Iron Mountain 10-K 2024-12-31

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, DC 20549

FORM 10-K

Commission File Number 1-13045

IRON MOUNTAIN INCORPORATED

(Exact name of Registrant as Specified in Its Charter)

Delaware

(State or other jurisdiction of incorporation)

85 New Hampshire Avenue, Suite 150

Portsmouth, New Hampshire

(Address of principal executive offices)

23-2588479

(I.R.S. Employer Identification No.)

03801

(Zip Code)

617-535-4766

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically, every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, smaller reporting company, or an emerging growth company. See the definitions of "large accelerated filer", "accelerated filer", "smaller reporting company" and "emerging growth company" in Rule 12b-2 of the Exchange Act. (Check one):

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. Yes ☒ No ☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to § 240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

As of June 30, 2024, the aggregate market value of the Common Stock of the registrant held by non-affiliates of the registrant was approximately $25.7 billion based on the closing price on the New York Stock Exchange on such date.

Number of shares of the registrant’s Common Stock at February 7, 2025: 293,740,905

DOCUMENTS INCORPORATED BY REFERENCE

Certain information required in Items 10, 11, 12, 13 and 14 of Part III of this Annual Report on Form 10-K (the "Annual Report") is incorporated by reference from our definitive Proxy Statement for our 2025 Annual Meeting of Stockholders (our "Proxy Statement") to be filed with the Securities and Exchange Commission (the "SEC") within 120 days after the close of the fiscal year ended December 31, 2024.

IRON MOUNTAIN INCORPORATED

2024 FORM 10-K ANNUAL REPORT

TABLE OF CONTENTS

ii

References in this Annual Report on Form 10-K for the year ended December 31, 2024 (this "Annual Report") to "the Company", "Iron Mountain", "we", "us" or "our" include Iron Mountain Incorporated, a Delaware corporation, and its predecessor, as applicable, and its consolidated subsidiaries, unless the context indicates otherwise.

CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS

We have made statements in this Annual Report that constitute "forward-looking statements" as that term is defined in the Private Securities Litigation Reform Act of 1995 and other securities laws. These forward-looking statements concern our current expectations regarding our future results from operations, economic performance, financial condition, goals, strategies, investment objectives, plans and achievements. These forward-looking statements are subject to various known and unknown risks, uncertainties and other factors, and you should not rely upon them except as statements of our present intentions and of our present expectations, which may or may not occur. When we use words such as "believes", "expects", "anticipates", "estimates", "plans", "intends", "pursue", "will" or similar expressions, we are making forward-looking statements. Although we believe that our forward-looking statements are based on reasonable assumptions, our expected results may not be achieved, and actual results may differ materially from our expectations. In addition, important factors that could cause actual results to differ from expectations include, among others:

• our ability or inability to execute our strategic growth plan, including our ability to invest according to plan, grow our businesses (including through joint ventures or other co-investment vehicles), incorporate alternative technologies (including artificial intelligence ("AI")) into our offerings, achieve satisfactory returns on new product offerings, continue our revenue management, expand and manage our global operations, complete acquisitions on satisfactory terms, integrate acquired companies efficiently and transition to more sustainable sources of energy;

• changes in customer preferences and demand for our storage and information management services, including as a result of the shift from paper and tape storage to alternative technologies that require less physical space or services activity;

• the costs of complying with and our ability to comply with laws, regulations and customer requirements, including those relating to data privacy and cybersecurity issues, as well as fire and safety and environmental standards;

• the impact of attacks on our internal information technology ("IT") systems, including the impact of such incidents on our reputation and ability to compete and any litigation or disputes that may arise in connection with such incidents;

• our ability to fund capital expenditures;

• the impact of our distribution requirements on our ability to execute our business plan;

• our ability to remain qualified for taxation as a real estate investment trust for United States federal income tax purposes ("REIT");

• changes in the political and economic environments in the countries in which we operate and changes in the global political climate;

• our ability to raise debt or equity capital and changes in the cost of our debt;

• our ability to comply with our existing debt obligations and restrictions in our debt instruments;

• the impact of service interruptions or equipment damage and the cost of power on our data center operations;

• the cost or potential liabilities associated with real estate necessary for our business;

• unexpected events, including those resulting from climate change or geopolitical events, could disrupt our operations and adversely affect our reputation and results of operations;

• failures to implement and manage new IT systems;

• other trends in competitive or economic conditions affecting our financial condition or results of operations not presently contemplated; and

• the other risks described in our periodic reports filed with the SEC, including under the caption "Risk Factors" in Part I, Item 1A of this Annual Report.

