Table of Contents

UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549

FORM 10-K

Commission File Number 1-13045

IRON MOUNTAIN INCORPORATED
(Exact name of registrant as specified in its charter)

         Securities registered pursuant to Section 12(b) of the Act:

         Securities registered pursuant to Section 12(g) of the Act:None

         Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ý    No o

         Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes o    No ý

         Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ý    No o

         Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Web site, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files). Yes o    No o

         Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation S-K is not contained herein, and will not be contained, to the best of registrant's knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K oý

         Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer or a small reporting company. See the definitions of "large accelerated filer," "accelerated filer" and "smaller reporting company" in Rule 12b-2 of the Exchange Act. (Check one):

         Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes o    No ý

         As of June 30, 2008,2009, the aggregate market value of the Common Stock of the registrant held by non-affiliates of the registrant was $4,765,397,453$5,202,229,298 based on the closing price on the New York Stock Exchange on such date.

         Number of shares of the registrant's Common Stock at February 13, 2009: 202,001,04411, 2010: 203,611,989

Table of Contents

IRON MOUNTAIN INCORPORATED
20082009 FORM 10-K ANNUAL REPORT

Table of Contents

i

Table of Contents

        References in this Annual Report on Form 10-K to "the Company," "we," "us" or "our" include Iron Mountain Incorporated and its consolidated subsidiaries, unless the context indicates otherwise.

DOCUMENTS INCORPORATED BY REFERENCE

        Certain information required in Items 10, 11, 12, 13 and 14 of Part III of this Annual Report on Form 10-K is incorporated by reference from our definitive Proxy Statement for the Annual Meeting of Stockholders to be held on or about June 4, 2009.3, 2010.

CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS

        We have made statements in this Annual Report on Form 10-K that constitute "forward-looking statements" as that term is defined in the Private Securities Litigation Reform Act of 1995 and other federal securities laws. These forward-looking statements concern our operations, economic performance, financial condition, goals, beliefs, future growth strategies, investments, objectives, plans and current expectations.expectations, including our intent to repurchase shares and to pay dividends, our financial ability and sources to fund the repurchase program and dividend policy, and the amounts of such repurchases and dividends. The forward-looking statements are subject to various known and unknown risks, uncertainties and other factors. When we use words such as "believes," "expects," "anticipates," "estimates" or similar expressions, we are making forward-looking statements.

        Although we believe that our forward-looking statements are based on reasonable assumptions, our expected results may not be achieved, and actual results may differ materially from our expectations. Important factors that could cause actual results to differ from expectations include, among others:

•

the cost to comply with current and future legislation,laws, regulations and customer demands relating to privacy issues;



•

the impact of litigation that may arise in connection with incidents in which we fail to protect our customer's information;



•

changes in the price for our services relative to the cost of providing such services;



•

changes in customer preferences and demand for our services;



•

in the various digital businesses in which we are engaged, the cost of capital and technical requirements, demand for our services, or competition for customers;



•

the impact of legal restrictions or limitations under stock repurchase plans on price, volume or timing of stock repurchases;



•

the impact of alternative, more attractive investments on dividends or stock repurchases;



•

our ability or inability to complete acquisitions on satisfactory terms and to integrate acquired companies efficiently;



•

the cost or potential liabilities associated with real estate necessary for our business;



•

the performance of business partners upon whom we depend for technical assistance or management and acquisition expertise outside the U.S.;



•

changes in the political and economic environments in the countries in which our international subsidiaries operate;



•

claims that our technology violates the intellectual property rights of a third party; and



•

other trends in competitive or economic conditions affecting our financial condition or results of operations not presently contemplated.

ii

Table of Contents

        Other risks may adversely impact us, as described more fully under "Item 1A. Risk Factors."

        You should not rely upon forward-looking statements except as statements of our present intentions and of our present expectations, which may or may not occur. You should read these cautionary statements as being applicable to all forward-looking statements wherever they appear. Except as required by law, we undertake no obligation to release publicly the result of any revision to these forward-looking statements that may be made to reflect events or circumstances after the date hereof or to reflect the occurrence of unanticipated events. Readers are also urged to carefully review and consider the various disclosures we have made in this document, as well as our other periodic reports filed with the Securities and Exchange Commission (the "Commission" or "SEC").

iiiii

Table of Contents

PART I

Item 1. Business.

A.    Development of Business.

        We believe we are the global leader ina leading information protection and storage services.management services company. We help organizations around the world reduce the risks, costs and costsinefficiencies associated with information protectionstoring and storage.using their physical and digital data. We offer comprehensive records management services, data protection & recovery services and information destruction services, along with the expertise and experience to address complex information management challenges such as rising storage costs, litigation, regulatory compliance and disaster recovery. Founded in an underground facility near Hudson, New York in 1951, Iron Mountain is a trusted partner to more than 120,000140,000 corporate clients throughout North America, Europe, Latin America and Asia Pacific. We have a diversified customer base comprised of commercial, legal, banking, healthcare, accounting, insurance, entertainment and government organizations, including more than 95%97% of the Fortune 1000 and more than 90%93% of the FTSE 100. As of December 31, 2008,2009, we provided services in 38 countries on five continents, employed over 21,00020,000 people and operated more than 1,000 facilities.

        Now in our 58th59th year, we have experienced tremendous growth, particularly since successfully completing the initial public offering of our common stock in February 1996. We have grown from a business with limited product offerings and annual revenues of $104 million in 1995 into a global enterprise providing a broad range of information protection and storagemanagement services to customers in markets around the world with total revenues of $3.1$3 billion for the year ended December 31, 2008.2009. On January 5, 2009, we were added to the S&P 500 Index and we are currently number 722681 on the Fortune 1000.

        Our success since becoming a public company in 1996 has been driven in large part by our execution of a consistent long-term growth plan to build market leadership by extending our strategic position through service line and global expansion. This growth plan has been sequenced into three phases. The first phase involved establishing leadership and broad market access in our core businesses: records management and data protection & recovery, primarily through acquisitions. In the second phase we invested in building a successful selling organization to access new customers, converting previously unvended demand. While different parts of our business are in different stages of evolution along our three-phase strategy, as an enterprise, we have transitioned to the third phase of our growth plan, which we call the capitalization phase. In this phase, which we expect will run for a long time to come, we seek to expand our relationships with our customers to continue solving their increasingly complex information protection and storagemanagement problems. Doing this well means expanding our service offerings on a global basis while maximizing our solid core businesses. In doing this, we continue to build what we believe to be a very durable business through disciplined execution.

