5-Attachment 8_Supplement 1 of 5.pdf

2021 Annual Financial Report

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, DC 20549

FORM 10-K

(Mark One) ☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the Fiscal Year Ended December 31, 2021 or

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 For the transition period from to

Commission File Number 1-13045

IRON MOUNTAIN INCORPORATED

(Exact name of Registrant as Specified in Its Charter)

Delaware (State or other jurisdiction of incorporation)

One Federal Street, Boston, Massachusetts (Address of principal executive offices)

23-2588479 (I.R.S. Employer Identification No.)

02110 (Zip Code)

617-535-4766 (Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Title of Each Class Trading Symbols(s) Name of Exchange on Which Registered Common Stock, $.01 par value per share IRM New York Stock Exchange

Securities registered pursuant to Section 12(g) of the Act: None Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐ Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒ Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of

1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically, every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer”, “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act. (Check one):

Large accelerated filer ☒ Accelerated filer ☐ Non-accelerated filer ☐ Smaller reporting company ☐ Emerging growth company ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report .Yes ☒ No ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒ As of June 30, 2021, the aggregate market value of the Common Stock of the registrant held by non-affiliates of the registrant was approximately

$12.1 billion based on the closing price on the New York Stock Exchange on such date.

Number of shares of the registrant’s Common Stock at February 18, 2022: 289,830,119

DOCUMENTS INCORPORATED BY REFERENCE

Certain information required in Items 10, 11, 12, 13 and 14 of Part III of this Annual Report on Form 10-K (the “Annual Report”) is incorporated by reference from our definitive Proxy Statement for our 2022 Annual Meeting of Stockholders (our “Proxy Statement”) to be filed with the Securities and Exchange Commission (the “SEC”) within 120 days after the close of the fiscal year ended December 31, 2021.

Table of Contents

IRON MOUNTAIN INCORPORATED

2021 FORM 10-K ANNUAL REPORT

TABLE OF CONTENTS

PART I 01 ITEM 1. BUSINESS

09 ITEM 1A. RISK FACTORS

20 ITEM 1B. UNRESOLVED STAFF COMMENTS

21 ITEM 2. PROPERTIES

25 ITEM 3. LEGAL PROCEEDINGS

25 ITEM 4. MINE SAFETY DISCLOSURES

PART II 27 ITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER

MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

27 ITEM 6. [RESERVED.]

27 ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND

RESULTS OF OPERATIONS

58 ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK

59 ITEM 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA

59 ITEM 9. CHANGES IN AND DISAGREEMENTS WITH ACCOUNTANTS ON ACCOUNTING AND

FINANCIAL DISCLOSURE

60 ITEM 9A. CONTROLS AND PROCEDURES

62 ITEM 9B. OTHER INFORMATION

63 ITEM 9C. DISCLOSURE REGARDING FOREIGN JURISDICTIONS THAT PREVENT

INSPECTIONS

PART III 65 ITEM 10. DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE

65 ITEM 11. EXECUTIVE COMPENSATION

65 ITEM 12. SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNERS AND MANAGEMENT

AND RELATED STOCKHOLDER MATTERS

65 ITEM 13. CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS, AND DIRECTOR

INDEPENDENCE

65 ITEM 14. PRINCIPAL ACCOUNTANT FEES AND SERVICES

PART IV 67 ITEM 15. EXHIBITS AND FINANCIAL STATEMENT SCHEDULES

138 ITEM 16. FORM 10-K SUMMARY

References in this Annual Report on Form 10-K for the year ended December 31, 2021 (this "Annual Report") to “the Company,” “Iron Mountain,” “we,” “us” or “our” include Iron Mountain Incorporated, a Delaware corporation, and its predecessor, as applicable, and its consolidated subsidiaries, unless the context indicates otherwise.

