XML 32 R22.htm IDEA: XBRL DOCUMENT v3.19.1
Commitments And Contingencies
3 Months Ended
Mar. 31, 2019
Commitments and Contingencies Disclosure [Abstract]  
COMMITMENTS AND CONTINGENCIES
COMMITMENTS AND CONTINGENCIES
Legal Matters
The Company accrues a liability for legal contingencies when it believes that it is both probable that a liability has been incurred and that it can reasonably estimate the amount of the loss. The Company reviews these accruals and adjusts them to reflect ongoing negotiations, settlements, rulings, advice of legal counsel and other relevant information. To the extent new information is obtained and the Company's views on the probable outcomes of any pending claims, suits, assessments, regulatory investigations, or other legal proceedings change, changes in the Company's accrued liabilities would be recorded in the period in which such determination is made. In addition, in accordance with the relevant authoritative guidance, for matters in which the likelihood of material loss is at least reasonably possible, the Company provides disclosure of the possible loss or range of loss. If a reasonable estimate cannot be made, however, the Company will provide disclosure to that effect.
Due to the nature of the Company's business, the Company is subject to patent infringement claims, including current litigation alleging infringement by various Company solutions and services. The Company believes that it has meritorious defenses to the allegations made in its pending litigation and intends to vigorously defend itself; however, it is unable currently to determine the ultimate outcome of these or similar matters or the potential exposure to loss, if any. In addition, the Company is a defendant in various litigation matters generally arising out of the normal course of business. Although it is difficult to predict the ultimate outcomes of these cases, the Company believes that outcomes that will materially and adversely affect its business, financial position, results of operations or cash flows are reasonably possible but not estimable at this time.
The Company also is the victim of a cyberattack, in which, the Company believes, between October 13, 2018 and March 8, 2019, international cyber criminals gained intermittent access to Citrix’s internal network through “password spraying”, and over a limited number of days stole business documents and files from a shared network drive and a drive associated with a web-based tool used in the Company's consulting practice. The shared drive from which documents and files were stolen was used to store current and historical business documents and files, such as human resources and employee records, some of which contained sensitive and personal identification information of the Company's current and former employees and, in limited cases, their beneficiaries and dependents; customer engagement documents, including consulting services project materials, statements of work and proofs of concept, some of which were also stored on the drive associated with a web-based tool used in the Company's consulting practice; marketing materials; sales and finance documents; contracts and other legal records; and a wide assortment of other company records. The cyber criminals also may have accessed the individual virtual drives of a very limited number of compromised users, accessed the company email accounts of the same very limited number of compromised users, and launched without further exploitation a limited number of internal applications. The Company has commenced a substantial discovery process to review the documents and files stolen from the shared network drive and the drive associated with the web-based tool used in the Company's consulting practice, and the accessed documents and files on the individual virtual drives and the company e-mail accounts of the very limited number of comprised users. Based upon the Company’s investigation to date, there is no indication that the cyber criminals discovered and exploited any vulnerabilities in the Company’s products or customer cloud services to gain entry, and there is no indication that the security of any Citrix product or customer cloud service was compromised. The Company’s investigation remains ongoing. At this time, however, the Company is not aware of any impact to its financial reporting systems from this cyberattack. Additionally, the Company continues to assess its internal controls over financial reporting and disclosure controls and procedures related to cyberattacks as its investigation continues.
Further, the Company has a program of network-security (or cyber risk) insurance policies that, with standard exclusions, insure against the costs of detecting and mitigating cyber breaches, the cost of credit monitoring, and reasonable expenses for defending and settling privacy and network security lawsuits. These policies are subject to a $500,000 self-insured retention and a total insurance limit of $200.0 million. There can be no assurance, however, that this insurance coverage is sufficient to cover this or any other cyberattack. In addition to these insurance policies, the Company maintains customary business coverage under its crime, commercial general liability, and director and officer insurance policies.

Although it is difficult to predict the ultimate outcomes of this cyberattack, based on the Company’s investigation to date, the Company believes that it is reasonably possible that outcomes from potential unasserted claims related to this cyberattack could materially and adversely affect its business, financial position, results of operations or cash flows. However, due to the ongoing nature of the Company’s investigation, it is not possible to estimate the amount or a range of potential loss, if any, at this time.
Guarantees
The authoritative guidance requires certain guarantees to be recorded at fair value and requires a guarantor to make disclosures, even when the likelihood of making any payments under the guarantee is remote. For those guarantees and indemnifications that do not fall within the initial recognition and measurement requirements of the authoritative guidance, the Company must continue to monitor the conditions that are subject to the guarantees and indemnifications, as required under existing generally accepted accounting principles, to identify if a loss has been incurred. If the Company determines that it is probable that a loss has been incurred, any such estimable loss would be recognized. The initial recognition and measurement requirements do not apply to the provisions contained in the majority of the Company’s software license agreements that indemnify licensees of the Company’s software from damages and costs resulting from claims alleging that the Company’s software infringes the intellectual property rights of a third party. The Company has not made material payments pursuant to these provisions. The Company has not identified any losses that are probable under these provisions and, accordingly, the Company has not recorded a liability related to these indemnification provisions.