        Consistent with this strategy, we have transitioned from a growth strategy driven primarily by acquisitions of information protection and storagemanagement services companies to expansion driven primarily by internal growth. In 2001, internal revenue growth exceeded growth through acquisitions for the first time since we began our acquisition program in 1996. This has continued to be the case in each year since 2001 with the exception of 2004. In the absence of unusual acquisition activity, we expect to achieve mostmore of our revenue growth internally in 20092010 and beyond.

        In 2008,February, 2010, we completed five small acquisitionsacquired Mimosa Systems, Inc. ("Mimosa"), a leader in enterprise-class digital content archiving solutions, for approximately $112 million in cash. Mimosa, based in Santa Clara, California, provides an on-premises integrated archive for email, SharePoint data and purchased the remaining interest offiles, and complements our partner in Brazil. In 2007, our U.S. physical businesses were supplemented by two significant acquisitions: ArchivesOne, Inc.existing enterprise-class, cloud-based digital archive services. NearPoint®, Mimosa's enterprise archiving platform, has applications for retention and disposition, electronic discovery ("ArchivesOne"eDiscovery") in May, compliance supervision, classification, recovery, and RMS Services—USA, Inc. ("RMS") in September. In December 2007 our digital business was supplemented by the acquisition of Stratify Inc. ("Stratify"). Priorend-user search, enabling customers to 2007, we completed two significant digital acquisitions: Connected Corporation ("Connected") in November 2004reduce risk, and LiveVault Corporation ("LiveVault") in December 2005. We expect our futurelower their eDiscovery and storage costs.

Table of Contents

digital acquisitions will be of two primary types, those that bring us new or improved technologies to enhance our existing technology portfolio and those that increase our market position through technology and established revenue streams.

        We expect to achieve our internal revenue growth objectives primarily through a sophisticated sales and account management coverage model. This model is designed to drive incremental revenues by acquiring new customer relationships and increasing business with new and existing customers by selling them our products and services in new geographies and selling additional products and services such as information destruction, digital data protection, document management services and eDiscovery services. We intend our selling efforts to be augmented and supported by an expanded marketing program,programs, which includesinclude product management as a core discipline. We also plan to continue developing an extensive worldwide network of channel partners through which we are selling a wide array of technology solutions, primarilysolutions. Our sales and account coverage model and our digital data protection and recovery products and services.go-to-market strategy will continue to evolve to meet the needs of our customers.

B.    Description of Business.

Overview

        Our information protection and storagemanagement services can be broadly divided into three major service categories: records management services, data protection & recovery services, and information destruction services. We offer both physical services and technology solutions in each of these categories. Media formats can be broadly divided into physical and electronic records. We define physical records to include paper documents, as well as all other non-electronic media such as microfilm and microfiche, master audio and videotapes, film, X-rays and blueprints. Electronic records include email and various forms of magnetic media such as computer tapes and hard drives and optical disks.

        Our physical records management services include: records management program development and implementation based on best-practices to help customers comply with specific regulatory requirements, implementation of policy-based programs that feature secure, cost-effective storage for all major media, including paper (which is the dominant form of records storage), flexible retrieval access and retention management. Included within physical records management services is Document Management Solutions ("DMS"). This suite of services helps organizations to gain better access to and, ultimately, control over their paper records by digitizing, indexing and hosting them in online archives to provide complete information life-cycle solutions. Our technology-based records management services are comprised primarily of digital archiving and related services for secure, legally compliant and cost-effective long-term archiving of electronic records.records and eDiscovery services. Within the records management services category, we have developed specialized services for vital records and regulated industries such as healthcare, energy, government and financial services.

        Our physical data protection & recovery services include disaster preparedness, planning, support and secure, off-site vaulting of data backup media for fast and efficient data recovery in the event of a disaster, human error or virus. Our technology-based data protection & recovery services include online backup and recovery solutions for desktop and laptop computers and remote servers. Additionally, we serve as a trusted, neutral third party and offer technologyintellectual property escrow services to protect and manage source code and other proprietary information.

        Our information destruction services are comprised almost exclusively of secure shredding services. Secure shredding services complete the life cycle of a record and involve the shredding of sensitive documents in a way that ensures privacy and a secure chain of custody for the records. These services typically include either the scheduled pick-up of loose office records which customers accumulate in specially designed secure containers we provide or the shredding of documents stored in records facilities upon the expiration of their scheduled retention periods. Our technology-based information destruction services include DataDefense, which provides automatic, intelligent encryption of sensitive PC data and, when behaviors that are inconsistent with authorized use are detected, that data is automatically eliminated and the PC is disabled—this is designed to render the data useless to unauthorized users.

Table of Contents

Physical Records

        Physical records may be broadly divided into two categories: active and inactive. Active records relate to ongoing and recently completed activities or contain information that is frequently referenced. Active records are usually stored and managed on-site by the organization that originated them to

Table of Contents

ensure ready availability. Inactive physical records are the principal focus of the information protection and storagemanagement services industry. Inactive records consist of those records that are not needed for immediate access but which must be retained for legal, regulatory and compliance reasons or for occasional reference in support of ongoing business operations. A large and growing specialty subset of the physical records market is medical records. These are active and semi-active records that are often stored off-site with and serviced by an information protection and storagemanagement services vendor. Special regulatory requirements often apply to medical records. In addition to our core records management services, we provide consulting, facilities management, fulfillment and other outsourcing services.

Electronic Records

        Electronic records management focuses on the storage of, and related services for, computer media that is either a backup copy of recently processed data or archival in nature. Customer needs for data backup and recovery and archiving are distinctively different. Backup data exists because of the need of many businesses to maintain backup copies of their data in order to be able to recover the data in the event of a system failure, casualty loss or other disaster. It is customary (and a best practice) for data processing groups to rotate backup tapes to off-site locations on a regular basis and to require multiple copies of such information at multiple sites.

        In addition to the physical rotation and storage of backup data that our physical business segments provide, our Worldwide Digital Business segment offers online backup services as an alternative way for businesses to transfer data to us, and to access the data they have stored with us. Online backup is a Web-based service that automatically backs up computer data from servers or directly from desktop and laptop computers over the Internet and stores it in one of our secure data centers. In early 2003, we announced an expansion of the online backup service to include backup and recovery for personal computer data, answering customers' needs to protect critical business data, which is often unprotected on employee laptop and desktop personal computers. In November 2004, we acquired Connected Corporation ("Connected"), a market leader in the backup and recovery of this distributed data, and in December 2005, we acquired LiveVault Corporation ("LiveVault"), a market leader in the backup and recovery of server data.