Except as required by law, we undertake no obligation to update any forward-looking statements appearing in this report.

iii

PART I

BUSINESS OVERVIEW

Iron Mountain Incorporated, a Delaware corporation ("IMI"), was founded in an underground facility near Hudson, New York in 1951 where it stored business records. Today, we are a global leader in information management services, and we are trusted by more than 240,000 customers in 61 countries, including approximately 95% of the Fortune 1000, to help unlock value and intelligence from their assets through services that transcend the physical and digital worlds. Our broad range of solutions address their information management, digital transformation, information security, data center and asset lifecycle management (“ALM”) needs. Our longstanding commitment to safety, security, sustainability and innovation in support of our customers underpins everything we do. We currently serve customers across an array of market verticals — commercial, legal, financial, healthcare, technology, insurance, life sciences, energy, business services, entertainment and government organizations.

We are listed on the New York Stock Exchange (the "NYSE") and are a constituent of the Standard & Poor’s 500 Index, the Morgan Stanley Capital International ("MSCI") REIT index and the FTSE EPRA Nareit Global Real Estate Index. As of December 31, 2024, we were number 604 on the Fortune 1000. We have been organized and have operated as a REIT beginning with our taxable year ended December 31, 2014.

BUSINESS STRATEGY

OVERVIEW

Our company has been a market leader in the physical ecosystem supporting information storage and retrieval, as most businesses have relied on paper documents or computer tapes to store their valuable information. Over time, customers are increasing their digital information, with the new information storage ecosystem being a hybrid of physical and digital media. We have evolved our business to meet our customers' needs while remaining focused on driving growth supported by our four pillars outlined below.

Part I

PROJECT MATTERHORN

In September 2022, we announced a global program designed to accelerate the growth of our business ("Project Matterhorn"). Project Matterhorn investments focus on transforming our operating model to a global operating model. Project Matterhorn focuses on the formation of a solution-based sales approach that is designed to allow us to optimize our shared services and best practices to better serve our customers' needs. We are investing to accelerate growth and to capture a greater share of the large, global addressable markets in which we operate. We have incurred approximately $378.5 million in Restructuring and other transformation costs from the inception of Project Matterhorn through December 31, 2024. We expect to incur approximately $150.0 million in costs related to Project Matterhorn during the year ending December 31, 2025, at which point the program is expected to be completed. Costs are comprised of (1) restructuring costs, which include (i) site consolidation and other related exit costs, (ii) employee severance costs and (iii) certain professional fees associated with these activities, and (2) other transformation costs, which include professional fees such as project management costs and costs for third party consultants who are assisting in the enablement of our growth initiatives. Total costs related to Project Matterhorn during the years ended December 31, 2024 and 2023 were approximately $161.4 million and $175.2 million, respectively.

BUSINESS SEGMENTS

The amount of revenues derived from our business segments and other relevant data, including financial information about geographic areas and product and service lines, for the years ended December 31, 2024, 2023 and 2022, are set forth in Note 11 to Notes to Consolidated Financial Statements included in this Annual Report.

The Global Records and Information Management ("Global RIM") Business segment includes several distinct offerings.

Records Management, stores physical records and provides information services, vital records services, courier operations, and the collection, handling and disposal of sensitive documents ("Records Management") for customers in 61 countries around the globe.

Data Management, provides storage and rotation of backup computer media as part of corporate disaster recovery plans, including service and courier operations, server and computer backup services and related services offerings ("Data Management").

Global Digital Solutions, develops, implements and supports comprehensive storage and information management solutions for the complete lifecycle of our customers’ information, including the management of physical records, conversion of documents to digital formats and digital storage of information ("Global Digital Solutions"). In August 2024, we launched the InSight Digital Experience Platform (also referred to as DXP), a secure, software-as-a-service platform designed to automate customer workflows, enhance data accessibility, ensure audit compliance and optimize customer data for AI applications.

Secure Shredding, includes the scheduled pick-up of office records that customers accumulate in specially designed secure containers we provide and is a natural extension of our hardcopy records management operations, completing the lifecycle of a record. Through a combination of shredding facilities and mobile shredding units consisting of custom built trucks, we are able to offer secure shredding services to our customers.