CAUTIONARY NOTE REGARDING FORWARD-

LOOKING STATEMENTS

We have made statements in this Annual Report that constitute “forward-looking statements” as that term is defined in the Private Securities Litigation Reform Act of 1995 and other securities laws. These forward-looking statements concern our operations, economic performance, financial condition, goals, beliefs, future growth strategies, investment objectives, plans and current expectations, such as our (1) expectations and assumptions regarding the impact of the COVID-19 (as defined below) pandemic on us and our customers, including on our businesses, financial position, results of operations and cash flows, (2) commitment to future dividend payments, (3) expected change in volume of records stored with us, (4) expected growth in revenue, organic revenue, including 2022 consolidated organic storage rental revenue growth rate and consolidated organic total revenue growth rate, and Adjusted EBITDA (as defined below), (5) expectations that profits will increase in our growth portfolio, including our higher-growth markets, (6) expectations related to our revenue management programs and continuous improvement initiatives, (7) expectations related to monetizing our owned industrial real estate assets as part of our capital recycling program, (8) expected ability to identify and complete acquisitions and drive returns on invested capital, (9) anticipated capital expenditures, (10) expected benefits related to Project Summit (as defined below), and (11) other forward-looking statements related to our business, results of operations and financial condition. These forward-looking statements are subject to various known and unknown risks, uncertainties and other factors, and you should not rely upon them except as statements of our present intentions and of our present expectations, which may or may not occur. When we use words such as “believes,” “expects,” “anticipates,” “estimates”, "plans", "intends" or similar expressions, we are making forward-looking statements. Although we believe that our forward-looking statements are based on reasonable assumptions, our expected results may not be achieved, and actual results may differ materially from our expectations. In addition, important factors that could cause actual results to differ from expectations include, among others:

• the severity and duration of the COVID-19 pandemic and its effects on the global economy, including its effects on us, the markets we serve and our customers and the third parties with whom we do business within those markets;

• our ability to remain qualified for taxation as a real estate investment trust for United States federal income tax purposes

(“REIT”);

• changes in customer preferences and demand for our storage and information management services, including as a result of the shift from paper and tape storage to alternative technologies that require less physical space;

• our ability or inability to execute our strategic growth plan, including our ability to invest according to plan, incorporate new digital information technologies into our offerings, achieve satisfactory returns on new product offerings, continue our revenue management, expand internationally, complete acquisitions on satisfactory terms, integrate acquired companies efficiently and grow our business through joint ventures;

• changes in the amount of our capital expenditures;

• our ability to raise debt or equity capital and changes in the cost of our debt;

• the cost and our ability to comply with laws, regulations and customer demands, including those relating to data security and privacy issues, as well as fire and safety and environmental standards;

• the impact of litigation or disputes that may arise in connection with incidents in which we fail to protect our customers’ information or our internal records or information technology (“IT”) systems and the impact of such incidents on our reputation and ability to compete;

• changes in the price for our storage and information management services relative to the cost of providing such storage and information management services;

• changes in the political and economic environments in the countries in which our international subsidiaries operate and changes in the global political climate, particularly as we consolidate operations and move records and data across borders;

• our ability to comply with our existing debt obligations and restrictions in our debt instruments;

• the impact of service interruptions or equipment damage and the cost of power on our data center operations;

• the cost or potential liabilities associated with real estate necessary for our business;

• failures in our adoption of new IT systems;

• other trends in competitive or economic conditions affecting our financial condition or results of operations not presently contemplated; and

• the other risks described in our periodic reports filed with the SEC, including under the caption "Risk Factors" in Part I, Item 1A of this Annual Report.

Except as required by law, we undertake no obligation to update any forward-looking statements appearing in this report.

PART I

ITEM 1. BUSINESS.

BUSINESS OVERVIEW

We help organizations around the world protect their information, reduce storage costs, comply with regulations, facilitate corporate disaster recovery, and better use their information and IT infrastructure for business advantages, regardless of its format, location or life cycle stage. We do this by storing physical records and data backup media, offering information management solutions, and providing data center space for enterprise-class colocation and hyperscale deployments. We offer comprehensive records and information management services and data management services, along with the expertise and experience to address complex storage and information management challenges such as rising storage rental costs, legal and regulatory compliance, and disaster recovery requirements. We provide secure and reliable data center facilities to protect digital information and ensure the continued operation of our customers’ IT infrastructure, with reliable and flexible deployment options.

Founded in an underground facility near Hudson, New York in 1951, Iron Mountain Incorporated, a Delaware corporation, has approximately 225,000 customers in a variety of industries in 63 countries around the world, as of December 31, 2021. We currently serve customers across an array of market verticals - commercial, legal, financial, healthcare, insurance, life sciences, energy, business services, entertainment and government organizations, including approximately 95% of the Fortune 1000. As of December 31, 2021, we employed approximately 25,000 people. We are listed on the New York Stock Exchange (the “NYSE”) and are a constituent of the Standard & Poor’s 500 Index and the MSCI REIT index. As of December 31, 2021, we were number 605 on the Fortune 1000.

We have been organized and have operated as a REIT beginning with our taxable year ended December 31, 2014.

BUSINESS STRATEGY

OVERVIEW

Our company has been a market leader in the physical ecosystem supporting information storage and retrieval, as most businesses have relied on paper documents or computer tapes to store their valuable information. Over time, customers are increasing their digital information, with the new information storage ecosystem being a hybrid of physical and digital mediums. We are a different company than the one we have been historically. The strategic journey we are on is driving this change and our focus remains on four pillars outlined below to grow our business.

