Table of Contents CITIZENS, INC. systems, or our failure to consolidate our existing systems could have a material adverse effect on our results of operations and financial condition. Some of our information technology systems and software are mainframe-based, legacy-type systems that require an ongoing commitment of resources to maintain current standards. Our systems utilize proprietary code requiring highly skilled personnel. Due to the unique nature of our proprietary operating environment, we could have difficulty finding personnel with the skills required to provide ongoing system maintenance and development as we seek to keep pace with changes in our products and business models, information processing technology, evolving industry and regulatory standards and policyholder needs. We are continuously evaluating and enhancing systems and creating new systems and processes as our business depends on our ability to maintain and improve our technology. Due to the complexity and interconnectedness of our systems and processes, these changes, as well as changes designed to update and enhance our protective measures to address new threats, increase the risk of a system or process failure or the creation of a gap in our security measures. Any such failure or gap could adversely affect our business operations and results of operations. We store confidential information about our business and our policyholders, independent marketing firms, independent consultants and employee- agents and others on our information technology systems, including proprietary and personally identifiable information. As part of our normal business operations, we use this information and engage third-party providers, including outsourcing, cloud computing, and other business partners, that store, access, process, and transmit such information on our behalf. We devote significant resources and employ security measures to help protect our information technology systems and confidential information, and we have programs in place to detect, contain, and respond to information security incidents. However, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and may be difficult to detect for long periods of time, we and our third-party providers may be unable to anticipate these techniques or implement adequate preventative measures. In addition, hardware, software, or applications we develop or procure from third parties or through open source solutions may contain defects in design or manufacture or other problems that could unexpectedly compromise our information security. Unauthorized parties, whether within or outside our company, may disrupt or gain access to our systems, or those of third parties with whom we do business, through human error, misfeasance, fraud, trickery, or other forms of deceit, including break-ins, use of stolen credentials, social engineering, phishing, or other cyber attacks, computer viruses, malicious codes, and similar means of unauthorized and destructive tampering. We and our third-party providers experience information security incidents from time to time. There is no assurance that our security systems and measures will be able to prevent, mitigate, or remediate future incidents. A successful penetration or circumvention of the security of our information technology systems, or those of third parties with whom we do business, could cause serious negative consequences for us, including significant disruption of our operations, unauthorized disclosure or loss of confidential information, harm to our brand or reputation, loss of customers and revenues, violations of privacy and other laws, and exposure to litigation, monetary damages, regulatory enforcement proceedings, fines, and potentially criminal proceedings and penalties. If we are unaware of the incident for some time after it occurs, our exposure could increase. In addition, the costs to address or remediate systems disruptions or security threats or vulnerabilities, whether before or after an incident, could be significant. As we continue to build our digital capabilities and focus on enhancing the customer experience, the amount of information that we retain and share with third parties is likely to grow, increasing the cost to prevent data security breaches and the cost and potential consequences of such breaches. An information technology systems failure could also interfere with our ability to comply with financial reporting and other regulatory requirements, exposing us to potential disciplinary action by regulators. Although we have insurance against some cyber risks and attacks, we may be subject to litigation and financial losses that exceed our policy limits, are subject to deductibles or are not covered under any of our current insurance policies. December 31, 2019 | 10-K 18 A cyber attack or other security breach could disrupt our operations, result in the unauthorized disclosure or loss of confidential data, damage our reputation or relationships, and expose us to significant financial and legal liability, which may adversely affect our business, results of operations, or financial condition.