Expedia (EXPE) Risk Analysis

The Company classifies its electronic data and information systems based on the sensitivity and criticality of the data involved and deploys commensurate technical safeguards, including but not limited to firewalls, encryption, network segmentation, real-time monitoring, intrusion prevention systems, anti-malware, and access controls. The Company's cybersecurity incident response plan, modeled on NIST 800-61, is built on a comprehensive framework which sets forth guidance and procedures required for the life cycle of an incident. The plan establishes processes for use by a cross-functional cybersecurity incident response team with the resources necessary to take action in a timely and decisive manner during the response, investigation, and remediation of an incident, and to comply with legal obligations. The Company tests, trains, and evaluates its incident response capabilities on at least an annual basis and updates its incident response plan accordingly. The Company also maintains insurance coverage for cybersecurity incidents.

As discussed in more detail under the heading "Cybersecurity Governance" below, as part of its general oversight duties, the Board oversees the Company's risk management, including its cybersecurity risks. The Board is supported in its oversight of cybersecurity risks by the Audit Committee, which regularly interacts with the Company's risk management function, the Company's Chief Information Security Officer function ("CISO") and the Company's Chief Technology Officer function ("CTO").

The Company's external service provider management program requires all third-party service providers to comply with the Company's security standards, including notification procedures in the event of an incident involving Company confidential information. The Company requires its service providers to ensure that their own third-party vendors and subcontractors comply with the Company's security standards when working with Company information. In addition, the Company performs diligence on external service providers and their vendors that have access to the Company's information and/or information systems, and conducts ongoing monitoring throughout the life of the relationship, including re-assessments in light of any significant changes to the provider's security controls or technical landscape.

The Company's cybersecurity risk management program is based on industry standard information security principles and best practices, specifically the NIST Cybersecurity Framework and the Payment Card Industry Data Security Standard ("PCI DSS"). The program encompasses all Company directly-managed brands, entities, and internal organizations other than its publicly-traded trivago subsidiary, which has its own standalone cybersecurity risk management program, and uses a proactive approach to continuously identify and assess cybersecurity threats, vulnerabilities and risks, and to evaluate the effectiveness of implemented security controls through internal audits, external threat intelligence, and periodic external independent assessments. Risks identified and assessed through the cybersecurity risk management program are then communicated to the Company's senior leadership team and used to prioritize risks based on their potential impact and likelihood as part of the Company's dynamic risk response strategy.

The Company regularly reviews its cybersecurity policies, standards, and programs and evaluates the effectiveness of implemented security controls. In addition to performing internal audits, assessments, tabletop exercises, and vulnerability testing, the Company periodically engages third parties to perform information security maturity assessments, audits, cyber breach root cause analysis, and independent reviews of its information security control environment and operating effectiveness. The Company's CISO provides regular reports on the results of such assessments to the Audit Committee and the Company's senior leadership team, and the Company adjusts its cybersecurity policies, standards, and programs as necessary based on these reviews. To date, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially adversely affected, or are reasonably likely to materially adversely affect, the Company, including its business strategy, results of operations or financial condition. Although the Company's cybersecurity risk management program, as described above, is designed to help prevent, detect, respond to, and mitigate the impact of cybersecurity incidents, there is no guarantee that a future cybersecurity incident would not materially adversely affect the Company's business strategy, results of operations or financial condition. For information regarding cybersecurity risks that the Company faces and potential impacts on its business related thereto, see the disclosure set forth in Part I, Item 1A, Risk Factors, under the caption "System interruption, security breaches and unplanned outages in our information systems, or those of third-party providers on which we rely, may harm our businesses."