Continued growth in physical storage through revenue management as well as volume growth achieved in faster growing emerging markets and consumer and adjacent business growth in developed markets

• We are establishing and enhancing leadership positions in higher-growth markets such as central and eastern Europe, Latin America, Asia and Africa, through both organic expansion and acquisitions in countries where GDP growth is faster and outsourcing information management is at an earlier stage.

• We continue to identify, acquire, incubate and scale complementary businesses and products to support our long-term growth objectives and drive solid returns on invested capital. These opportunities include our digital services, Secure IT Asset Disposition and our Entertainment Services, Fine Arts and Consumer Storage (each as defined below) businesses.

Utilizing our global scale as well as 70 years of customer trust to deliver differentiated data center offerings

• We have made significant progress in scaling our Global Data Center Business through acquisitions and organic growth, with 19 operating data centers across 16 global markets.

• As of December 31, 2021, approximately 89% of our data center capacity was leased. With total potential capacity of 604 megawatts ("MW") in land and buildings currently owned or operated by us, we are among the largest global data center operators.

Developing and offering new products and services that allow our customers to achieve reliable and secure information management solutions in an increasingly hybrid physical and digital world

• Our customers are faced with navigating a more complex regulatory environment, and one in which hybrid physical and digital solutions have become the norm. Our strategy is underpinned by our persistent focus on best-in-class customer experience, as we continue to seek innovative solutions to help our customers progress on their journey from physical storage to a digital ecosystem.

IRON MOUNTAIN 2021 FORM 10-K 1

Increased investment in our business and customer-centric solutions

• We have established an investment strategy to fuel our growth. The investments are enabled by the success of Project Summit and informed by our established leadership position in the physical storage business, expanding services, and our significant progress in the Global Data Center business.

PROJECT SUMMIT

In October 2019, we announced our global program ("Project Summit") designed to better position us for future growth and achievement of our strategic objectives. We expanded Project Summit during the first quarter of 2020 to include additional opportunities to streamline our business and operations, as well as accelerated the timing of certain opportunities previously identified. As a result of this initiative, we simplified our global structure, rebalanced resources to focus on higher growth areas, realigned our management structure to create a more dynamic, agile organization, and made investments to enhance the customer experience. All Project Summit activities were completed in 2021, resulting in $375.0 million in annual Adjusted EBITDA benefits of which $165.0 million were delivered in 2020 and $160.0 million were delivered in 2021, with the remainder to come in 2022. Project Summit charges totaled approximately $450.0 million since the program's inception. For further details on Project Summit, see the "Overview" section of “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” in this Annual Report.

BUSINESS SEGMENTS

The amount of revenues derived from our business segments and other relevant data, including financial information about geographic areas and product and service lines, for the years ended December 31, 2021, 2020 and 2019, are set forth in Note 11 to Notes to Consolidated Financial Statements included in this Annual Report.

GLOBAL RIM BUSINESS

The Global RIM Business segment includes several distinct offerings.

Records Management, stores physical records and provides healthcare information services, vital records services, courier operations, and the collection, handling and disposal of sensitive documents (collectively, “Records Management”) for customers in 63 countries around the globe. As of December 31, 2021, we stored approximately 740 million cubic feet of hardcopy records.

Data Management, provides storage and rotation of backup computer media as part of corporate disaster recovery plans, including service and courier operations (“Data Protection & Recovery”); server and computer backup services; and related services offerings, (collectively, “Data Management”).

Global Digital Solutions (“GDS”), develops, implements and supports comprehensive storage and information management solutions for the complete lifecycle of our customers’ information, including the management of physical records, conversion of documents to digital formats and digital storage of information, primarily in the United States and Canada.

Secure Shredding, includes the scheduled pick-up of office records that customers accumulate in specially designed secure containers we provide and is a natural extension of our hardcopy records management operations, completing the lifecycle of a record. Complementary to our shredding operations is the sale of the resultant waste paper to third-party recyclers. Through a combination of shredding facilities and mobile shredding units consisting of custom built trucks, we are able to offer secure shredding services to our customers throughout the United States, Canada and South Africa.

Secure IT Asset Disposition ("Secure ITAD"), a component of asset life cycle management, provides secure disposition of obsolete IT assets with: industry leading secure logistics and chain of custody practices, environmentally-responsible asset processing and recycling, and data sanitization and asset refurbishment services that enable value recovery through asset remarketing. Our service focuses on protecting and eradicating customer data while maintaining strong, audible, and transparent chain of custody practices. We are able to offer this service in over 30 countries.