        There is a growing need for better ways of archiving electronic records for legal, regulatory and compliance reasons and for occasional reference in support of ongoing business operations. Historically, businesses have relied on backup tapes for storing archived data in electronic format, but this process can be costly and ineffective when attempting to search and retrieve the data for litigation or other needs. In addition, many industries, such as healthcare and financial services, are facing increased governmental regulation mandating the way in which electronic records are stored and managed. To help customers meet these growing storage challenges, we introduced digital archiving services in 2003. We have experienced increasing market adoption of these services, especially for e-mail archiving, which enables businesses to identify and retrieve electronic records quickly and cost-effectively, while maintaining regulatory compliance.

        On December 1, 2006, changes to the Federal Rules of Civil Procedure ("FRCP") were implemented; as a result, electronically stored information was explicitly defined as a separate class of discoverable information in litigation. There is no longer any ambiguity about whether digital data constitutes a "document" and businesses now have the clear responsibility to produce electronic records. In December 2007, we acquired Stratify Inc. ("Stratify"), a leading provider of eDiscovery services to assist customers with managing discovery of electronic records.

Table of Contents

        We believe the issues encountered by customers trying to manage their electronic records are similar to the ones they face in their physical records management programs and consist primarily of: (1) storage capacity and the preservation of data; (2) access to and control over the data in a secure environment; and (3) the need to retain electronic records due to regulatory requirements or for

Table of Contents

litigation support. Our digital services offerings are representative of our commitment to address evolving records management needs and expand the array of services we offer.

Growth of Market

        We believe that the volume of stored physical and electronic records will continue to increase for a number of reasons, including: (1) regulatory requirements; (2) concerns over possible future litigation and the resulting increases in volume and holding periods of records; (3) the continued proliferation of data processing technologies such as personal computers and networks; (4) inexpensive document producing technologies such as facsimile, desktop publishing software and desktop printing; (5) the high cost of reviewing records and deciding whether to retain or destroy them; (6) the failure of many entities to adopt or follow policies on records destruction; and (7) requirementsthe need to keep backup copies of certain records in off-site locations.locations for business continuity purposes in the event of disaster.

        We believe that paper-based information will continue to grow, not in spite of, but because of, "paperless" technologies such as e-mail and the Internet. These technologies have prompted the creation of hard copies of such electronic information and have also led to increased demand for electronic records services, such as the storage and off-site rotation of backup copies of magnetic media. In addition, we believe that the proliferation of digital information technologies and distributed data networks has created a growing need for efficient, cost-effective, high quality technology solutions for electronic data protection, digital archiving and the management of electronic documents.

Consolidation of a Highly Fragmented Industry

        There was significant consolidation within the highly fragmented physical information protection and storagemanagement services industry in North America from 1995 to 2000 and at a slower but continuing pace in recent years. Most physical information protection and storagemanagement services companies serve a single local market, and are often either owner-operated or ancillary to another business, such as a moving and storage company. We believe that the consolidation trend in the physical information management industry, both in North America and other regions,international geographies, will continue because of the industry's capital requirements for growth, opportunities for large information protection and storagemanagement services providers to achieve economies of scale and customer demands for more sophisticated technology-based solutions.

        We believe that the consolidation trend in thethis industry is also due to, and will continue as a result of, the preference of certain large organizations to contract with one vendor in multiple cities and countries for multiple services. In particular, larger customers increasingly demand a single, sophisticated company to handle all of their important physical and electronic records needs. Large national and multinational companies are better able to satisfy these demands than smaller competitors. We have made, and intend tomay continue to make from time to time, acquisitions of our competitors, many of whom are small, single-city operators.

Description of Our Business

        We generate our revenues by providing storage (both physical and electronic records in a variety of information media formats), core records management, data protection & recovery, information destruction services and an expanding menu of complementary products and services to a large and diverse customer base. Providing outsourced information protection and storagemanagement services is the mainstay of our customer relationships and provides the foundation for our revenue growth. Core services, which are a vital part of a comprehensive records management program, consist primarily of the handling and

Table of Contents

transportation of stored records and information. In our secure shredding operations, core services consist primarily of the scheduled collection and shredding of records and documents generated by business operations. As is the case with storage revenues, core service revenues are highly recurring in nature and therefore very predictable.nature. In 2008,2009, our storage and core service revenues represented approximately 85%88% of our total consolidated revenues. In addition to our core services, we offer a wide array of complementary

Table of Contents

products and services, including special project work, data restoration projects, fulfillment services, consulting services and product sales (including software licenses, specially designed storage containers and related supplies). In addition, included in complementary services revenue is recycled paper revenues. These services address more specific needs and are designed to enhance our customers' overall records management programs. These services complement our core services; however, they are more episodic and discretionary in nature. Revenue generated by all of our operating segments includes both core and complementary components.

        Our various operating segments offer the products and services discussed below. In general, our North American Physical Business and our International Physical Business segments offer physical records management services, data protection & recovery services and information destruction services, in their respective geographies. Our Worldwide Digital Business segment includes our online backup and recovery solutions for server data and personal computers, digital archiving services, eDiscovery services and intellectual property management services and electronic information destruction services and is not limited to any particular geography. Some of our complementary services and products are offered within all of our segments. The amount of revenues derived from our North American Physical Business, International Physical Business and Worldwide Digital Business operating segments and other relevant data, including financial information about geographic areas and product and service lines, for fiscal years 2006, 2007, 2008 and 20082009 are set forth in Note 9 to Notes to Consolidated Financial Statements.

Service Offerings

        Our information protection and storagemanagement services can be broadly divided into three major categories: records management services, data protection & recovery services and information destruction services. We offer both physical services and technology solutions in each of thesethe records management and data protection & recovery categories. Currently, we only offer physical services in the information destruction services category.

Records Management Services

        By far our largest category of services, records management services are comprised primarily of the archival storage of records, both physical and digital, for long periods of time according to applicable laws, regulations and industry best practice. Core to any records management program is the handling and transportation of those records being stored and the destruction of documents stored in records facilities upon the expiration of their scheduled retention periods. For physical records, this is accomplished through our extensive service and courier operations. Other records management services include: Compliant Records Management and Consulting Services, DMS, Health Information Management Solutions, Film & Sound Archives, Energy Data Services, Discovery Services and other ancillary services.

        Hard copy business records are typically stored for long periods of time in cartons packed by the customer with limited activity. For some customers we store individual files on an open shelf basis and these files are typically more active. Storage charges are generally billed monthly on a per storage unit basis, usually either per carton or per cubic foot of records, and include the provision of space, racking, computerized inventory and activity tracking and physical security.

