new laws that are applicable to us and that may hinder our business, including by restricting our use of customer data or otherwise regulating the use of algorithms and automated processing in ways that could materially affect our business or lead to significant increases in the cost of compliance. In addition, the use of emerging technologies entails risks including risks relating to the possibility of intellectual property infringement or misappropriation; data privacy; new or enhanced governmental or regulatory scrutiny, requirements, litigation, or other liability; ethical concerns; negative consumer perceptions as to automation and artificial intelligence; or other complications or liabilities that could adversely affect our business, reputation, results of operations, or financial results.

Our inability to adapt and deliver new capabilities in time with strategic requirements may cause the organization to miss market competitive timing, first mover position, or to suffer material loss due to failed technology choices or implementation.