Consumer Storage, provides on-demand, valet storage for consumers (“Consumer Storage”) across 31 markets in North America through a strategic partnership that utilizes data analytics and machine learning to provide effective customer acquisition and a convenient and seamless consumer storage experience.

Table of Contents Part I

2 IRON MOUNTAIN 2021 FORM 10-K

GLOBAL DATA CENTER BUSINESS

The Global Data Center Business segment provides enterprise-class data center facilities and hyperscale-ready capacity to protect mission-critical assets and ensure the continued operation of our customers’ IT infrastructure, with secure, reliable and flexible data center options. The world’s most heavily regulated organizations have trusted us with their data centers for over 15 years, and as of December 31, 2021, five of the top 10 global cloud providers were Iron Mountain Data Center customers.

As of December 31, 2021, our Global Data Center Business footprint spans nine markets in the United States and seven international markets.

UNITED STATES INTERNATIONAL MARKETS

Denver, Colorado Amsterdam Kansas City, Missouri London Boston, Massachusetts Singapore Boyers, Pennsylvania Frankfurt (directly and through an unconsolidated joint venture) Manassas, Virginia Mumbai (through an unconsolidated joint venture) Edison, New Jersey Pune (through an unconsolidated joint venture) Columbus, Ohio Noida (through an unconsolidated joint venture) Phoenix and Scottsdale, Arizona

CORPORATE AND OTHER BUSINESS

The Corporate and Other Business segment consists primarily of Adjacent Businesses and other corporate items.

Adjacent Businesses is comprised of (i) entertainment and media which helps industry clients store, safeguard and deliver physical media of all types, and provides digital content repository systems that house, distribute, and archive key media assets, throughout the United States, Canada, France, China - Hong Kong S.A.R., the Netherlands and the United Kingdom (“Entertainment Services”) and (ii) technical expertise in the handling, installation and storing of art in the United States, Canada and Europe (“Fine Arts”).

Our Corporate and Other Business segment also includes costs related to executive and staff functions, including finance, human resources and IT, which benefit the enterprise as a whole.

Table of Contents

IRON MOUNTAIN 2021 FORM 10-K 3

BUSINESS ATTRIBUTES

Our business has the following attributes:

Large, Diversified, Global Business

The world’s most heavily regulated organizations trust us with the storage of their records. Our mission-critical storage offerings and related services generated approximately $4.5 billion in annual revenue in 2021. Our business has a highly diverse customer base of approximately 225,000 customers - with no single customer accounting for more than approximately 1% of revenue during the year ended December 31, 2021 - and operates in 63 countries globally. This presents a significant cross-sell opportunity for our Global Data Center, Global Digital Solutions and Global Secure IT Asset Disposition businesses.

Recurring, Durable Revenue Stream

We generate a majority of our revenues from contracted storage rental fees, via agreements that generally range from one to five years in length. Historically, in our Records Management business, we have seen strong customer retention (of approximately 98%) and solid physical records retention; more than 50% of physical records that entered our facilities 15 years ago are still with us today. We have also seen strong customer retention in our Global Data Center Business.

Comprehensive Information Management Solution

As an S&P 500 REIT with approximately 1,450 locations globally and with offerings spanning physical storage, digitization solutions and digital storage, we are positioned to provide a holistic offering to our customers. We are able to cater to our customers’ physical and digital needs and to help guide their digital transformation journey.

Significant Owner and Operator of Real Estate

We operate approximately 95 million square feet of real estate worldwide. Our owned real estate footprint spans nearly 25 million square feet and is concentrated in major metropolitan statistical areas in North America, Western Europe and Latin America.

Limited Revenue Cyclicality

Historically, economic downturns have not significantly affected our storage rental business. Due to the durability of our total global physical volumes, the success of our revenue management initiatives, and the growth of our Global Data Center Business, we believe we can continue to grow organic storage rental revenue over time.

Shifting Revenue Mix We have identified a number of areas where we see opportunity for growth as we position ourselves to unlock greater value for our customers. These business lines, including Data Center, Fine Arts and Entertainment Services, Consumer Storage and Secure IT Asset Disposition, represent markets with strong secular growth.

Table of Contents

4 IRON MOUNTAIN 2021 FORM 10-K

In addition, our Global Data Center business has the following attributes:

Large Data Center Platform with Significant Expansion Opportunity

As of December 31, 2021, we had 177 MW of leasable capacity with an additional 427 MW under construction or held for development.

Differentiated Compliance and Security

We offer comprehensive compliance support and physical and cyber security. Our Security-in-Depth approach to security includes a combination of technical and human security measures, and experienced senior military and public sector security leaders oversee our security. As of December 31, 2021, our data centers comply with one of the most comprehensive compliance programs in the industry, including enterprise-wide certified ISO 14001 and 50001 environmental and energy management systems. We also report globally on service organizational controls, as well as global ISO 27001 certification, and PCI-DSS compliance, and met FISMA HIGH and FedRAMP controls in the United States.