        Service and courier operations are an integral part of our comprehensive records management program for all physical media. They include adding records to storage, temporary removal of records from storage, refiling of removed records, permanent withdrawals from storage and the destruction of

Table of Contents

records. Service charges are generally assessed for each procedure on a per unit basis. Courier operations consist primarily of the pick-up and delivery of records upon customer request. Charges for courier services are based on urgency of delivery, volume and location and are billed monthly. As of December 31, 2008,2009, we were utilizing a fleet of approximately 3,9003,700 owned or leased vehicles.

Table of Contents

        Our digital archiving services focus on archiving digital information with long-term preservation requirements. These services represent the digital analogy to our physical records management services. Because of increased litigation risks and regulatory mandates, such as the changes to the FRCP that explicitly define electronically stored information as a separate class of discoverable information, companies are increasingly aware of the need to apply the same records management policies and retention schedules to electronic data as they do physical records. Typical digital records include e-mail, e-statements, images, electronic documents retained for legal or compliance purposes and other data documenting business transactions.

        The growth rate of mission-critical digital information is accelerating, driven in part by the use of the Internet as a distribution and transaction medium. The rising cost and increasing importance of digital information management, coupled with the increasing availability of telecommunications bandwidth at lower costs, may create meaningful opportunities for us to provide solutions to our customers with respect to their digital records management challenges. We continue to cultivate marketing and technology partnerships to support this anticipated growth.

        The focus of our DMS business is to develop, implement and support comprehensive document management solutions for the complete lifecycle of our customers' information. We seek to develop solutions that solve our customers' document management challenges by integrating the management of physical records, document conversion and digital storage. DMS complements our core physical and digital service offerings, leveraging our global footprint and our existing customer relationships. We differentiate our offerings by providing solutions that integrate and extend our existing portfolio of products and services.

        The trend towards increased usage of Electronic Document Management ("EDM") systems represents a tremendousanother opportunity for us. In addition to our existing archival storage services, there is increased opportunity to manage active records. Our DMS services provide the bridge between customers' physical documents and their new EDM solutions.

        We offer records management services that have been tailored for specific industries such as health care, or to address the needs of customers with more specific needs based on the critical nature of their records. Healthcare information services principally include the handling, storage, filing, processing and retrieval of medical records used by hospitals, private practitioners and other medical institutions. Medical records tend to be more active in nature and are typically stored on specialized open shelving systems that provide easier access to individual files. Healthcare information services also include recurring project work and ancillary services. Recurring project work involves the on-site removal of aged patient files and related computerized file indexing. Ancillary healthcare information services include release of information (medical record copying)copying and delivery), temporary staffing, contract coding, facilities management and imaging.

        Vital records contain critical or irreplaceable data such as master audio and video recordings, film and other highly proprietary information, such as energy data. Vital records may require special facilities or services, either because of the data they contain or the media on which they are recorded. Our charges for providing enhanced security and special climate-controlled environments for vital records are higher than for typical storage services. We provide the same ancillary services for vital records as we provide for our other storage operations.

        Our Discovery Services comprise solutions designed to address the legal discovery and corporate governance needs of our customers. Those services and solutions allow our customers to collect,

Table of Contents

prepare, process, review, and produce data that may exist in either paper or digital form in response to internal investigations, litigation or regulatory requests.

        Electronic discovery ("eDiscovery") is the component of legal discovery involving information that is converted into digital data or collected and processed in that form. Our eDiscovery services, principally embodied by the Stratify® Legal Discovery application, help our customers identify, organize, analyze, and review

Table of Contents

particularly relevant or responsive information from within the universe of electronic data generated during the normal course of their business. The ability of current content management technologies to capture and maintain several copies of documents—including different versions of working drafts—underscores the challenges companies face in managing information for eDiscovery.

        Our consolidated suite of physical and digital discovery services has been designed to deliver a secure, end-to-end chain-of-custody, while also reducing both risks and costs for our customers.

        We offer a variety of additional services which customers may request or contract for on an individual basis. These services include conducting records inventories, packing records into cartons or other containers, and creating computerized indices of files and individual documents. We also provide services for the management of active records programs. We can provide these services, which generally include document and file processing and storage, both off-site at our own facilities and by supplying our own personnel to perform management functions on-site at the customer's premises.

        Other complementary lines of business that we operate include fulfillment services and professional consulting services. Fulfillment services are performed by our wholly-owned subsidiary, Iron Mountain Fulfillment Services, Inc. ("IMFS"). IMFS stores customer marketing literature and delivers this material to sales offices, trade shows and prospective customers' locations based on current and prospective customer orders. In addition, IMFS assembles custom marketing packages and orders, and manages and provides detailed reporting on customer marketing literature inventories. A growing element of the content we manage and fulfill is stored digitally and printed on demand by IMFS. Digital print allows marketing materials such as brochures, direct mail, flyers, pamphlets and newsletters to be personalized to the recipient with the variable messages, graphics and content.

        We provide professional consulting services to customers, enabling them to develop and implement comprehensive records and information management programs. Our consulting business draws on our experience in information protection and storagemanagement services to analyze the practices of companies and assist them in creating more effective programs of records and information management. Our consultants work with these customers to develop policies and schedules for document retention and destruction.

        We also sell a full line of specially designed corrugated cardboard storage cartons. In 2008 we divested ourselves of our commodity data products sales business. Consistent with our treatment of acquisitions, we will eliminateeliminated all revenues associated with our data products business from the calculation of our internal growth in 2008 and 2009.

Data Protection & Recovery Services

        Our data protection & recovery services are designed to comply with applicable laws and regulations and to satisfy industry best practices with regard to the off-site vaulting of data for disaster recovery and business continuity purposes. As is the case with our records management services, we provide data protection & recovery services for both physical and electronic records. We also offer intellectual property management services in this category.

        Physical data protection & recovery services consist of the storage and rotation of backup computer media as part of corporate disaster recovery and business continuity plans. Computer tapes, cartridges and disk packs are transported off-site by our courier operations on a scheduled basis to

Table of Contents

secure, climate-controlled facilities, where they are available to customers 24 hours a day, 365 days a year, to facilitate data recovery in the event of a disaster. Frequently, back-up tapes are then rotated from our facilities back to our customers' data centers. We also manage tape library relocations and support disaster recovery testing and execution.

        Online backup is our Web-based service that automatically backs up computer data from servers or directly from desktop or laptop computers over the Internet and stores it in one of our secure data centers. Customers use our Connected® backup for PC software product for online backup of desktop or laptop computer data and our LiveVault® server data backup and recovery product for online

Table of Contents

backup of server data. Customers can choose our off-site hosted Software as a Service solution or they can license the software from us as part of a customer on-site solution.

        Through our intellectual property management services, we act as a trusted, neutral, third party, safeguarding valuable technology assets—such as software source code, object code and data—in secure, access-protected escrow accounts. Acting in this intermediary role, we help document and maintain intellectual property integrity. The result is increased control and leverage for all parties, enabling them to protect themselves, while maintaining competitive advantage.

