Disclosure · Form 10-K · fiscal 2025
Hyatt Hotels Corp 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 13, 2026· period ended December 31, 2025· H· CIK 1468174· Updated · filing on sec.gov ↗
Hyatt Hotels Corp's Form 10-K for fiscal 2025, filed February 13, 2026, names the Chief Information Security Officer as its top security role, with oversight by the Audit Committee.
What Hyatt Hotels' Item 1C says
Hyatt's Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Audit Committee, to which the board of directors has delegated it. The cybersecurity department at Hyatt is led by the Chief Information Security Officer, who is responsible for assessing and managing material risks from cybersecurity threats.
Board and management oversight
The board of directors and the Audit Committee receive periodic reports from the CISO on cybersecurity risks. The CISO updates the Audit Committee, when deemed appropriate, about cybersecurity incidents the CISO considers significant or potentially significant. The Audit Committee reports to the full board of directors about its activities, including those related to cybersecurity. The full board of directors also receives periodic briefings from management on the cyber risk management program. The cybersecurity and ITGRC departments provide reporting to the Risk Council, which is led by the Senior Vice President of Internal Audit. The Risk Council meets quarterly and is responsible for identifying, assessing, prioritizing, and monitoring critical risks of the Company. The Risk Council periodically reports to the board of directors and the Audit Committee about the Company's risk management processes and procedures.
Who leads security
The CISO has more than twenty years of experience in information technology and/or information security, including more than eight years in such positions in the hospitality industry. The cybersecurity and ITGRC departments have primary responsibility for the overall cybersecurity risk management program.
How the company manages cyber risk
Hyatt designs and assesses its security program using an internally developed risk management framework based on recognized industry security standards. The cybersecurity risk management program is integrated into the overall risk management program of the company.
Third parties and incidents
A professional advisory firm with cybersecurity expertise regularly performs a third-party assessment of the framework maturity. Hyatt has a third-party risk management program designed to evaluate the cybersecurity capabilities of key vendors. Franchisees, licensees, and hospitality venture partners are typically required to comply with Hyatt brand standards relating to cybersecurity, including an obligation to report relevant information security incidents. Hyatt has not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect it.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed February 13, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
not identified
Board oversight
Audit Committee
“Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and risks, including management's implementation of our cybersecurity risk management program.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
Described
“The cybersecurity and ITGRC departments have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants and suppliers.”
Experience of the security leadership, as stated
Stated
“Our CISO has more than twenty years of experience in information technology and/or information security, including more than eight years in such positions in the hospitality industry.”
Material incident
The filing states none
“We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.”
The section
1,106 words, Form 10-K filed February 13, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 21, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Hyatt Hotels Corp standard industrial classification 7011, Hotels & motels (SEC SIC list). 4 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Full House Resorts IncFY 2025, filed March 16, 2026 | not identified | not identified | Audit Committee |
| PENN EntertainmentFY 2025, filed February 26, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Travel & Leisure Co.FY 2025, filed February 18, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Marriott InternationalFY 2025, filed February 10, 2026 | Chief Information Security Officer | not identified | Technology and Information Security Oversight Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Hyatt Hotels Corp's Form 10-K as filed with the SEC on February 13, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity.
Cybersecurity Risk Management and Strategy
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including guest and colleague information.
We design and assess our security program using an internally developed risk management framework based on recognized industry security standards. The framework is the basis for our cybersecurity policy, cybersecurity standards, and our processes for managing exceptions to those policies. Additionally, a third-party assessment of our framework maturity is performed regularly by a professional advisory firm with cybersecurity expertise . This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use recognized standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management program include, but are not limited to, the following:
• cybersecurity and information technology governance, risk management, and compliance ("ITGRC") departments principally responsible for (i) our cybersecurity risk assessment, management, and compliance processes, (ii) the development and maintenance of our security controls, and (iii) our monitoring for and response to cybersecurity incidents;
• risk assessments designed to help identify material cybersecurity threats to our critical systems and information, including, but not limited to, risk and compliance assessments, security scanning and testing, and periodic updating of our risk management framework;
• the use of external service providers, where appropriate, to assess, evaluate, or otherwise assist with aspects of our security processes, including, but not limited to, cybersecurity tools and technology, cybersecurity services, threat intelligence information, professional services consulting, and contract staff augmentation;
• training of our employees in cybersecurity awareness and payment card compliance, such as training for incident response personnel, software developers, and senior management in cybersecurity-related topics including, but not limited to, incident response, secure software development, and training commensurate with job responsibilities;
• a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and
• a third-party risk management program designed to evaluate the cybersecurity capabilities of key vendors based on our assessment of their criticality to our business and respective risk profile.
