Marriott International (MAR) Risk Analysis

We have enhanced our security measures to safeguard our information systems and data, and we intend to continue implementing additional measures in the future, but, as we have seen in the past, our measures may not be sufficient to maintain the confidentiality, security, or availability of the data we collect, store, and use to operate our business. Security measures implemented by our hotel owners, service providers, and other third parties with whom we or they do business also may not be sufficient, as we have seen in the past. Efforts to hack or circumvent security measures, efforts to gain unauthorized access to, exploit or disrupt the operation or integrity of our data or information systems, failures of information systems or software to operate as designed or intended, viruses, "ransomware" or other malware, "supply chain" attacks, "phishing" or other types of business communications compromises, operator error, or inadvertent releases of data have impacted, and may in the future impact, our information systems and records or those of our hotel owners, service providers, or other third parties with whom we or they do business. Security measures, no matter how well designed or implemented, may only mitigate and not fully eliminate risks, and security events, when detected by security tools or third parties, may not always be immediately understood or acted upon. Our reliance on computer, Internet-based, and mobile systems and communications, and the frequency and sophistication of efforts by third parties to gain unauthorized access or prevent authorized access to such systems, have greatly increased in recent years. Our increased reliance on cloud-based services and on remote access to information systems and our use of AI and other emerging technologies increases the Company's exposure to potential cybersecurity incidents. We and our hotel owners, service providers, and other third parties with whom we or they do business have experienced cyberattacks, attempts to disrupt access to systems and data, and attempts to affect the operation or integrity of data or systems, and the frequency and sophistication of such efforts could continue to increase. Any additional significant theft of, unauthorized access to, compromise or loss of, loss of access to, or fraudulent use of guest, associate, hotel owner, service provider, Company, or other data as a result of a cybersecurity incident could adversely impact our reputation and could result in legal, regulatory, and other consequences, including remedial and other expenses, fines, or litigation. Depending on the nature and scope of the event, future compromises in the security of our information systems or those of our hotel owners, service providers, or other third parties with whom we or they do business, or other future disruptions or compromises of data or information systems, could lead to future interruptions in, or other adverse effects on, the operation of our systems or those of our hotel owners, service providers, or other third parties with whom we or they do business. This could result in operational interruptions and/or outages and a loss of profits, as well as negative publicity and other adverse effects on our business, including lost sales, loss of consumer confidence, boycotts, reduced enrollment and/or participation in our Loyalty Program, litigation, regulatory investigations or actions, diminished associate satisfaction, and/or retention and recruiting difficulties, all of which could materially affect our market share, reputation, business, financial condition, or results of operations. Because we have experienced cybersecurity incidents in the past, additional cybersecurity incidents or the failure to detect and appropriately respond to additional cybersecurity incidents could magnify the severity of the adverse effects on our business. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage information systems change frequently (including the integration of AI and other emerging technologies), can be difficult to detect for long periods of time, and can involve difficult or prolonged assessment or remediation periods even once detected, which could also magnify the severity of these adverse effects. We cannot assure you that all potential causes of past significant cybersecurity incidents have been identified and remediated; additional measures may be needed to prevent significant incidents in the future. The steps we take may not be sufficient to prevent future significant cybersecurity incidents, and as a result, such incidents may occur again. Although we carry cyber insurance that is designed to protect us against certain losses related to cyber risks, that insurance coverage may not be sufficient or available to cover all expenses or other losses (including payments, fines, or penalties) or all types of claims that may arise in connection with cyberattacks, security compromises, and other related incidents. Furthermore, in the future such insurance may not be available on commercially reasonable terms, or at all.

The lodging industry continues to demand the use of sophisticated technology and systems, including those used for our reservation, customer relationship management, finance, analytics, revenue management, property management, human resources and payroll systems, our Loyalty Program, and technologies we make available to our guests and for associates, and these and other technologies and systems must be refined, updated, and/or replaced with more advanced systems on a regular basis. Our business could suffer if we cannot refine, update, and/or replace technologies and systems as quickly or effectively as our competitors, sufficiently in advance of obsolescence or performance failure or degradation, or within budgeted costs and time frames. We also may not achieve the benefits that we anticipate from any new or upgraded technology or system, and a failure to do so could result in higher than anticipated costs or lower guest satisfaction or could impair our operating results. We are undertaking a multi-year transformation of our reservations, property management, and loyalty systems. The development and deployment of our new systems could involve delays, system interruptions, compromises of data security, or other operational impacts, including impacts on our financial reporting or internal control environment. Additionally, if we fail to keep pace with rapidly-evolving technological developments in AI and other emerging technologies, our competitive position and business may suffer.

We and the hotels in our system compete with other companies both within and outside of our industry for personnel. We and the hotels in our system have in the past experienced, and could in the future experience, challenges hiring for certain positions due to various factors, such as increasing wage expectations or competition for labor from other industries, and these circumstances could continue or worsen in the future to an extent and for durations that we are not able to predict. If we or the hotels in our system cannot recruit, train, develop, and retain sufficient numbers of associates, we could experience significant negative impacts on operations, associate morale and turnover, guest satisfaction, or our internal control environment. Insufficient numbers of associates could also limit our ability to grow and expand our business. Labor shortages have in the past resulted, and could in the future result, in higher wages and initial hiring costs, increasing our labor costs and labor costs at hotels in our system, which could reduce our revenues and profits. In addition, the efforts and abilities of our senior executives are important elements of maintaining our competitive position and driving future growth, and the loss of the services of one or more of our senior executives could result in challenges executing our business strategies or other adverse effects on our business.

Our agreements with hotel owners may be subject to premature termination in certain circumstances, such as the bankruptcy of a hotel owner, the failure of a hotel owner to comply with its payment or other obligations under the agreement, a failure under some agreements to meet specified financial or performance criteria which we do not cure, or in certain limited cases, other negotiated contractual termination rights. Hotel owners may assert the right to terminate our agreements even where the agreements provide otherwise, and some courts have upheld such assertions about our agreements and may do so in the future. When terminations occur for certain of these or other reasons, we may seek to enforce our right to damages for breach of contract and related claims, which may cause us to incur significant legal fees and expenses. We have in the past had, and could in the future have, difficulty collecting damages from the hotel owner, and any damages we ultimately collect could be less than the projected future value of the fees and other amounts we would have otherwise collected under the agreement with the hotel owner. A significant loss of these agreements could materially hurt our financial performance or our ability to grow our business.