Johnson Controls International plc

Current report

Our business success depends on attracting and retaining qualified personnel.

Current report

Our ability to sustain and grow our business requires us to hire, retain and develop a high-performance, customer-centric and diverse management team and workforce. Continuous efficient and timely customer service, customer support and customer intimacy are essential to enabling customer loyalty and driving our financial results. Our growth strategies require that we pivot to new talent capability investments and build the workforce of the future, with an emphasis on developing skills in digital and consultative, outcome-based selling. Failure to ensure that we have the leadership and talent capacity with the necessary skillset and experience could impede our ability to deliver our growth objectives, execute our strategic plan and effectively transition our leadership. Any unplanned turnover or inability to attract and retain key employees could have a negative effect on our results of operations.

Current report

The nature of our business requires us to maintain a labor force that is sufficiently large enough to support our manufacturing operations to meet customer demand, as well as provide on-site services and project support for our customers. This includes recruiting, hiring and retaining skilled trade workers to support our direct channel field businesses. We have in the past, and could in the future, experience shortages for skilled or unskilled labor. The impacts of such labor shortages could limit our ability to scale our operations to meet increased demand and convert backlog into revenue, which could negatively impact our growth and results of operations.

Current report

Data privacy, identity protection and information security compliance may require significant resources and presents certain risks.

Current report

We collect, store, have access to and otherwise process certain confidential or sensitive data, including proprietary business information, customer data, personal data or other information that is subject to privacy and security laws, regulations and/or customer-imposed controls. Despite our efforts to protect such data, our business, data and our products have been and will in the future be vulnerable to security incidents, theft, misplaced or lost data, programming errors, or errors that could potentially lead to the compromise or further compromise of such data, improper use of our products, systems, software solutions or networks, unauthorized access, use, disclosure, modification or destruction of information, defective products, production downtimes and operational disruptions. During September 2023, we became aware of a cybersecurity event consisting of unauthorized access, data exfiltration and deployment of ransomware to a portion of our internal IT infrastructure. The Company determined that certain data, primarily employee, job applicant and personal information and other related data, was impacted by the incident. The Company has taken appropriate actions to notify individuals and regulatory authorities.

Current report

The actual or perceived risk of theft, loss, fraudulent use or misuse of customer, employee or other data as a result of the foregoing or any other cybersecurity incident, as well as non-compliance with applicable industry standards or our contractual or other legal obligations or privacy and information security policies regarding such data, could result in litigation and/or regulatory activity and associated fines, damages, costs, awards, or settlements. In addition, we may be required to make certain third-party notifications to individuals and regulators following the completion of our analysis of the data impacted by the cybersecurity incident.

Current report

We could face similar consequences in the future if we, our employees, our suppliers, channel partners, customers or other third parties experience the actual or perceived risk of theft, loss, fraudulent use or misuse of data, including as a result of employee error or malfeasance, non-compliance with required or expected security practices, or as a result of the imaging, software, security and other products we incorporate into our products. Such an event could lead customers to select the products and services of our competitors. Both the September 2023 cybersecurity incident and any future incidents could harm our reputation, cause unfavorable publicity or otherwise adversely affect certain existing and potential customers’ perception of the security and reliability of our services as well as our credibility and reputation, which could result in lost sales.

Current report

We operate in an environment in which there are different and potentially conflicting data privacy laws in effect in the various U.S. states and foreign jurisdictions in which we operate and we must understand and comply with each law and standard in each of these jurisdictions while ensuring the data is secured. For example, proposed regulations restricting the use of biometric security technology could impact the products and solutions offered by our security business. Similarly the Executive Order 14117, and its implementing regulations Preventing Access to Americans’ Bulk Sensitive Personal Data and US Government Related Data By Countries of Concern, may limit our ability to share information with China and other designated countries. Government enforcement actions can be costly and interrupt the regular operation of our business, and violations of data privacy laws can result in fines, reputational damage and civil lawsuits, any of which may adversely affect our business, reputation and financial statements.

Current report

Some of our contracts do not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. While we maintain general liability insurance coverage and coverage for errors or omissions, such coverage might not be adequate or otherwise protect us from liabilities or damages with respect to claims alleging compromises, including relevant to compromises of our systems or data, that such coverage will continue to be available to us on acceptable terms or at all, or that such coverage will pay future claims including claims and other costs related to the September 2023 cybersecurity incident. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business.