Information Destruction Services

        Our information destruction services consist primarily of our physical secure shredding operations. Secure shredding is a natural extension of our hardcopy records management services, completing the life cycle of a record, and involves the shredding of sensitive documents for corporate customers that, in many cases, also use our services for management of less sensitive archival records. These services typically include the scheduled pick-up of loose office records which customers accumulate in specially designed secure containers we provide. Complementary to our shredding operations is the sale of the resultant waste paper to third-party recyclers. Through a combination of plant-based shredding operations and mobile shredding units comprised of custom built trucks, we are able to offer secure shredding services to our customers throughout the U.S., Canada, the U.K. and Australia/New Zealand.

Financial Characteristics of Our Business

        Our financial model is based on the recurring nature of our various revenue streams. The historical predictability of our revenues and the resulting adjusted operating income before depreciation and amortization ("Adjusted OIBDA") allow us to operate with a high degree of financial leverage. For a more detailed definition and reconciliation of Adjusted OIBDA and a discussion of why we believe this measure provides relevant and useful information to our current and potential investors, see Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations—Non-GAAP Measures." Our primary financial goal has always been, and continues to be, to increase consolidated OIBDA in relation to capital invested, even as our focus has shifted from growth through acquisitions to internal revenue growth. Our business has the following financial characteristics:

•

Recurring Revenues.  We derive a majority of our consolidated revenues from fixed periodic, usually monthly, fees charged to customers based on the volume of records stored. Once a customer places physical records in storage with us and until those records are destroyed or permanently removed (for which we typically receive a service fee) we receive recurring payments for storage fees without incurring additional labor or marketing expenses or significant capital costs. Similarly, contracts for the storage of electronic backup media consist primarily of fixed monthly payments. Our annual revenues from these fixed periodic storage fees have grown for 2021 consecutive years. For each of the five years 20042005 through 2008,2009, storage revenues, which are stable and recurring, have accounted for over 54% or more of our total consolidated revenues. This stable and growing storage revenue base also provides the foundation for increases in service revenues and Adjusted OIBDA.

Table of Contents

•

Historically Non-Cyclical Storage Business.  WeHistorically, we have not experienced any significant reductions in our storage business as a result of past economic downturns although, we can give no assurance that this would beduring recent economic slowdowns, the case in the future.rate at which some customers added new cartons to their inventory was below historical levels. We believe that companies that have outsourced records management services are less likely during economic downturns to incur the move-out costs and other expenses associated with accelerating destructions of their records, switching vendors or moving their records management services programs in-house. However, during past economic slowdowns, the rate at whichthis current recession, destruction rates have increased as some customers added new cartonshave been more willing to their inventory was below historical levels.incur additional short-term service costs in exchange for lower storage costs in the long-term. This phenomenon results in lower net volume growth rates in the short-term. The net effect of these factors has been the continued growth of our storage revenue base, albeit at a lower rate. For

Table of Contents

each of the five years 20042005 through 2008,2009, total net volume growth in North America has ranged between 4%1% and 8%.



•

Inherent Growth from Existing Physical Records Customers.  Our physical records customers have, on average, generated additional cartons at a faster rate than stored cartons have been destroyed or permanently removed. We estimate that inherent growth from existing customers represents approximately half of our total net volume growth, excluding acquisitions, in North America. We believe the consistent growth of our physical records storage revenues is the result of a number of factors, including: (1) the trend toward increased records retention; (2) customer satisfaction with our services; (3) the costs and inconvenience of moving storage operations in-house or to another provider of information protection and storagemanagement services; and (4) our positive pricing actions.



•

Diversified and Stable Customer Base.  As of December 31, 2008,2009, we had over 120,000140,000 corporate clients in a variety of industries. We currently provide services to commercial, legal, banking, healthcare, accounting, insurance, entertainment and government organizations, including more than 95%97% of the Fortune 1000 and 90%93% of the FTSE 100. No customer accounted for as much as 2% of our consolidated revenues forin any of the years ended December 31, 2006, 2007, 2008 and 2008.2009. For each of the three years 20062007 through 2008,2009, the average volume reduction due to customers terminating their relationship with us was less than 2%.



•

Capital Expenditures Related Primarily to Growth.  Our information protectionbusiness requires significant capital expenditures to support our growth as well as our current operations. We believe that capital expenditures as a percent of revenues is a meaningful metric for investors as it indicates the efficiency with which we are investing in the internal growth of our business. For the years 2007 through 2009, our total capital expenditures as a percent of revenues were 14%, 13% and storage business requires10%, respectively. Included in the total are limited annual capital expenditures made in order to maintain our current revenue stream. We define these maintenance capital expenditures to include items such as major facility repairs including life, health and safety improvements, replacement of warehouse equipment, shredding bins, and certain computer equipment (including personal computers for employees and equipment for our operations), and system conversions. For each of the years 20062007 through 2008, over 85%2009, these maintenance capital expenditures represented approximately 2% of our annual revenues. The balance of our aggregate capital expenditures were growth-related investments, primarily in storage systems, which include racking, building and leasehold improvements, computer systems hardware and software, and buildings. These growth-related capital expenditures are primarily discretionary and create additional capacity for increases in revenues and Adjusted OIBDA. Since shifting our focus from growth through acquisitions to internal revenue growth, our capital expenditures in most years, made primarily to support our internal revenue growth, have generally exceeded the aggregate acquisition consideration we paid.paid in the same year. This was not the case in 2003 due to the acquisition of Hayes plc ("Hays IMS"), in 2004 due to the acquisition of Connected and the 49.9% equity interest held by Mentmore plc ("Mentmore") in Iron Mountain Europe Limited ("IME") and 2007 due to the acquisitions of ArchivesOne, Inc. ("ArchivesOne") and Stratify. We expect this trend to continue in the future absent unusual acquisition activity.

Growth Strategy

        Our objective is to maintain a leadership position in the information protection and storagemanagement services industry around the world, protecting and storing our customers' information and enabling them to better use it without regard to media format or geographic location. In the U.S. and Canada, we seek to be one of the largest information protection and storagemanagement services providers in each of our markets. Internationally, our objectives are to continue to capitalize on our expertise in the information protection and storagemanagement services industry and to make additional acquisitions and investments in selected international markets. We intend that our primary avenues of growth will continue to be: (1) the introduction of new products

Table of Contents

and services such as secure shredding, online backup, eDiscovery and DMS; (2) increased business with existing customers; (3) the addition of new customers; and (4) selective acquisitions in new and existing markets.