Efficient Access and Flexibility

We have the ability to provide customers with a range of deployment options from one cabinet to an entire building, leveraging our global portfolio of hyperscale-ready and underground data centers. We also provide access to numerous carriers, cloud providers and peering exchanges with migration support and IT.

100% Green Powered Data Centers

As of December 31, 2021, our Global Data Center platform was powered by 100% renewable energy, with carbon credit assistance and low power usage effectiveness (“PUE"). We are one of the top 30 buyers of renewable energy among the Fortune 1000 and now offer the Green Power Pass, which allows customers to include the power they consume at any Iron Mountain data centers as green power in their CDP, RE100, GRI, or other sustainability reporting.

COMPETITION

We compete with thousands of storage and information management services providers around the world as well as storage and information management services managed and operated internally by organizations. We believe that competition for records and information customers is based on price, reputation and reliability, quality and security of storage, quality of service and scope and scale of technology. While the majority of our competitors operate in only one market or region, we believe we provide a differentiated global offering that competes effectively in these areas.

We also compete with numerous data center developers, owners and operators, many of whom own properties similar to ours in some of the same metropolitan areas where our facilities are located. We believe that competition for data center customers is based on availability of power, security considerations, location, connectivity and rental rates, and we generally believe we compete effectively in each of these areas. Additionally, we believe our strong brand, global footprint and excellent commercial relationships enable us to compete successfully and provide significant cross-sell opportunities with our existing customer base.

HUMAN CAPITAL MANAGEMENT

EMPLOYEES

As of December 31, 2021, we employed approximately 9,000 employees in the United States and approximately 16,000 employees outside of the United States. As of December 31, 2021, approximately 500 employees were represented by unions in North America and approximately 1,250 employees were represented by unions in Latin America. All union employees are currently under renewed labor agreements or operating under an extension agreement.

BENEFIT PROGRAMS

We provide our employees with benefits that are designed to support their overall physical, financial, emotional and social well-being. These benefits vary by location but may include health and welfare benefits, paid time off, and programs to support financial security. Additionally, employees are able to access emotional well-being resources through global employee assistance programs.

Certain unionized employees receive benefits through unions and are not eligible to participate in our benefit programs. In addition to base compensation and other usual benefits, a significant portion of full-time employees participate in some form of incentive-based compensation program that provides payments based on revenues, profits or attainment of specific objectives for the unit in which they work.

Table of Contents

IRON MOUNTAIN 2021 FORM 10-K 5

DIVERSITY, EQUITY AND INCLUSION

At Iron Mountain, we believe that an inclusive environment with diverse teams produces more creative solutions, results in better, more innovative products and services and is crucial to our efforts to attract and retain key talent. As one of our five core company values, Promoting Including and Teamwork is a behavior all of our employees are expected to demonstrate every day. We have prioritized diversity, equity and inclusion ("DEI") as part of our corporate-wide strategic goals. Steps we have taken to create and sustain a more diverse, equitable and inclusive environment include: hiring a Global Chief Diversity, Equity & Inclusion Officer with significant DEI experience to lead our cultural transformation, the path to creating an environment of inclusiveness and belonging.

We review and revise our systems, policies and processes to assure that our structures facilitate inclusiveness and accountability.

We ensure that our recruiting efforts reflect our diversity goals and we launch, expand and support our Employee Resource Groups, who meet and connect on shared characteristics and life experiences that can prove impactful to our business, our customers and our employees.

COMPANY CULTURE

We recognize that an inspired culture is foundational to how we deliver on our purpose and create sustained growth and value for our shareholders. Iron Mountain's culture is deeply rooted in its enduring values: Act with Integrity, Own Safety and Security, Build Customer Value, Take Ownership and Promote Inclusion and Teamwork. While Iron Mountain is a culture of learning, collaboration, diversity and well-being, we know that culture overall comes down to what it feels like to work at Iron Mountain. This is why we celebrate our employees who consistently demonstrate Iron Mountain's values in measurable ways while inspiring others to do the same. We commit significant resources to sustaining a culture that enables innovation and facilitates trust, engagement, belonging and performance. We regularly survey our employees on a range of topics to measure our effectiveness and to obtain their views. In addition, headcount data and cost analyses offer insights into how and where our employees work. We use all of this information to refine our approach when necessary to drive increased employee engagement and success.

