Company: CRAI
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001053706-25-000007
Chunk: 49

Company: CRA INTERNATIONAL, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 49
---
ifiable information and commercial, financial and consumer data. Our ability to secure and maintain the confidentiality, integrity and availability of both these systems and this information is critical to our reputation and the success of our businesses.

Our information and technology systems may be affected by or subject to events that are out of our control, including, but not limited to, the possibility of disruptions or outages or cybersecurity incidents which continue to evolve (including from emerging technologies such as AI) and pose a constant risk. Examples of these events include malicious attacks, unauthorized system intrusions by unknown third parties, viruses, malicious software, ransomware, worms, insider threats, failures in our or our third party hosting sites’ (whether hosted offsite or in the cloud) information and technology systems, unavailability of backup restoration, disruptions in the Internet or electricity grids, natural disasters, and terrorism. Any of these events could disrupt our or our client’s business operations or cause us or our clients to incur unanticipated losses, including the costs of investigating and remediating any such event and any fines/settlements related thereto, as well as reputational damage, any of which could have a material adverse effect on our business and results of operations. In the past we have experienced, and we anticipate we will continue to experience cybersecurity threats to our systems.

In addition, our or our clients' sensitive, confidential or proprietary information could be compromised, corrupted, or lost whether intentionally or unintentionally, by various causes such as an inadvertent disclosure or cybersecurity incident (as described above). This client information could be compromised or corrupted because of groups that include without limitation our employees, outside consultants, vendors, or rogue third-party "hackers" or enterprises (including nation-state sponsored groups). Any unauthorized access, corruption, or loss of clients’ information could result in our suffering claims, fines, damages, losses or reputational damage, any of which could have a material adverse effect on our business and results of operations.

Further, we also must comply with applicable U.S. and foreign privacy laws and regulations, including the General Data Privacy Regulation ("GDPR") in the European Union and its United Kingdom equivalent, laws that adopt the GDPR as a model 

12

(such as Brazil's General Law for the Protection of Privacy), and U.S. state and federal laws such as the California Consumer Protection Act, and these laws are becoming increasingly complex and vary by jurisdiction. In addition to directly applying, our clients impose contractual obligations regarding compliance with these laws. The costs of complying with these laws and any fines