Hayward Holdings, Inc.

Previous report

We rely on information technology systems to support our business operations. A significant disturbance or breach of our technological infrastructure, or those of our vendors or others with which we do business, could adversely affect our financial condition and results of operations. Additionally, failure to maintain the security of confidential information could damage our reputation and expose us to litigation.

Previous report

We rely upon information technology systems and networks in connection with a variety of business activities, some of which are managed by third parties, whose products, services and systems are beyond our control. We expect our reliance on information technology systems to increase as we continue to develop IoT-enabled products, such as our Omni mobile app, and implement new technologies to facilitate our operations, such as our ERP system and human resources information system, which are in the process of being implemented. As a result, our ability to operate effectively on a day-to-day basis and accurately report our results depends on a reliable technological infrastructure, which is inherently susceptible to internal and external threats, including malicious code embedded in open-source software, or misconfigurations, “bugs” or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) information technology systems and networks, products or services. We are vulnerable to interruption and breakdown by system downtime or failure, fire, natural disaster, power loss, telecommunication failures, internet failures, security breaches and other catastrophic events.

Previous report

We are subject to known and unknown vulnerabilities in our software and systems and those of third parties. We and certain of our third-party service providers have in the past experienced, and we expect in the future will continue to experience, cybersecurity attacks and other incidents that threaten the confidentiality, integrity and availability of information technology systems and networks and confidential information, including personal information, that we or third parties collect, maintain and/or process. We periodically evaluate and test the adequacy of our systems, measures, controls and procedures and perform third-party risk assessments. However, such threats have increased in frequency, scope, and potential impact in recent years. Because the techniques used to obtain unauthorized access or to sabotage systems change frequently and are often not recognized until after they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. We prioritize the remediation of identified security vulnerabilities based on known and anticipated risks, and we aim to patch vulnerabilities within reasonable timeframes. However, we are unable to comprehensively identify all vulnerabilities (particularly as related to third-party software and systems), apply patches or confirm that mitigating measures are in place, or ensure that any patches will be applied by us or third parties before exploitation by a threat actor. If attackers are able to exploit vulnerabilities before patches are installed or mitigating measures are implemented, significant compromises could impact our systems and data.

Previous report

The development of artificial intelligence technologies may exacerbate these cybersecurity risks and pose new or unknown cybersecurity risks and challenges. As a result, we may be unable to detect, investigate, remediate or recover from future attacks or incidents, or to avoid a material adverse impact to our information technology systems and networks, confidential information or business. The accidental or willful security breaches or other unauthorized access by third parties to our information technology systems or facilities, or those of our vendors and/or others with which we do business, or the existence of computer viruses, such as ransomware or other malware, in our or their data or software, and/or any other failure of our or their information technology systems could expose us to a risk of information loss, the misappropriation of proprietary and confidential information, work stoppages, reputational damage, regulatory investigations and enforcement actions, regulatory fines or penalties, litigation by affected parties, possible financial obligations for liabilities and damages related to the theft or misuse of this information and/or the defective manufacture or defective design of our products, which could expose us to liability, and/or significant incident response, system restoration or remediation and future compliance costs. In addition, while we currently maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cybersecurity incidents and information systems failures, this insurance coverage may not, depending on the specific facts and circumstances surrounding an incident, cover all losses or all types of claims that arise from an incident, or the damage to our reputation that may result from an incident. The occurrence of any of these events could have an adverse effect on our business, financial condition, results of operations and reputation. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our information technology systems and confidential information.

Previous report

Establishing and maintaining systems and processes to address these threats may increase our costs and may be mandated by regulation. For example, the California Internet of Things Security Law, which became effective in 2020, requires us to implement reasonable security measures for IoT devices, and failure to do so could expose us to penalties.