Table of Contents

Introduction of New Products and Services

        We continue to expand our portfolio of products and services. Adding new products and services allows us to further penetrate our existing customer accounts and attract new customers in previously untapped markets.

        In 2008,2009, we introduced two servicesnew technology solutions: Virtual File Store™ ("VFS"), an enterprise-class, cloud-based digital storage archiving service and eVantage™, an on-premises eDiscovery early case assessment solution. VFS is an on-demand, long-term storage service that reduces total cost of ownership for storing and managing static data files. As companies search for cost-effective solutions to further help healthcare organizations meet their uniquemanage large amounts of digital information, challenges. Through a new collaboration with Hewlett-Packard, we launched our Digital Record Center™ for Medical Images. This service combines HP technology with our storage-as-a-service expertise to protect diagnostic images like X-raysVFS solution offers secure, long-term storage of inactive data at off-site data centers, greatly reducing the investment in an expensive on-site storage infrastructure and CT scanssupporting regulatory and provide hospitals an alternative to in-house file rooms for long-term archiving. Also introduced last year was a diagnostic assessment tool that shows the nation's largest hospital systems how to process patient records more efficiently and prepare themselves for electronic health records. Adopted from RMS Services, a healthcare records specialist we acquired in October 2007, the assessment looks at the costs of staff, third-party vendors, storage and even lost revenue from file rooms occupying space that hospitals could use for treating patients.

        We also enhanced our DMS offerings with two new services for quickly accessingcompliance initiatives. Stratify's eVantage solution safeguards corporate proprietary information and derivingallows general counsel to reduce the cost and risk of eDiscovery by going beyond statistical data culling with advanced technologies that drive more business value from that information. The first is the Digital Record Center™ for Images, a digital repository powered by IBM software for electronic scans of paper documents stored with Iron Mountain. We later extended this strategic relationship with IBM by integrating our Accutrac® software for managing paper documents with IBM's FileNet Records Manager for electronic files. The unified offering gives companies one solution for viewingintelligent qualitative analysis on all matters and managing bothinternal investigations in their paper and electronic documents. The company acquired Accutrac in June 2007.eDiscovery portfolio.

Growth from Existing Customers

        Our existing customers storing physical records contribute to storage and storage-related service revenues growth because, on average, they generate additional cartons at a faster rate than old cartons are destroyed or permanently removed. In order to maximize growth opportunities from existing customers, we seek to maintain high levels of customer retention by providing premium customer service through our local account management staff.

        Our sales coverage model is designed to identify and capitalize on incremental revenue opportunities by allocating our sales resources based on a sophisticated segmentation of our customer base and selling additional records management, data protection & recovery and information destruction services, in new and existing markets, within our existing customer relationships. We also seek to leverage existing business relationships with our customers by selling complementary services and products. Services include special project work, data restoration projects, fulfillment services, consulting services and product sales (including software licenses, specially designed storage containers and related supplies). In addition, included in complementary services revenue is recycled paper revenues.

Addition of New Customers

        Our sales forces are dedicated to three primary objectives: (1) establishing new customer account relationships; (2) generating additional revenue from existing customers in new and existing markets; and (3) expanding new and existing customer relationships by effectively selling a wide array of complementary services and products. In order to accomplish these objectives, our sales forces draw on our U.S. and international marketing organizations and senior management.

Table of Contents

Growth through Acquisitions

        The goals of our current acquisition program are (1) to supplement internal growth in our physical businesses by expanding our new service capabilities and industry-specific services and continuing to expand our presence in targeted international markets; and (2) to accelerate our leadership and time to market in our digital businesses. We have a successful record of acquiring and integrating information protection and storagemanagement services companies. We substantially completed our geographic expansion in North America, Europe and Latin America by 2003 and began our expansion into Asia Pacific in 2005.

Table of Contents

Acquisitions in the U.S. and CanadaNorth American Physical Segment

        Given the small number of largeattractive acquisition targets in the U.S. and Canadaour core physical businesses in North America and our increased revenue base, future acquisitions are expected to be less significant to our overall U.S. and CanadaNorth American revenue growth.growth than in the past. Acquisitions in the U.S. and CanadaNorth American Physical segment will likely focus primarily on expanding our DMS capabilities and enhancing industry-specific services such as health information management solutions.

Acquisitions in the International Acquisition StrategyPhysical Segment

        We expect to continue to make acquisitions and investments in information protection and storagemanagement services businesses outside the U.S. and Canada.North America. We have acquired and invested in, and seek to acquire and invest in, information protection and storagemanagement services companies in countries, and, more specifically, markets within such countries, where we believe there is potential for significant growth. Future acquisitions and investments will focus primarily on developing priority expansion markets in Continental Europe and Asia, with continued leverage of our successful joint venture model. Similar to our strategy in the U.S. and Canada,North America, we will also explore international acquisitions that strengthen our capabilities in areas such as DMS and industry-specific services.

        The experience, depth and strength of local management are particularly important in our international expansion and acquisition strategy. Since beginning our international expansion program in January 1999, we have, directly and through joint ventures, expanded our operations into 3836 countries in Europe, Latin America and Asia Pacific. These transactions have taken, and may continue to take, the form of acquisitions of an entire business or controlling or minority investments, with a long-term goal of full ownership. We believe our joint venture strategy, rather than an outright acquisition, may, in certain markets, better position us to expand the existing business. The local partner benefits from our expertise in the information protection and storagemanagement services industry, our multinational customer relationships, our access to capital and our technology, and we benefit from our local partner'spartners' knowledge of the market, relationships with local customers and their presence in the community. In addition to the criteria we use to evaluate U.S. and CanadianNorth American acquisition candidates, when looking at an international investment or acquisition, we also evaluate the presence in the potential market of our existing customers as well as the risks uniquely associated with an international investment, including those risks described below.

        In 2006, we established a majority-owned joint venture serving four major markets in India and completed minority investments in information protection and storage businesses with operations in Poland and Russia. In 2007, we established a majority-owned joint venture in Asia Pacific for consideration of approximately $2 million with operations in Singapore, Hong Kong-SAR, China, Sri Lanka, Indonesia and Taiwan. In 2007, we acquired minority interests in information and protection and storage businesses in Denmark, Turkey and Greece. In 2008, we acquired a minority interest in an information protection and storage business in Switzerland.

Table of Contents

Our long-term goal is to acquire full ownership of each business in which we made a joint venture investment. Since 2005In 2008, we acquired the remaining minority equity ownership in our MexicanBrazilian operations and bought out partnership interests, in whole or in part, in Chile, Brazil, Eastern Europe and the Netherlands. As a result of these transactions we now own more than 98% of our international operations, measured as a percentage of consolidated revenues.