Media and Archive Services, includes entertainment and media services, which help industry clients store, safeguard and deliver physical media of all types, and provides digital content repository systems that house, distribute and archive key media assets.

Consumer Storage, provides on-demand, valet storage for consumers ("Consumer Storage") utilizing data analytics and machine learning to provide effective customer acquisition and a convenient and seamless consumer storage experience.

Part I

The Global Data Center Business segment provides enterprise-class data center facilities and hyperscale-ready capacity to protect mission-critical assets and ensure the continued operation of our customers’ IT infrastructure with secure, reliable and flexible data center options. The world’s most heavily regulated organizations have trusted us as a data center operator for over 20 years, with five of the largest global hyperscalers among our customers.

Corporate and Other consists primarily of our ALM and Fine Arts businesses and other corporate items ("Corporate and Other").

ALM, provides hyperscale and corporate IT infrastructure managers with services and solutions that enable the decommissioning, data erasure, processing and disposition, and recycling or sale of IT hardware and component assets. ALM services are enabled by: secure logistics, chain of custody and complete asset traceability practices, environmentally-responsible asset processing and recycling, and data sanitization and asset refurbishment services that enable value recovery through asset remarketing. In addition, ALM also offers workplace IT asset management services including storage, configuration, deployment, device support, end-of-life disposition and recycling or sale of employee IT devices. Our ALM services focus on protecting and eradicating customer data while maintaining strong, auditable and transparent chain of custody practices.

Fine Arts, provides technical expertise in the handling, installation and storing of art ("Fine Arts").

Corporate and Other also includes costs related to executive and staff functions, including finance, human resources and IT, which benefit the enterprise as a whole.

Part I

BUSINESS ATTRIBUTES

Our business has the following attributes:

Large, Diversified, Global Business			The world’s most heavily regulated organizations trust us with the storage of their records. Our mission-critical storage offerings and related services generated approximately $6.1 billion in annual revenue in 2024. Our business has a highly diverse customer base of more than 240,000 customers - with no single customer accounting for more than approximately 1% of revenue during the year ended December 31, 2024 - and operates in 61 countries globally. This presents a significant cross-sell opportunity for our expanding solutions, including digital, data center and ALM.
Recurring, Durable Revenue Stream			A majority of our revenue is recurring in nature. In our Records Management business, our contracted storage rental fee agreements generally range from one to five years in length. As of December 31, 2024, we stored more than 730 million cubic feet of physical volume and we have consistently experienced strong customer retention levels. In our Global Data Center Business, our lease durations vary by customer, with a weighted average lease expiration of 10.6 years as of December 31, 2024.
Comprehensive Information Management Solution			As an S&P 500 REIT with approximately 1,350 locations globally and with offerings spanning physical storage, digitization solutions and digital storage, we are positioned to provide a holistic offering to our customers. We are able to cater to our customers’ physical and digital needs and to help guide their digital transformation journey.
Significant Owner and Operator of Real Estate			We operate approximately 98 million square feet of real estate worldwide. Our owned real estate footprint spans to over 24 million square feet.
Limited Revenue Cyclicality			Historically, economic downturns have not significantly affected our storage rental business. Due to the durability of our total global physical volumes, the success of our revenue management initiatives and the growth of our Global Data Center Business, we believe we can continue to grow organic storage rental revenue over time.
Shifting Revenue Mix			We have identified a number of areas where we see opportunity for growth as we position ourselves to unlock greater value for our customers. These business lines, including Global Data Center, ALM and Global Digital Solutions, represent markets with strong, secular growth.

Part I

In addition, our Global Data Center Business has the following attributes:

