Marriott International (MAR) Risk Factors

We compete with other companies both within and outside of our industry for personnel. We have in the past experienced, and could in the future experience, challenges hiring for certain positions due to various factors, such as increasing wage expectations or competition for labor from other industries, and these circumstances could continue or worsen in the future to an extent and for durations that we are not able to predict. If we cannot recruit, train, develop, and retain sufficient numbers of associates, we could experience significant negative impacts on our operations, associate morale and turnover, guest satisfaction, or our internal control environment. Insufficient numbers of associates could also limit our ability to grow and expand our business. Labor shortages have in the past resulted, and could in the future result, in higher wages and initial hiring costs, increasing our labor costs and labor costs at our hotels, which could reduce our revenues and profits. In addition, the efforts and abilities of our senior executives are important elements of maintaining our competitive position and driving future growth, and the loss of the services of one or more of our senior executives could result in challenges executing our business strategies or other adverse effects on our business.

We require comprehensive property and liability insurance policies for our managed, leased, and owned properties with coverage features and insured limits that we believe are customary. We also require our franchisees to maintain similar levels of insurance. Market forces beyond our control may nonetheless limit the scope of the insurance coverage we, our hotel owners, or our franchisees can obtain, or our or their ability to obtain coverage at reasonable rates. Certain types of losses, generally of a catastrophic nature, such as earthquakes, hurricanes and floods, terrorist acts, pandemics, or liabilities that result from incidents involving the security of information systems, may result in high deductibles, low limits, or may be uninsurable, or the cost of obtaining insurance may be unacceptably high. As a result, we, our hotel owners, and our franchisees may not be successful in obtaining insurance without increases in cost or decreases in coverage levels, or may not be successful in obtaining insurance at all. For example, over the past several years following the severe and widespread damage caused by natural disasters, coupled with continued large global losses, the property, liability, and other insurance markets have seen significant cost increases. Further, in the event of a substantial loss, the insurance coverage we, our hotel owners, or our franchisees carry may not be sufficient to pay the full market value or replacement cost of any lost investment or in some cases could result in certain losses being totally uninsured. As a result, our revenues and profits could be adversely affected, and for properties we own or lease, we could lose some or all of the capital that we have invested in the property and we could remain obligated for guarantees, debt, or other financial obligations.

We have implemented enhanced security measures to safeguard our systems and data, and we intend to continue implementing additional measures in the future, but, as we have seen in the past, our measures may not be sufficient to maintain the confidentiality, security, or availability of the data we collect, store, and use to operate our business. Security measures implemented by our service providers or our owners, franchisees, licensees, other third parties or their service providers also may not be sufficient, as we have seen in the past. Efforts to hack or circumvent security measures, efforts to gain unauthorized access to, exploit or disrupt the operation or integrity of our data or systems, failures of systems or software to operate as designed or intended, viruses, "ransomware" or other malware, "supply chain" attacks, "phishing" or other types of business communications compromises, operator error, or inadvertent releases of data have impacted, and may in the future impact, our information systems and records or those of our owners, franchisees, licensees, service providers, or other third parties. Security measures, no matter how well designed or implemented, may only mitigate and not fully eliminate risks, and security events, when detected by security tools or third parties, may not always be immediately understood or acted upon. Our reliance on computer, Internet-based, and mobile systems and communications, and the frequency and sophistication of efforts by third parties to gain unauthorized access or prevent authorized access to such systems, have greatly increased in recent years. Our increased reliance on cloud-based services and on remote access to information systems increases the Company's exposure to potential cybersecurity incidents. We have experienced cyberattacks, attempts to disrupt access to our systems and data, and attempts to affect the operation or integrity of our data or systems, and the frequency and sophistication of such efforts could continue to increase. Any additional significant theft of, unauthorized access to, compromise or loss of, loss of access to, or fraudulent use of guest, associate, owner, franchisee, licensee, or Company data could adversely impact our reputation and could result in legal, regulatory and other consequences, including remedial and other expenses, fines, or litigation. Depending on the nature and scope of the event, future compromises in the security of our information systems or those of our owners, franchisees, licensees, service providers, or other third parties, or other future disruptions or compromises of data or systems, could lead to future interruptions in, or other adverse effects on, the operation of our systems or those of our owners, franchisees, licensees, service providers, or other third parties. This could result in operational interruptions and/or outages and a loss of profits, as well as negative publicity and other adverse effects on our business, including lost sales, loss of consumer confidence, boycotts, reduced enrollment and/or participation in our Loyalty Program, litigation, diminished associate satisfaction, and/or retention and recruiting difficulties, all of which could materially affect our market share, reputation, business, financial condition, or results of operations. Because we have experienced cybersecurity incidents in the past, additional incidents or the failure to detect and appropriately respond to additional incidents could magnify the severity of the adverse effects on our business. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage information systems change frequently, can be difficult to detect for long periods of time, and can involve difficult or prolonged assessment or remediation periods even once detected, which could also magnify the severity of these adverse effects. We cannot assure you that all potential causes of past significant incidents have been identified and remediated; additional measures may be needed to prevent significant incidents in the future. The steps we take may not be sufficient to prevent future significant incidents and as a result, such incidents may occur again. Although we carry cyber insurance that is designed to protect us against certain losses related to cyber risks, that insurance coverage may not be sufficient or available to cover all expenses or other losses (including payments to regulatory authorities) or all types of claims that may arise in connection with cyberattacks, security compromises, and other related incidents. Furthermore, in the future such insurance may not be available on commercially reasonable terms, or at all.

The lodging industry continues to demand the use of sophisticated technology and systems, including those used for our reservation, customer relationship management, analytics, revenue management, property management, human resources and payroll systems, our Loyalty Program, and technologies we make available to our guests and for our associates. We have underway a multi-year initiative to upgrade certain of our core technologies and systems, as these and other technologies and systems described in this risk factor must be refined, updated, and/or replaced with more advanced systems on a regular basis. Our business could suffer if we cannot refine, update, and/or replace technologies and systems as quickly or effectively as our competitors, sufficiently in advance of obsolescence or performance failure or degradation, or within budgeted costs and time frames. We also may not achieve the benefits that we anticipate from any new or upgraded technology or system, and a failure to do so could result in higher than anticipated costs or lower guest satisfaction or could impair our operating results. Our business could also suffer if the use of technologies that provide alternatives to in-person meetings and events results in a decrease in demand for our lodging properties.

We, the hotels that we franchise or manage, and the programs that we offer, are subject to or affected by a variety of laws, regulations and government policies around the globe, including, among others, those related to employment practices; marketing and advertising efforts; trade and economic sanctions; anti-bribery, anti-corruption, and anti-money laundering; intellectual property; cybersecurity, data privacy, data localization, data transfers, and the handling of personally identifiable information; competition; climate and the environment; health and safety; liquor sales; the offer and sale of franchises; and credit card products. These laws, regulations, and government policies may be complex and change frequently and could have a range of adverse effects on our business. The compliance programs, internal controls, and policies we maintain and enforce may need to be updated regularly to keep pace with changing laws, regulations and government policies and may not prevent our associates, contractors, or agents from materially violating applicable laws, regulations, and government policies. The requirements of applicable laws, regulations, and government policies, our failure to meet such requirements (including investigations and publicity resulting from actual or alleged failures), or actions we take to comply with such requirements or investigations could have significant adverse effects on our results of operations, reputation, or ability to grow our business.