COMMUNITY INVOLVEMENT

We are committed to integrating responsible and sustainable practices throughout our organization to help our operations to have a positive impact on the environment and the communities in which we operate. We aim to give back to the communities where we live and work, and believe that this commitment helps in our efforts to attract and retain employees. We offer philanthropic support to our global community through our Living Legacy Initiative, which is our commitment to help preserve and make accessible cultural and historical information and artifacts. We encourage volunteerism in the communities in which we live and work through our Moving Mountains volunteer program, offering paid time off for employees to help community-based and civic-minded organizations.

INSURANCE

For strategic risk transfer purposes, we maintain a comprehensive insurance program with insurers that we believe to be reputable and that have adequate capitalization in amounts that we believe to be appropriate. Property insurance is purchased on a comprehensive basis, including flood and earthquake (including excess coverage), subject to certain policy conditions, sublimits and deductibles. Property is insured based upon the replacement cost of real and personal property, including leasehold improvements, business income loss and extra expense. Other types of insurance that we carry, which are also subject to certain policy conditions, sublimits and deductibles, include medical, workers’ compensation, general liability, umbrella, automobile, professional, warehouse legal liability and directors’ and officers’ liability policies.

GOVERNMENT REGULATION

We are required to comply with numerous U.S. federal, state, and foreign laws and regulations covering a wide variety of subject matters which may have a material effect on our capital expenditures, earnings and competitive position.

For example, some of our current and formerly owned or leased properties were previously used by entities other than us for industrial or other purposes, or were affected by waste generated from nearby properties, that involved the use, storage, generation and/or disposal of hazardous substances and wastes, including petroleum products. In some instances, this prior use involved the operation of underground storage tanks or the presence of asbestos-containing materials. Where we are aware of environmental conditions that require remediation, we undertake appropriate activity, in accordance with all legal requirements.

Although we have from time to time conducted limited environmental investigations and remedial activities at some of our former and current facilities, we have not undertaken an environmental review of all of our properties, including those we have acquired.

We therefore may be potentially liable for environmental cost and may be unable to sell, rent, mortgage or use contaminated real estate owned or leased by us. Under various federal, state and local environmental laws, we may be liable for environmental compliance and remediation costs to address contamination, if any, located at owned and leased properties as well as damages arising from such contamination, whether or not we know of, or were responsible for, the contamination, or the contamination occurred while we owned or leased the property. Environmental conditions for which we might be liable may also exist at properties that we may acquire in the future. In addition, future regulatory action and environmental laws may impose costs for environmental compliance that do not exist today.

Table of Contents

6 IRON MOUNTAIN 2021 FORM 10-K

We transfer a portion of our risk of financial loss due to currently undetected environmental matters by purchasing an environmental impairment liability insurance policy, which covers all owned and leased locations. Coverage is provided for both liability and remediation costs.

In addition, we are subject to numerous U.S. federal, state, local and foreign laws and regulations relating to data privacy and cybersecurity, which are complex, change frequently and have tended to become more stringent over time. We devote substantial resources, and may in the future have to devote significant additional resources, to facilitate compliance with these laws and regulations, and to investigate, defend or remedy actual or alleged violations or breaches. Any failure by us to comply with, or remedy any violations or breaches of, these laws and regulations could result in the curtailment of certain of our operations, the imposition of fines and penalties, liability resulting from litigation, restrictions on our ability to carry on or expand our operations, significant costs and expenses and reputational harm.

For more information about laws and regulations that could affect our business, see “Item 1A. Risk Factors” included in this Annual Report.

CORPORATE SOCIAL RESPONSIBILITY

Through our approach to Corporate Social Responsibility, we not only see ourselves as having our own responsibility to society, but also in helping our customers with their own environmental, social and governance (ESG) goals, and helping them gain value, make improvements and save costs. We are committed to responsible, sustainable growth. To that end, we have publicly adopted 20 goals to address our environmental footprint, corporate philanthropy and volunteerism and DEI practices. As signatories of The Climate Pledge, we are on a path to reach net zero carbon emissions by 2040. We are committed to the safety and well-being of our employees and strive to cultivate a culture of inclusion that values diverse perspectives across our global workforce. Iron Mountain and its employees also make a social impact in the communities in which we operate through charitable giving and volunteerism.

We have been recognized for our commitment to Corporate Social Responsibility. We ranked 93rd on Newsweek’s 2022 list of America’s Most Responsible Companies. We were a top scorer on the Disability Equality Index in 2020 and 2021. We received a 100% on the Human Rights Campaign Corporate Equality Index for each of the years 2018 through 2022.