Large Data Center Platform with Significant Expansion Opportunity			As of December 31, 2024, we had 416 MW of leasable capacity with an additional 864 MW under construction or held for development.
Differentiated Compliance and Security			We offer comprehensive compliance support as well as physical and cybersecurity. Our Security-in-Depth strategy integrates both technical and human security measures, with oversight provided by senior security leaders with military and public sector backgrounds. As of December 31, 2024, our data center portfolio has achieved numerous certifications and received third party assurance reports, making it one of the most comprehensive compliance programs in the industry. These certifications and reports on compliance include the global ISO 27001, ISO 22301, ISO 9001, SOC 2 and PCI-DSS standards, as well as HIPAA, NIST 800-53 and FISMA HIGH in the United States. The program also includes enterprise-wide certified ISO 14001 and 50001 environmental and energy management systems and complies with ISO 14064 for greenhouse gas emissions, supporting our commitment to sustainability.
Efficient Access and Flexibility			We have the ability to provide customers with a range of deployment options from one cabinet to an entire building, leveraging our global portfolio of hyperscale-ready and underground data centers. We also provide access to numerous carriers, cloud providers and peering exchanges with migration support.
100% Clean Energy Data Centers			We have matched 100% of the energy consumption in our data centers with clean energy annually since 2017. This approach enables our Green Power Pass offering, which allows customers to report the power they consume at any Iron Mountain Data Center as clean power in their public reporting, making Iron Mountain a key part of their decarbonization roadmaps and goals. Our data center business is a founding signatory to the UN Compact on 24/7 Carbon-Free Energy (“CFE”), which seeks hour-by-hour matching of site consumption with local CFE by 2040.

COMPETITION

We face competition from numerous storage and information management services providers globally, as well as storage and information management services that are managed and operated internally by organizations. Competition for records and information customers is driven by factors such as pricing, reputation and reliability, the quality and security of storage solutions and the scope and scale of technology. While the majority of our competitors operate in only one market or region, we believe we provide a differentiated global offering that competes effectively in these areas.

We also compete with numerous data center developers, owners and operators, many of whom own properties comparable to ours in several of the same metropolitan areas where our facilities are located. We believe that competition for data center customers is based on availability of power, security measures, location, connectivity and rental rates, and we are confident in our ability to compete effectively in each of these areas. Additionally, we believe our strong brand, global footprint and excellent commercial relationships empower us to compete successfully and provide significant cross-selling opportunities with our existing customer base.

In our ALM business, we compete with both hyperscalers and individual corporate clients who manage their own asset recycling, disposition and management, in addition to external competitors.

HUMAN CAPITAL MANAGEMENT

EMPLOYEES

As of December 31, 2024, we employed approximately 11,150 employees in the United States and approximately 17,700 employees outside of the United States. As of December 31, 2024, approximately 375 employees were represented by unions in North America and approximately 1,375 employees were represented by unions in Latin America. All union employees are currently under renewed labor agreements or operating under an extension agreement.

Part I

BENEFIT PROGRAMS

We provide our employees with benefits that are designed to support their overall physical, financial, emotional and social well-being. These benefits vary by location but generally include health and welfare benefits, paid time off and programs to support financial security. Additionally, employees are able to access emotional well-being resources through global employee assistance programs. Certain unionized employees receive benefits through unions and are not eligible to participate in our benefit programs. In addition to base compensation and other usual benefits, a significant portion of full-time employees participate in some form of incentive-based compensation program that provides payments based on revenues, profits or attainment of specific objectives for the unit in which they work.

COMPANY CULTURE

We are committed to making a meaningful impact on our customers, our people and our business by cultivating a culture that is firmly grounded in our values: Acting with Integrity, Owning Safety and Security, Building Customer Value, Taking Ownership and Promoting Inclusion and Teamwork.

While we foster an environment of learning, collaboration, diversity and wellbeing, we know culture truly thrives in the everyday experience of working at Iron Mountain.

Our culture encourages open communication and innovation while fostering trust, engagement and exceptional performance. We evaluate this through regular employee surveys and by leveraging data to gain a deeper understanding of our global workforce, and how they work. These insights collectively enable us to drive enhanced employee engagement, measure effectiveness and refine our approach for sustained success.

Led by our President and CEO, William Meaney, our Inclusive Leadership Alliance (the "Alliance") includes members of the Executive Leadership Team and plays a pivotal role in advancing our culture and driving growth. The Alliance reviews and supports key initiatives, monitors progress toward enterprise goals, ensures accountability through measurable targets and communicates achievements to stakeholders.

Our volunteer-based global employee resource groups play an essential role in supporting talent attraction, retention and development, and serving as valuable allies across our company. Each group is sponsored by one or more members of Iron Mountain’s Executive Leadership Team.

COMMUNITY INVOLVEMENT

We are committed to integrating responsible and sustainable practices throughout our organization to help our operations have a positive impact on the environment and the communities in which we operate. We aim to give back to the communities where we live and work and believe that this commitment helps in our efforts to attract and retain employees. We offer philanthropic support to our global community through our Living Legacy Initiative, which is our commitment to help preserve and make accessible cultural and historical information and artifacts. We encourage volunteerism in the communities in which we live and work through our Moving Mountains volunteer program, offering paid time off for employees to help community-based and civic-minded organizations.

