Sallie Mae 2012 Annual Report Download - page 19

Our loan originations and conversions and the servicing, financial, accounting, data processing or other
operating systems and facilities that support them may fail to operate properly or become disabled as a result of
events that are beyond our control, adversely affecting our ability to process these transactions. Any such failure
could adversely affect our ability to service our clients, result in financial loss or liability to our clients, disrupt
our business, result in regulatory action or cause reputational damage. Despite the plans and facilities we have in
place, our ability to conduct business may be adversely affected by a disruption in the infrastructure that supports
our businesses. This may include a disruption involving electrical, communications, Internet, transportation or
other services used by us or third parties with which we conduct business. Notwithstanding our efforts to
maintain business continuity, a disruptive event impacting our processing locations could adversely affect our
business, financial condition and results of operations.
Our operations rely on the secure processing, storage and transmission of personal, confidential and other
information in our computer systems and networks. Although we take protective measures, our computer
systems, software and networks may be vulnerable to unauthorized access, computer viruses, malicious attacks
and other events that could have a security impact beyond our control. Our technologies, systems, networks and
those of third parties may become the target of cyber-attacks or information security breaches that could result in
the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our customers’ confidential,
proprietary and other information, or otherwise disrupt our or our customers’ or other third parties’ business
operations. Moreover, information security risks for large financial institutions such as Sallie Mae have generally
increased in recent years in part because of the proliferation of new technologies, the use of the Internet and
telecommunications technologies to conduct financial transactions, and the increased sophistication and activities
of organized crime, hackers, terrorists, activists, and other external parties.
If one or more of such events occur, personal, confidential and other information processed and stored in,
and transmitted through, our computer systems and networks, could be jeopardized or could cause interruptions
or malfunctions in our operations that could result in significant losses or reputational damage. We also routinely
transmit and receive personal, confidential and proprietary information, some through third parties. We have put
in place secure transmission capability, and work to ensure third parties follow similar procedures. An
interception, misuse or mishandling of personal, confidential or proprietary information being sent to or received
from a customer or third party could result in legal liability, regulatory action and reputational harm. In the event
personal, confidential or other information is jeopardized, intercepted, misused or mishandled, we may be
required to expend significant additional resources to modify our protective measures or to investigate and
remediate vulnerabilities or other exposures, and we may be subject to fines, penalties, litigation costs and
settlements and financial losses that are either not insured against or not fully covered through any insurance
maintained by us. If one or more of such events occur, our business, financial condition or results of operations
could be significantly and adversely affected.
We increasingly depend on third parties for a wide array of services, systems and information technology
applications. Third-party vendors are significantly involved in aspects of our software and systems development,
the timely transmission of information across our data communication network, and for other
telecommunications, processing, remittance and technology-related services in connection with our banking and
payment services businesses. We also utilize third-party debt collectors significantly in the collection of
defaulted Private Education Loans. If a service provider fails to provide the services we require or expect, or fails
to meet applicable contractual or regulatory requirements, such as service levels or compliance with applicable
laws, the failure could negatively impact our business by adversely affecting our ability to process customers’
transactions in a timely and accurate manner, otherwise hampering our ability to serve our customers, or
subjecting us to litigation and regulatory risk for matters as diverse as poor vendor oversight or improper release
or protection of personal information. Such a failure could adversely affect the perception of the reliability of our
networks and services, and the quality of our brands, and could materially adversely affect our revenues and/or
our results of operations.
17