We are committed to transparent reporting on sustainability and corporate responsibility efforts in accordance with the guidelines of the Global Reporting Initiative. Our corporate responsibility report highlights our progress against key measures of success for our efforts in the community, our environment, and for our people. We are a member of the FTSE4 Good Index, MSCI World ESG Index, MSCI World Climate Change Index and MSCI USA ESG Select Index, each of which include companies that meet globally recognized corporate responsibility standards. A copy of our corporate responsibility report is available on the “About Us” section of our website, www.ironmountain.com, under the heading “Corporate Social Responsibility." We are not including the information contained on or available through our website as part of, or incorporating such information by reference into, this Annual Report. In addition, we continue to work to further align our reporting with the recommendations of the Financial Stability Board’s Task Force on Climate-related Financial Disclosures to disclose climate-related financial risks and opportunities.

STRONG SUSTAINABILITY FOCUS

• Green Power Pass solution in Data Center market to help customers manage their carbon footprint.

• Part of RE100 Initiative — commitment to using renewable energy sources for 100% of our worldwide electricity.

• Founding signatory of the 24/7 Carbon-Free Energy (CFE) Compact committed to consuming carbon-free electricity every hour on every grid where we operate.

• 81% of our global electricity use - including 100% of the electricity used to power our Data Center business was from renewable sources in 2020.

• Reduced GHG emissions by 62% (since 2016) as part of our Science Based Target and net zero by 2040 commitment.

• Received a 100% on the Human Rights Campaign Corporate Equality Index for each of the years 2018 through 2022.

Table of Contents

IRON MOUNTAIN 2021 FORM 10-K 7

INTERNET WEBSITE

Our Internet address is www.ironmountain.com. Under the “Investors” section on our website, we make available, free of charge, our Annual Reports on Form 10-K, our Quarterly Reports on Form 10-Q, our Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934 (the “Exchange Act”) as soon as reasonably practicable after such forms are filed with or furnished to the SEC. We are not including the information contained on or available through our website as a part of, or incorporating such information by reference into, this Annual Report.

Copies of our corporate governance guidelines, code of ethics and the charters of our audit, compensation, finance, nominating and governance, risk and safety, and technology committees are available on the “Investors” section of our website, www.ironmountain.com, under the heading “Corporate Governance."

Table of Contents

8 IRON MOUNTAIN 2021 FORM 10-K

ITEM 1A. RISK FACTORS.

We face many risks. If any of the events or circumstances described below actually occur, we and our businesses, financial condition or results of operations could suffer, and the trading price of our debt or equity securities could decline. Our current and potential investors should consider the following risks and the information contained under the heading “Cautionary Note Regarding Forward-Looking Statements” before deciding to invest in our securities.

BUSINESS RISKS

Failure to execute our strategic growth plan may adversely impact our financial condition and results of operations.

As part of our strategic growth plan we expect to invest in our existing businesses, including records and information management storage and services businesses in our higher-growth markets, data centers, asset life cycle management and secure information technology asset disposition, consumer storage and other adjacent businesses, and in new businesses, business strategies, products, services, technologies and geographies, and we may selectively divest certain businesses. These initiatives may involve significant risks and uncertainties, including:

• our inability to maintain relationships with key customers and suppliers or to execute on our plan to incorporate the digitization of our customers’ records and new digital information technologies into our offerings;

• failure to achieve satisfactory returns on new product offerings, acquired companies, joint ventures, growth initiatives, or other investments, particularly in markets where we do not currently operate or have a substantial presence;

• our inability to identify suitable companies to acquire, invest in or partner with;

• our inability to complete acquisitions or investments on satisfactory terms;

• our inability to structure acquisitions or investments in a manner that complies with our debt covenants and is consistent with our leverage ratio goals;

• challenges in managing costs to offset the impact of inflationary pressure;

• increased demands on our management, operating systems, internal controls and financial and physical resources and, if necessary, our inability to successfully expand our infrastructure;

• incurring additional debt necessary to acquire suitable companies or make other growth investments if we are unable to pay the purchase price or make the investment out of working capital or the issuance of our common stock or other equity securities;

• our inability to manage the budgeting, forecasting and other process control issues presented by future growth, particularly with respect to operations in countries outside of the United States or in new lines of business;

• insufficient revenues to offset expenses and liabilities associated with new investments;

• our inability to attract, develop and retain skilled employees to lead and support our strategic growth plan, particularly in new businesses, technologies, products or offerings outside our core competencies; and

• challenges in executing on our strategic growth plan within the constraints of our REIT structure, as well as remaining REIT compliant.

Our new ventures are inherently risky and we can provide no assurance that such strategies and offerings will be successful in achieving the desired returns within a reasonable timeframe, if at all, and that they will not adversely affect our business, reputation, financial condition, and operating results.