INSURANCE

For strategic risk transfer purposes, we maintain a comprehensive insurance program with insurers that we believe to be reputable and which have adequate capitalization in amounts that we believe to be appropriate. Property insurance is purchased on a comprehensive basis, including flood and earthquake (including excess coverage), subject to certain policy conditions, sublimits and deductibles. Property is insured based upon the replacement cost of real and personal property, including leasehold improvements, business income loss and extra expense. Other types of insurance that we carry, which are also subject to certain policy conditions, sublimits and deductibles, include medical, workers’ compensation, general liability, umbrella, automobile, professional, cyber, warehouse legal liability and directors’ and officers’ liability policies.

GOVERNMENT REGULATION

We are required to comply with numerous laws and regulations covering a wide variety of subject matters which may have a material effect on our capital expenditures, earnings and competitive position.

Part I

For example, some of our currently and formerly owned or leased properties were previously used by entities other than us for industrial or other purposes, or were affected by waste generated from nearby properties, that involved the use, storage, generation and/or disposal of hazardous substances and wastes, including petroleum products. In some instances, this prior use involved the operation of underground storage tanks or the presence of asbestos-containing materials. Where we are aware of environmental conditions that require remediation, we undertake appropriate activity, in accordance with all legal requirements. Although we have from time to time conducted limited environmental investigations and remedial activities at some of our former and current facilities, we have not undertaken environmental reviews of all of our properties. We therefore may be potentially liable for environmental costs and may be unable to sell, rent, mortgage or use contaminated real estate owned or leased by us. Under various federal, state and local environmental laws, we may be liable for environmental compliance and remediation costs to address contamination, if any, located at owned and leased properties as well as damages arising from such contamination, whether or not we know of, or were responsible for, the contamination, or the contamination occurred while we owned or leased the property. Environmental conditions for which we might be liable may also exist at properties that we may acquire in the future. In addition, future regulatory action and environmental laws may impose costs for environmental compliance that do not exist today.

We transfer a portion of our risk of financial loss due to currently undetected environmental matters by purchasing an environmental impairment liability insurance policy, which covers all owned and leased locations. Coverage is provided for both liability and remediation costs.

In addition, we are subject to numerous laws and regulations relating to data privacy and cybersecurity, which are complex, change frequently and have tended to become more stringent over time. We have an established global privacy compliance framework and devote substantial resources, and may in the future have to devote significant additional resources, to facilitate compliance with these laws and regulations, and to investigate, defend or remedy actual or alleged violations or breaches. Any failure by us to comply with, or remedy any violations or breaches of, these laws and regulations could negatively impact our operations, result in the imposition of fines and penalties, liability and litigation, significant costs and expenses and reputational harm.

For more information about laws and regulations that could affect our business, see "Item 1A. Risk Factors" included in this Annual Report.

SUSTAINABILITY

At Iron Mountain, we are using our influence and expertise to drive innovations that protect and elevate the effectiveness of our customers’ endeavors, while also creating a meaningful, positive impact on individuals, the environment, and our overall performance. Iron Mountain is committed to sustainable growth, and this is highlighted through initiatives and targets within our company. We aim to minimize our environmental impact, foster a culture and processes that support the well-being of our global teams, and to be a catalyst for positive change within our communities.

We transparently report on our sustainability efforts and the advancement of our objectives by using widely adopted reporting frameworks such as the Global Reporting Initiative, CDP and EcoVadis. In addition, we continue to further align our reporting with the recommendations of the Financial Stability Board’s Task Force on Climate-related Financial Disclosures.

Our work continues to receive recognition. In 2024, the Science Based Targets initiative ("SBTi") validated our targets, which are aligned with the Paris Climate Agreement aspiration of limiting the global temperature increase to 1.5 degrees Celsius. Our data center team was recognized with the Decarbonization of Electricity award from BroadGroup International for their work and thought leadership on carbon-free energy.

As of December 31, 2024, we are a constituent of multiple indexes that focus on corporate sustainability standards, including several MSCI All Country World Indexes (ACWI), such as the ACWI Low Carbon Leaders, ACWI Climate Paris Aligned, ACWI ESG Leaders and ACWI Socially Responsible Index (SRI). We have also been a constituent of the FTSE4Good Index for more than ten years. A copy of our sustainability report is available on the "Who we are" section of our website, www.ironmountain.com, under the heading "Sustainability". We are not including the information contained on or available through our website as part of, or incorporating such information by reference into, this Annual Report.