        Our international investments are subject to risks and uncertainties relating to the indigenous political, social, regulatory, tax and economic structures of other countries, as well as fluctuations in currency valuation, exchange controls, expropriation and governmental policies limiting returns to foreign investors.

        The amount of our revenues derived from international operations and other relevant financial data for fiscal years 2006, 2007, 2008 and 20082009 are set forth in Note 9 to Notes to Consolidated Financial Statements. For the years ended December 31, 2006, 2007, 2008 and 2008,2009, we derived approximately 30%32%, 32% and 32%30%, respectively, of our total revenues from outside of the U.S. As of December 31, 2006, 2007, 2008 and 2008,2009, we have long-lived assets of approximately 33%34%, 34%31% and 31%34%, respectively, outside of the U.S.

Digital Growth and Technology Innovation Strategy

        Similar to our physical businesses, we seek to grow revenuesAcquisitions in ourthe Worldwide Digital Segment by selling our products and services to existing and new customers.

        Our focus on technology innovation allows us to bring leading products and services to market designed to solve customer problems in the areas of data protection, archiving and discovery. Our

Table of Contents

approach to innovation has three major components: build, buyincludes our internal development efforts, partnering with other technology companies and partner.acquisition of new and existing technologies. We intend to build or develop our own technology in areas core to our strategy in order to protect and extend our leadposition in the market. Examples include, back up and archiving Software as a Service and data reduction technologies. Our technology acquisition strategy is designed to accelerate our product strategy, leadership and time to market and past examples include the Connected, LiveVault and Stratify acquisitions. Finally, weWe are developing global technology partnerships that complement our product and service offerings, allow us to offer a complete solution to the marketplace and keep us in contact with emerging technology companies.

Customers

Our customer basetechnology acquisition strategy is diversified in termsdesigned to accelerate our product strategy, leadership and time to market and past examples include the Connected (2004), LiveVault (2005), Stratify (2007) and Mimosa (2010) acquisitions. We expect our future technology acquisitions will be of revenuestwo primary types, those that bring us new or improved technologies to enhance our existing technology portfolio and industry concentration. As of December 31, 2008, we had over 120,000 corporate clients in a variety of industries. We currently provide services to commercial, legal, banking, healthcare, accounting, insurance, entertainmentthose that increase our market position through technology and government organizations, including more than 95% of the Fortune 1000 and more than 90% of the FTSE 100. No customer accounted for as much as 2% of our consolidated revenues for the years ended December 31, 2006, 2007 and 2008.established revenue streams.

Competition

        We compete with our current and potential customers' internal information protection and storagemanagement services capabilities. We can provide no assurance that these organizations will begin or continue to use an outside company such as Iron Mountain for their future information protection and storagemanagement services.

        We also compete with multiple information protection and storagemanagement service providers in all geographic areas where we operate. We believe that competition for customers is based on price, reputation for reliability, quality of service and scope and scale of technology and that we generally compete effectively in each of these areas.

Table of Contents

Alternative Technologies

        We derive most of our revenues from the storage of paper documents and storage-related services. This storage requires significant physical space. Alternative storage technologies exist, many of which require significantly less space than paper documents. These technologies include computer media, microform, CD-ROM and optical disk. To date, none of these technologies has replaced paper documents as the principal means for storing information. However, we can provide no assurance that our customers will continue to store most of their records in paper documents format. We continue to invest in additional services such as online backup and digital records management, designed to address our customers' need for efficient, cost-effective, high quality solutions for electronic records and information management.

Employees

        As of December 31, 2008,2009, we employed over 11,40010,500 employees in the U.S. and over 9,600 employees outside of the U.S. At December 31, 2008,2009, an aggregate of 550518 employees were represented by unions in California, Georgia and threefive cities in Canada.

        All non-union employees are generally eligible to participate in our benefit programs, which include medical, dental, life, short and long-term disability, retirement/401(k) and accidental death and dismemberment plans. Unionized employees receive these types of benefits through their unions. In addition to base compensation and other usual benefits, all full-time employees participate in some form of incentive-based compensation program that provides payments based on revenues, profits, collections or attainment of specified objectives for the unit in which they work. Management believes that we have good relationships with our employees and unions. However, since December 31 2007, one of ourAll union employees are currently under renewed labor contracts covering approximately 30 employees has expired, and we have beenagreements or operating under the expired contract while attempting to negotiate a replacementan extension agreement.

Table of Contents

Insurance

        For strategic risk transfer purposes, we maintain a comprehensive insurance program with insurers that we believe to be reputable and that have adequate capitalization in amounts that we believe to be appropriate. Property insurance is purchased on a comprehensive basis, including flood and earthquake (including excess coverage), subject to certain policy conditions, sublimits and deductibles. Property is insured based upon the replacement cost of real and personal property, including leasehold improvements, business income loss and extra expense. Among other types of insurance that we carry, subject to certain policy conditions, sublimits and deductibles are: medical, workers compensation, general liability, umbrella, automobile, professional, warehouse, legal and directors and officers liability policies. In 2002, we established a wholly-owned Vermont domiciled captive insurance company as a subsidiary through which we retain and reinsure a portion of our property loss exposure.

        Our customer contracts usually contain provisions limiting our liability with respect to loss or destruction of, or damage to, records stored with us. Our liability under these contracts is often limited to a nominal fixed amount per item or unit of storage, such as per cubic foot. We cannot assure you that where we have limitation of liability provisions that they will be enforceable in all instances or would otherwise protect us from liability. Also, some of our contracts with large volume accounts and some of the contracts assumed in our acquisitions contain no such limits or contain higher limits. In addition to provisions limiting our liability, our standard storage and service contracts include a schedule setting forth the majority of the customer-specific terms, including storage and service pricing and service delivery terms. Our customers may dispute the interpretation of various provisions in their contracts. While we have had relatively few disputes with our customers with regard to the terms of their customer contracts, and any disputes to date have not been material, we can give you no assurance that we will not have material disputes in the future.

Table of Contents

Environmental Matters

        Some of our current and formerly owned or leased properties were previously used by entities other than us for industrial or other purposes that involved the use, storage, generation and/or disposal of hazardous substances and wastes, including petroleum products. In some instances these properties included the operation of underground storage tanks or the presence of asbestos-containing materials. Although we have from time to time conducted limited environmental investigations and remedial activities at some of our former and current facilities, we have not undertaken an in-depth environmental review of all of our properties. We therefore may be potentially liable for environmental costs and may be unable to sell, rent, mortgage or use contaminated real estate owned or leased by us. Under various federal, state and local environmental laws, we may be potentially liable for environmental compliance and remediation costs to address contamination, if any, located at owned and leased properties as well as damages arising from such contamination, whether or not we know of, or were responsible for, the contamination, or the contamination occurred while we owned or leased the property. Environmental conditions for which we might be liable may also exist at properties that we may acquire in the future. In addition, future regulatory action and environmental laws may impose costs for environmental compliance that do not exist today.

