JCIJohnson Controls

We collect, store, have access to and otherwise process certain confidential or sensitive data, including proprietary business information, customer data, personal data or other information that is subject to privacy and security laws, regulations and/or customer-imposed controls. Despite our efforts to protect such data, our business business, data and our products may have been and will in the future be vulnerable to security incidents, theft, misplaced or lost data, programming errors, or errors that could potentially lead to compromising the compromise or further compromise of such data, improper use of our products, systems, software solutions or networks, unauthorized access, use, disclosure, modification or destruction of information, defective products, production downtimes and operational disruptions. During September 2023, we experienced a cybersecurity event consisting of unauthorized access, data exfiltration where certain data, primarily employee, job applicant and deployment of ransomware by a third party to a portion of our internal IT infrastructure. The actual or perceived risk of theft, loss, fraudulent use or misuse of customer, employee or other data as a result of the cybersecurity incident, as well as non-compliance with applicable industry standards or our contractual or other legal obligations or privacy and personal information security policies regarding such data, could result in costs, fines, litigation or regulatory actions. We could face similar consequences in the future if we, our suppliers, channel partners, customers or other third parties experience the actual or perceived risk of theft, loss, fraudulent use or misuse of data, including as a result of employee error or malfeasance, or as a result of the imaging, software, security and other products we incorporate into our products. Such an event could lead customers related data, was impacted. The Company has taken appropriate actions to select the products notify individuals and services of our competitors. Both the cybersecurity incident and similar future incidents could harm our reputation, cause unfavorable publicity or otherwise adversely affect certain potential customers’ perception of the security and reliability of our services as well as our credibility and reputation, which could result in lost sales. regulatory authorities.

The Company is a global leader in engineering, manufacturing, commissioning and retrofitting building products and systems, including residential and commercial HVAC heating, ventilating, air-conditioning ("HVAC") equipment, industrial refrigeration systems, controls, security systems, fire-detection systems and fire-suppression solutions. The Company further serves customers by providing technical services, including maintenance, management, repair, retrofit and replacement of equipment (in the HVAC, industrial refrigeration, controls, security and fire-protection space), space) and energy-management consulting. The Company's OpenBlue digital software platform enables enterprises to better manage their physical spaces by combining the Company's building products and services with cutting-edge technology and digital capabilities to enable data-driven “smart building” services and solutions. The Company partners with customers by leveraging its broad product portfolio and digital capabilities, powered by OpenBlue, together with its direct channel service and solutions capabilities, to deliver outcome-based solutions across the lifecycle of a building and services addressing distinct and diverse operating environments and regulatory requirements that address customers’ needs in their core missions. On April 1, 2025, the Company, as part of ongoing initiatives to improve energy efficiency, enhance security, create healthy environments drive simplification, accelerate growth, better reflect its organizational and reduce greenhouse gas emissions. operational structure and align with the manner in which the Company's chief operating decision maker assesses performance and makes decisions regarding the allocation of resources following portfolio simplification actions, realigned into three reportable segments (Americas, EMEA and APAC) from four reportable segments (Global Products, Building Solutions North America, Building Solutions EMEA/LA and Building Solutions APAC). The Company began reporting under this segment structure on April 1, 2025.

It is not possible to estimate the Company’s ultimate level of liability at many remediation sites due to the large number of other parties that may be involved, the complexity of determining the relative liability among those parties, the financial viability of other potentially responsible parties and third-party indemnitors, the uncertainty as to the nature and scope of the investigations and remediation to be conducted, changes in environmental regulations, changes in permissible levels of specific compounds in soil, groundwater and drinking water sources, or changes in enforcement theories and policies, including efforts to recover natural resource damages, the uncertainty in the application of law and risk assessment, the various choices and costs associated with diverse technologies that may be used in corrective actions at the sites, and the often quite lengthy periods over which eventual remediation may occur. It is possible that technological, regulatory or enforcement developments, the results of additional environmental studies or other factors could change the Company's expectations with respect to future charges and cash outlays, and such changes could be material to the Company's future results of operations, financial condition or cash

Certain contracts and related customer relationships result from purchasing residential security monitoring contracts from an external network of independent dealers who operate under the ADT dealer program, primarily outside of North America. Acquired contracts and related customer relationships are recorded at their contractually determined purchase price. During the first 6 months (12 months in certain circumstances) after the purchase of the customer contract, any cancellation of monitoring service, including those that result from customer payment delinquencies, results in a chargeback by the Company to the dealer for the full amount of the contract purchase price. The Company records the amount charged back to the dealer as a reduction of the previously recorded intangible asset. Intangible assets arising from the ADT dealer program are amortized in pools determined by the same month and year of contract acquisition on a straight-line basis over the period of the customer relationship. The estimated useful life of dealer intangibles ranges from 12 to 15 years.