Part I

STRONG ENVIRONMENTAL FOCUS •Iron Mountain provides a Green Power Pass solution in the data center market to help customers manage their carbon footprint. •Founding signatory of the UN Compact on 24/7 Carbon Free Energy. As of 2024, Iron Mountain has over 190 locations globally with the ability to track and match renewable energy usage on an hourly basis. •87% of our global electricity use was covered by renewable sources in 2023. •Iron Mountain has near and long-term science-based emissions reduction targets that have been validated by SBTi. •Reduced Scope 1 and 2 greenhouse gas (GHG) emissions by 10% from 2022 to 2023. •Achieved a landfill diversion rate of 81% in 2023, reducing waste to landfill and lowering emissions associated with waste processing.

INTERNET WEBSITE

Our internet address is www.ironmountain.com. Under the "Investors" section on our website, we make available, free of charge, our Annual Reports on Form 10-K, our Quarterly Reports on Form 10-Q, our Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934 (the "Exchange Act") as soon as reasonably practicable after such forms are filed with or furnished to the SEC. We are not including the information contained on or available through our website as a part of, or incorporating such information by reference into, this Annual Report. Copies of our corporate governance guidelines, code of ethics and the charters of our audit, compensation, finance, nominating and governance and risk and safety committees are available on the "Investors" section of our website, www.ironmountain.com, under the heading "Corporate Governance".

Part I

We face many risks. If any of the events or circumstances described below actually occur, we and our businesses, financial condition or results of operations could suffer, and the trading price of our debt or equity securities could decline. Our current and potential investors should consider the following risks and the information contained under the heading "Cautionary Note Regarding Forward-Looking Statements" before deciding to invest in our securities.

BUSINESS RISKS

Failure to execute our strategic growth plan may adversely impact our financial condition and results of operations.

As part of our strategic growth plan, including Project Matterhorn, we expect to invest in our existing businesses, including records and information management storage and services businesses in our higher-growth markets, data centers, digital solutions, ALM business and other complementary businesses, and in new businesses, business strategies, products, services, technologies and geographies. These initiatives may involve significant risks and uncertainties, including:

• our inability to maintain relationships with key customers and suppliers or to execute on our plan to incorporate the digitization of our customers’ records and new digital information technologies into our offerings;

• failure to achieve satisfactory returns on new product offerings, acquired companies, joint ventures, growth initiatives or other investments, particularly in markets where we do not currently operate or have a substantial presence;

• our inability to identify suitable companies to acquire, invest in or partner with;

• our inability to complete acquisitions or investments on satisfactory terms;

• our inability to structure acquisitions or investments in a manner that complies with our debt covenants or is consistent with our leverage ratio goals;

• challenges in managing costs to offset the impact of inflationary pressure;

• increased demands on our management, operating systems, internal controls and financial and physical resources and, if necessary, our inability to successfully expand our infrastructure;

• incurring additional debt necessary to acquire suitable companies or make other growth investments if we are unable to pay the purchase price or make the investment out of working capital or the issuance of our common stock or other equity securities;

• our inability to manage the budgeting, forecasting and other process control issues presented by future growth, particularly with respect to new lines of business;

• insufficient revenues to offset expenses and liabilities associated with new investments; and

• our inability to attract, develop and retain skilled employees to lead and support our strategic growth plan, particularly in new businesses, technologies, products or offerings outside our core competencies.

Our new ventures are inherently risky and we can provide no assurance that such strategies and offerings will be successful in achieving the desired returns within a reasonable timeframe, if at all, and that they will not adversely affect our business, reputation, financial condition and operating results.

If stored records and tapes become less active, our service revenue growth and profits from related services may decline.

Our Records Management and Data Management service revenue growth is being negatively impacted by declining activity rates as stored records and tapes are becoming less active and more archival. The amount of information available to customers digitally or in their own information systems has been steadily increasing in recent years, and we believe this trend will continue. As a result, our customers are less likely than they have been in the past to retrieve records and rotate tapes, thereby reducing their activity levels. At the same time, many of our costs related to records and tape related services remain relatively fixed. In addition, our reputation for providing secure information storage is critical to our success, and actions to manage cost structure, such as outsourcing certain transportation, security or other functions, could negatively impact our reputation and adversely affect our business, and, if we are unable to appropriately align our cost structure with decreased levels of service activity, our operating results could be adversely affected.