        We transfer a portion of our risk of financial loss due to currently undetected environmental matters by purchasing an environmental impairment liability insurance policy, which covers all owned and leased locations. Coverage is provided for both liability and remediation costs.

Reincorporation

        On May 27, 2005, Iron Mountain Incorporated, a Pennsylvania corporation ("Iron Mountain PA"), reincorporated as a Delaware corporation. The reincorporation was effected by means of a statutory merger (the "Merger") of Iron Mountain PA with and into Iron Mountain Incorporated, a Delaware

Table of Contents

corporation ("Iron Mountain DE"), a wholly owned subsidiary of Iron Mountain PA. In connection with the Merger, Iron Mountain DE succeeded to and assumed all of the assets and liabilities of Iron Mountain PA. Apart from the change in its state of incorporation, the Merger had no effect on Iron Mountain PA's business, board composition, management, employees, fiscal year, assets or liabilities, or location of its facilities, and did not result in any relocation of management or other employees. The Merger was approved at the Annual Meeting of Stockholders held on May 26, 2005. Upon consummation of the Merger, Iron Mountain DE succeeded to Iron Mountain PA's reporting obligations and continued to be listed on the New York Stock Exchange under the symbol "IRM."

Internet Website

        Our Internet address iswww.ironmountain.com. Under the "Investors" section on our Internet website, we make available through a hyperlink to a third party website, free of charge, our Annual Report on Form 10-K, our Quarterly Reports on Form 10-Q, our Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934 (the "Exchange Act") as soon as reasonably practicable after such forms are filed with or furnished to the SEC. We are not including the information contained on or available through our website as a part of, or incorporating such information by reference into, this Annual Report on Form 10-K. Copies of our corporate governance guidelines, code of ethics and the charters of our audit, compensation, and nominating and governance committees may be obtained free of charge by writing to our Secretary, Iron Mountain Incorporated, 745 Atlantic Avenue, Boston, Massachusetts, 02111 and are available on the Investors section of our website,www.ironmountain.com, under the heading "Corporate Governance."

Table of Contents

Item 1A. Risk Factors.

        Our businesses face many risks. If any of the events or circumstances described in the following risks actually occur, our businesses, financial condition or results of operations could suffer and the trading price of our debt or equity securities could decline. Our investors and prospective investors should consider the following risks and the information contained under the heading "Cautionary Note Regarding Forward-Looking Statements" before deciding to invest in our securities.

Operational Risks

Governmental and customer focus on data security could increase our costs of operations. We may not be able to fully offset these costs through increases in our rates. In addition, incidents in which we fail to protect our customers' information against security breaches could result in monetary damages against us and could otherwise damage our reputation, harm our businesses and adversely impact our results of operations.

        In reaction to publicized incidents in which electronically stored information has been lost, illegally accessed or stolen, almost all states have adopted breach of data security statutes andor regulations that require notification to consumers if the security of their personal information, such as social security numbers, is breached. In addition, onein 2009 the United States Department of Health and Human Services adopted regulations requiring notification to persons whose personal health information is accessed by an unauthorized third party and provides for civil fines in some circumstances. One state has adopted and other states are considering, regulations requiring every company that maintains or stores personal information to adopt a comprehensive written information security programs, and the Federal Trade Commission has proposed legislation intended to addressprogram. In some instances European data protection authorities have issued large fines as a result of data security through various methods that include requiring notification to affected persons of breaches of data security.breaches. Our information security practices have been the subject of review or inquiry by governmental agencies, and we may be subject to additional reviews or inquiries of governmental agencies in the future.

        Continued governmental focus on data security may lead to additional legislative action. For example, the United States Congress is considering legislation intended to address data security through various methods that include requiring notification to affected persons of data security breaches. In

Table of Contents

addition, the increased emphasis on information security is leadingmay lead customers to request that we take additional measures to enhance security and assume higher liability under our contracts. We have experienced incidents in which customers' backup tapes or other records have been lost, and we have been informed by customers in some incidents that the lost media or records contained personal information. As a result of legislative initiatives and client demands, we may have to modify our operations with the goal of further improving data security. Any such modifications may result in increased expenses and operating complexity, and we may be unable to increase the rates we charge for our services sufficiently to offset any increased expenses.

        In addition to increases in the costs of operations or potential liability that may result from a heightened focus on data security, our reputation may be damaged by any compromise of security, accidental loss or theft of customer data in our possession. We believe that establishing and maintaining a good reputation is critical to attracting and retaining customers. If our reputation is damaged, we may become less competitive which could negatively impact our businesses, financial condition or results of operations.

Our customer contracts may not always limit our liability and may sometimes contain terms that could lead to disputes in interpretation.

        Our customer contracts usually contain provisions limiting our liability with respect to loss or destruction of, or damage to, records or information stored with us. Our liability under thesephysical storage contracts is often limited to a nominal fixed amount per item or unit of storage, such as per cubic foot. Our liability under our digital, DMS and other service contracts is often limited to a percentage of annual revenue under the contract. We cannot assure you that where we have limitation of liability provisions they will be enforceable in all instances or would otherwise protect us from liability. In addition to provisions limiting our liability, our standard storage and service contracts include a schedule setting forth the majority of the customer-specific terms, including storage and service pricing and service delivery terms. Our customers may dispute the

Table of Contents

interpretation of various provisions in their contracts. While we have had relatively few disputes with our customers with regard to the terms of their customer contracts, and any disputes to date have not been material, we can give you no assurance that we will not have material disputes in the future.

We face competition for customers.

        We compete, in some of our business lines, with our current and potential customers' internal information protection and storagemanagement services capabilities. These organizations may not begin or continue to use an outside company,a third party, such as our company, for their future information protection and storagemanagement services needs. We also compete, in both our physical and digital businesses, with multiple information protection and storagemanagement services providers in all geographic areas where we operate; our current or potential customers may choose to use those competitors instead of us.

We may not be able to effectively operate and expand our digital businesses.

        We operate certain digital information storage and protectionmanagement businesses and are implementing a planned expansion into other digital businesses. Our participation in these markets poses certain unique risks. For example, we may be unable to:

•

raise the amount of capital necessary to effectively participate in these markets;



•

successfully acquire and integrate businesses or technologies to complement our current service offerings;



•

keep up with rapid technological changes, evolving industry expectations and changing customer requirements;