We face competition from other companies to grow our business, and, as a result, we may be unable to acquire or invest in, or we may pay a premium purchase price for, data centers, technology and adjacent businesses and businesses in higher-growth markets that support our strategic growth plan, which could have an adverse effect on our results of operations and financial condition.

As stored records and tapes become less active our service revenue growth and profits from related services may decline.

Our Records Management and Data Management service revenue growth is being negatively impacted by declining activity rates as stored records and tapes are becoming less active and more archival, and these activity levels were further negatively impacted by the COVID-19 pandemic. The amount of information available to customers digitally or in their own information systems has been steadily increasing in recent years, and we believe this trend will continue. As a result, our customers are less likely than they have been in the past to retrieve records and rotate tapes, thereby reducing their activity levels. At the same time, many of our costs related to records and tape related services remain relatively fixed. In addition, our reputation for providing secure information storage is critical to our success, and actions to manage cost structure, such as outsourcing certain transportation, security or other functions, could negatively impact our reputation and adversely affect our business. Ultimately, if we are unable to appropriately align our cost structure with decreased levels of service activity, our operating results could be adversely affected.

Table of Contents

IRON MOUNTAIN 2021 FORM 10-K 9

Our customers may shift from paper and tape storage to alternative technologies that may shift our revenue mix away from storage revenue.

We derive substantial revenues from rental fees for the storage of physical records and computer backup media and from storage related services. Storage volume and/or demand for our traditional storage related services may decline as our customers adopt alternative storage technologies or as retention requirements evolve, which may require significantly less space than traditional physical records and tape storage. To date, our customers’ shift from paper and tape storage to alternative technologies has not accelerated as a result of the COVID-19 pandemic. While volumes in our Global RIM Business segment were relatively steady in 2021 and we expect them to remain relatively consistent in the near term, we can provide no assurance that our customers will continue to store most or a portion of their records as paper documents or as tapes, or that the paper documents or tapes they do store with us will require our storage related services at the same levels as they have in the past. A significant shift by our customers to storage of data through non-paper or non-tape-based technologies, whether now existing or developed in the future, could adversely affect our businesses. In addition, the digitization of records may shift our revenue mix from the more predictable storage revenue to service revenue, which is inherently more volatile.

Our future growth depends in part upon our ability to continue to effectively manage and execute on revenue management.

Over the past several years, our organic revenue growth has been positively impacted by our ability to effectively introduce, expand and monitor revenue management initially in our more established markets, and subsequently in our higher-growth markets. If we are not able to continue and effectively manage pricing, our results of operations could be adversely affected and we may not be able to execute on our strategic growth plan.

Changes in customer behavior with respect to destruction of records stored with us could adversely affect our business, financial condition and results of operations.

Over the past several years, our destruction rates, as a percentage of records stored with us, have fluctuated. When destruction rates for records stored with us increase, it has a positive impact on our service revenues in the year of destruction but negatively impacts our longer term storage revenues, adversely affecting our financial condition and results of operations.

We and our customers are subject to laws and governmental regulations relating to data privacy and cybersecurity and our customers’ demands in this area are increasing. This may cause us to incur significant expenses and non-compliance with such regulations and demands could harm our business.

We are subject to numerous U.S. federal, state, local and foreign laws and regulations relating to data privacy and cybersecurity.

These regulations are complex, change frequently and have tended to become more stringent over time. There are also a number of legislative proposals pending before the U.S. Congress, various state legislative bodies and foreign governments concerning data protection that could affect us. In addition, a growing number of U.S. and foreign legislative and regulatory bodies have adopted consumer notification and other requirements if consumer information is accessed by unauthorized persons and additional regulations regarding the use, access, accuracy and security of such information are possible. In the U.S., we are subject to various state laws which provide for disparate notification regimes. In addition, as a result of the continued emphasis on information security and instances in which personal information has been compromised, our customers are requesting that we take increasingly sophisticated measures to enhance security and comply with data privacy regulations, and that we assume higher liability under our contracts.

We devote substantial resources, and may in the future have to devote significant additional resources, to facilitate compliance with laws and regulations, our customers’ data privacy and security demands, and to investigate, defend or remedy actual or alleged violations or breaches. Any failure by us to comply with, or remedy any violations or breaches of, laws and regulations or customer requirements could result in the curtailment of certain of our operations, the imposition of fines and penalties, liability resulting from litigation, restrictions on our ability to carry on or expand our operations, significant costs and expenses and reputational harm.

Table of Contents

10 IRON MOUNTAIN 2021 FORM 10-K

Attacks on our internal IT systems could damage our reputation, cause us to lose revenues, and adversely affect our business, financial condition and results of operations.

Our reputation for…