Part I

Our customers continue to evolve the way they store records, which could impact our storage revenue.

We derive substantial revenues from rental fees for the storage of physical records and computer backup media and from storage related services. Volume in and demand for our traditional storage related services has evolved as our customers adopt alternative storage technologies or as retention requirements change, which may require significantly less space than traditional physical records and tape storage; however, volumes in our Global RIM Business segment were relatively steady in 2024 and we expect them to remain relatively consistent in the near term. We can provide no assurance that our customers will continue to store most or a portion of their records as paper documents or as tapes, or that the paper documents or tapes they do store with us will require our storage related services at the same levels as they have in the past. A significant shift by our customers to storage of data through non-paper or non-tape-based technologies, whether now existing or developed in the future, could adversely affect our businesses. In addition, the digitization of records may shift our revenue mix from the more predictable storage revenue to service revenue, which is inherently more volatile.

We and our customers are subject to laws and governmental regulations relating to data privacy and cybersecurity, and our customers’ demands in this area are increasing. This may cause us to incur significant expenses and non-compliance with such regulations and demands could harm our business.

We and our customers are subject to numerous laws and regulations relating to data privacy and cybersecurity. These regulations are complex, change frequently and have tended to become more stringent over time. In addition, a growing number of regulatory bodies have adopted data breach notification requirements and increased enforcement of regulations regarding the use, access, accuracy and security of personal information. Finally, as a result of the continued emphasis on information security and instances in which personal information has been compromised, our customers are requesting that we take increasingly sophisticated measures to enhance security and comply with cybersecurity and data privacy regulations and that we assume higher liability under our contracts.

We have an established global privacy compliance program and devote substantial resources, and may in the future have to devote significant additional resources, to facilitate compliance with global laws and regulations, our customers’ data privacy, data residency and security demands, and to investigate, defend or remedy actual or alleged violations or breaches. Any failure by us to comply with, or remedy any violations or breaches of, laws and regulations or customer requirements could negatively impact our operations, result in the imposition of fines and penalties, contractual liability and litigation, significant costs and expenses and reputational harm.

Expansion into Global Digital Solutions and ALM services means that our privacy and security risk profile is increasing. In particular, we are hosting increasing volumes of customer digital data, including sensitive and confidential data, and disposing of customer data-bearing devices. This may result in increased regulatory exposure, contractual liability and security expectations from customers. Finall

Showing the first 8K of 67K characters. Open the full section

None.

RISK MANAGEMENT AND STRATEGY

We maintain a robust information security program that is designed to protect our information and the information of our customers. Our information security program is based on a recognized cybersecurity framework established by the National Institute of Standards and Technology ("NIST") and establishes controls to mitigate critical areas of cybersecurity risk. Our information security program has adopted all elements of the NIST cybersecurity framework, including the six functions of identify, protect, detect, respond, recover and govern, as well as each of the categories and control groups thereunder. This does not imply that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST framework as a guide to ensure our information security program is designed to manage cybersecurity risks relevant to our business. Among other things, the cybersecurity controls in our information security program address information access rights, incident monitoring and response processes, information technology system configuration, network security, security architecture planning, mobile device security and compliance with information security policy requirements and protocols. These cybersecurity controls are designed to oversee, identify and mitigate risks from all cybersecurity threats, including those arising from our use of third-party service providers. Our cybersecurity controls are evaluated regularly by our internal information security team, and we engage a third party examiner to assess the maturity of our information security program against the NIST cybersecurity framework no less frequently than bi-annually. Additionally, our information security program is assessed periodically by a federal regulator in the United States as part of its routine audit of the Company. In addition to our internal assessments, we also assess our third-party service providers on a regular basis using a risk-based approach that assigns a risk calculation to each such service provider. The results of our assessments are tracked and evaluated to ensure these third parties comply with our cybersecurity standards. We require all employees to undertake data protection and cybersecurity training and compliance programs annually.

