Page last updated on March 3, 2025
MARRIOTT VACATIONS WORLDWIDE Corp reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2025-02-28 15:10:24 EST.
Filings
10-K filed on 2025-02-28
MARRIOTT VACATIONS WORLDWIDE Corp filed a 10-K at 2025-02-28 15:10:24 EST
Accession Number: 0001524358-25-000044
Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!
Item 1C. Cybersecurity.
Item 1C. Cybersecurity We maintain a cybersecurity program designed to protect our information, and that of our customers, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems. Governance Board of Directors Our Board is responsible for overseeing our processes for assessing and managing enterprise risk, including with respect to cybersecurity. The Board considers our risk profile when reviewing our annual business plan and incorporates risk assessment into its decisions. Our Board has delegated the primary responsibility for oversight of cybersecurity risk to the Audit Committee . The Audit Committee regularly reviews our cybersecurity and data security risks and mitigation strategies. At least twice each year, the Audit Committee receives reports and presentations from members of our team responsible for overseeing our cybersecurity risk management, including our Senior Vice President, Global Information Security (“SVP-GIS”) and our Executive Vice President and Chief Information Officer (“EVP-CIO”) , and periodically receives reports and presentations from third parties. These reports may address a wide range of topics, including recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends and cybersecurity considerations arising with respect to our peers and third parties. The Audit Committee reports to the Board on cybersecurity matters. We also have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee in a timely manner. Management We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents. At the management level, our SVP-GIS is responsible for the assessment and management of risks from cybersecurity threats. Our SVP-GIS has extensive cybersecurity knowledge and skills gained from over 25 years of experience in government and industries including retail and manufacturing, and industry certifications including Certified Information Systems Security Professional (“CISSP”) from ISC Squared and Global Information Assurance Certification (“GIAC”) from SANS Institute. Our SVP-GIS also has experience in forensic investigations, strategic cyber risk management, and cybersecurity program development. Our SVP-GIS leads the team responsible for implementing, monitoring and maintaining cybersecurity policies and practices across our business and reports directly to our EVP-CIO. Our SVP-GIS’s direct reports include a number of experienced cybersecurity leaders responsible for various aspects of our cybersecurity program, each of whom is supported by a team of experienced cybersecurity professionals. The functions that report to our SVP-GIS include: cybersecurity risk management, Payment Card Industry compliance, and cybersecurity testing; operation of protective cybersecurity tools and systems; cybersecurity monitoring, incident response, and digital forensics; cybersecurity research and development and support for information technology and cybersecurity functions. Our SVP-GIS works closely with our Law Department and regularly engages expert consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks and to oversee compliance with legal, regulatory and contractual cybersecurity requirements. The EVP-CIO and SVP-GIS also periodically attend Audit Committee meetings to report on any material developments. Risk Management and Strategy We employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. We currently carry cybersecurity insurance, however, we cannot assure you that we will be able to maintain such policies in the future or that they will be sufficient to cover all potential cybersecurity events or losses we incur in connection with such events. 38 We require our associates to receive annual training on our cybersecurity policies and practices. This may include, but is not limited to, training regarding information classification and handling, data privacy, physical security, phishing, malware and ransomware, social engineering, identifying and reporting information security incidents, and secure credit card handling, as well as additional topics based on job roles and responsibilities. We also maintain written cybersecurity policies and procedures that apply to the entire Company and third parties who handle our data or have access to our information technology systems. These policies and procedures establish the framework for our cybersecurity program and cover topics such as acceptable use of information systems, cybersecurity risk management, access management, audit and logging, patching, and cybersecurity requirements for numerous technologies. These policies and procedures are reviewed at least annually, updated as necessary, and integrated into employee training programs and our technology procurement process. We are also subject to the Payment Card Industry Data Security Standard and perform an annual self-assessment according to the requirements set forth by the Payment Card Industry Security Standards Council. Incident Response We have adopted an Incident Response Plan (the “IRP”) that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. The SVP-GIS is responsible for maintaining our IRP. Potentially significant threats are escalated to an interdisciplinary data breach response team (the “DBRT”), which is led by our EVP-CIO and co-chaired by the SVP-GIS, our head of data privacy, and a representative from our Law Department. The DBRT is responsible for oversight and handling of significant cybersecurity threats, incidents, and issues through a documented process. Potentially material cybersecurity incidents are escalated by our EVP-CIO to executive management and reviewed with members of the Company’s Disclosure Committee. Material Cybersecurity Risk, Threats & Incidents Routinely, we partner with and use third-party service providers and products that host, manage, or control sensitive data. We and the companies we work with have experienced cybersecurity incidents involving our data and systems, including ransomware and other forms of malware and computer virus attacks, unauthorized access, systems failures and temporary disruptions. For example, in June 2018, we identified forged and fraudulently induced electronic payment disbursements we made to third parties in an aggregate amount of $10 million resulting from unauthorized third-party access to our email system. Risks from cybersecurity incidents, including as a result of the June 2018 incident, have not materially affected us, including our business strategy, results of operations or financial condition for the periods covered by this Annual Report, and we do not believe that such risks are reasonably likely to have such an effect over the long term. Additional information on cybersecurity risks we face can be found in Part I, Item 1A “Risk Factors” of this Annual Report under the heading “Failure to maintain the integrity of internal or customer data or to protect our information systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to costs, fines or lawsuits,” which should be read in conjunction with the foregoing information.
Company Information
Name | MARRIOTT VACATIONS WORLDWIDE Corp |
CIK | 0001524358 |
SIC Description | Real Estate Agents & Managers (For Others) |
Ticker | VAC - NYSE |
Website | |
Category | Large accelerated filer |
Fiscal Year End | December 30 |