Part I

Our reputation for providing secure information storage to customers is critical to the success of our business, and protecting against material cybersecurity risks is an integral part of maintaining that reputation. A successful cybersecurity breach could lead to theft or misuse of our or our customers’ proprietary or confidential information or our employees’ personal information and result in third-party claims against us, regulatory penalties and reputational harm. As part of our information security program, we also actively monitor emerging cyberattack patterns to develop custom detection capabilities and mitigation techniques to protect against material risk of cybersecurity threats. Upon encountering a cybersecurity incident, our information security team responds using our detailed cybersecurity incident response plan ("CSIRP"), which is based on industry best practices, relevant legal requirements and our contractual commitments. Among other things, the CSIRP sets forth the specific criteria used to assess a cybersecurity incident, mitigate risks of adverse consequences associated with any such incident, protocols to escalate the management of the incident and the process to inform our executive management team and any impacted functions of our business. All cybersecurity incidents are assessed to determine whether disclosure is required pursuant to any contractual or regulatory requirements and any material cybersecurity incident is also reported to our board of directors (our "Board").

To date, our information security program has been successful in protecting against risks from cybersecurity threats, and we have not had any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, “Risk Factors,” under the heading “Attacks on our internal IT systems could damage our reputation, cause us to lose revenues, and adversely affect our business, financial condition and results of operations”, which should be read in conjunction with the information above.

GOVERNANCE

Our Board reviews and discusses significant risks with executive management, including cybersecurity risk, that affect us. Although our executive management team and our Board work together on risk matters, our Board has the ultimate oversight authority over all enterprise risks, including cybersecurity risk. Our Board reserves the right to, and periodically does, consult with third-party advisors and experts to assist our Board in understanding and anticipating future cybersecurity threats and trends. The risk and safety committee of our Board (the "RSC") is specifically tasked with reviewing and monitoring cybersecurity and information security risk, as well as the risk management strategies, systems and policies, and processes implemented, established and reported on by our executive management team. The RSC is also primarily responsible for assisting our Board with oversight of our enterprise risk management program.

Our executive management team, with oversight from our Board, is responsible for our enterprise risk management process and the day-to-day supervision and mitigation of enterprise risks, including cybersecurity risk. Our enterprise risk management program includes our executive management team receiving regular reports from our operations personnel. As part of our enterprise risk program, our executive management team has established an enterprise risk committee (the "ERC"), which is chaired by our Chief Risk Officer and is otherwise composed of each of our other executive vice presidents. The ERC oversees our risk and compliance activities to ensure that management has appropriate policies and management plans in place for managing risks of the business, including cybersecurity risk, as well as reviewing and prioritizing significant risks and allocating resources for risk mitigation.

Our Chief Risk Officer provides reports at each meeting of the RSC on areas of potential risks to us, including cybersecurity risk, and our Chief Information Security Officer provides quarterly reports to the RSC on the key performance indicators of our information security program to facilitate the RSC’s oversight of the program through objective measurements, including metrics regarding software patching, IT asset management, cyber incident management and cybersecurity training. Reports by our Chief Information Security Officer also include detailed information on the activities of our cyber incident response team to allow for analysis of trends and the identification of any control gaps that require remediation.

We also maintain a business information security committee (the "ISC") with employee representation across geographies, business lines and business functions. The ISC includes a cross functional group of our employees with expertise and responsibilities in areas such as operations, digital product solutions, information technology, compliance, security, finance, privacy, internal audit and legal risk mitigation. The ISC is managed by our Chief Information Security Officer and meets regularly to receive updates on our cybersecurity posture, emerging risks and new cybersecurity capabilities. Members of the ISC act as points of contact during incident response activities to provide oversight and logistical support to the information security team.

The information security team is made primarily of full-time employees; however, we routinely engage consultants to provide supplemental labor and additional expertise in specific areas on an as-needed basis. Our information security team is organized based on industry best practices in alignment with NIST recommendations. All of the leaders in our information security team have over 10 years of cybersecurity experience and most of our information security staff maintain cybersecurity program certifications such as CMU Cybersecurity Executive Certification, ISACA Certifications (CISSP & CISM) and other relevant vendor certifications. Our information security team also regularly undergoes continuing education to ensure our implementation of best-in-class techniques.

Part I

As of December 31, 2024, we conducted operations through 1,110 leased facilities and 236 owned facilities. Our facilities are divided among our reportable segments and Corporate and Other as follows: Global RIM Business (1,211), Global Data Center Business (33) and Corporate and Other (102). These facilities contain a total of approximately 98.1 million square feet of space. A breakdown of owned and leased facilities by country (and by state within the United States) is listed below:

Part I