The franchisees, licensees, hospitality venture partners, or other applicable counterparties of properties that are not owned, leased, or managed by Hyatt are generally responsible for cybersecurity at such properties and the information systems, security measures, and related business processes that are under their direction and control. Franchisees, licensees, and hospitality venture partners are typically required to comply with Hyatt brand standards relating to cybersecurity, which include an obligation to report relevant information security incidents to us.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, procedures, standards, and controls, will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A, "Risk Factors—Risks Related to Our Business—Cyber risk and the failure to maintain the availability or security of our systems or customer, colleague, or Company data could adversely affect our business, harm our reputation, and/or subject us to costs, fines, penalties, investigations, enforcement actions, or lawsuits."
Cybersecurity Governance
Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and risks, including management's implementation of our cybersecurity risk management program. Our board of directors and the Audit Committee receive periodic reports from our Chief Information Security Officer ("CISO") on our cybersecurity risks . In addition, our CISO updates the Audit Committee, when deemed appropriate, regarding cybersecurity incidents the CISO considers to be significant or potentially significant.
The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives periodic briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CISO, internal cybersecurity personnel, and/or external experts as part of the board of directors' continuing education on topics that impact public companies.
Our cybersecurity department, comprised of various levels of management and led by our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The cybersecurity and ITGRC departments have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants and suppliers. Our CISO and cybersecurity and ITGRC departments collectively possess relevant expertise in cybersecurity architecture, engineering, governance, risk management, compliance, operations, vulnerability management, third-party risk management, threat intelligence, and cloud security areas. Our CISO has more than twenty years of experience in information technology and/or information security, including more than eight years in such positions in the hospitality industry.
In addition, our cybersecurity and ITGRC departments provide reporting to our Risk Council that is led by our Senior Vice President of Internal Audit and is comprised of certain members of management from diverse functional areas and business units, including risk, finance, legal, accounting, tax, operations, cybersecurity, privacy, human resources, and environmental sustainability. The Risk Council is responsible for identifying, assessing, prioritizing, and monitoring critical risks of the Company. The Risk Council meets quarterly and assesses risks based on potential impact to the Company, both in terms of inherent risk, or the risk exposure without consideration for how the Company manages the risk, as well as residual risk, or the risk exposure remaining after consideration of the Company's existing risk mitigation efforts. The Risk Council periodically reports to the board of directors and the Audit Committee regarding the Company's risk management processes and procedures .
Our CISO and the personnel of our cybersecurity and ITGRC departments take steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 13, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CISO and cybersecurity and information technology governance departments collectively possess relevant expertise in cybersecurity architecture, engineering, governance, risk management, and compliance, operations, vulnerability management, third-party risk management, threat intelligence, and cloud security areas.”
Material incident
The filing states none
“We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 21, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Cybersecurity Risk Management and Strategy
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including guest and colleague information.
We design and assess our security program using an internally-developed risk management framework based on recognized industry security standards. The framework is the basis for our cybersecurity policy, cybersecurity standards, and our processes for managing exceptions to those policies. Additionally, a third-party assessment of our framework maturity is performed regularly by a professional advisory firm with cybersecurity expertise. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use recognized standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management program include:
• cybersecurity and information technology governance departments principally responsible for (i) our cybersecurity risk assessment, management, and compliance processes, (ii) development and maintenance of our security controls, and (iii) our monitoring for and response to cybersecurity incidents;
• engagements with external professionals and internal subject matter experts designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment, including, but not limited to risk and compliance assessments, security scanning and testing, and periodic updating of our risk management framework;
• the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls, including, but not limited to cybersecurity tools and technology, cybersecurity services, threat intelligence information, professional services consulting, and contract staff augmentation;
• training of our employees in cybersecurity awareness and payment card compliance and additional training for cybersecurity personnel, software developers, and senior management in cybersecurity-related topics including, but not limited to, incident response, secure software development, and training commensurate with job responsibilities;
• a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and
• a third-party risk management program designed to evaluate the cybersecurity capabilities of new and existing centrally managed vendors based on their criticality to our business and risk profile.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See Part I, Item 1A, "Risk Factors—Risks Related to Our Business—Cyber risk and the failure to maintain the availability or security of our systems or customer, colleague, or Company data could adversely affect our business, harm our reputation, and/or subject us to costs, fines, penalties, investigations, enforcement actions, or lawsuits."
Cybersecurity Governance
Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our board of directors and the Audit Committee receive periodic reports from our Chief Information Security Officer ("CISO") on our cybersecurity risks. In addition, our CISO updates the Audit Committee, as necessary, regarding significant cybersecurity incidents or updates.
The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives periodic briefings from management on our cyber risk management program. From time to time, board members receive presentations on cybersecurity topics from our CISO, internal cybersecurity personnel, and/or external experts as part of the board of directors' continuing education on topics that impact public companies.
Our cybersecurity department, comprised of various levels of management and led by our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The cybersecurity and information technology governance departments have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants and suppliers. In addition, our cybersecurity and information technology governance departments provide reporting to our Risk Council that is led by our Senior Vice President of Internal Audit and is comprised of certain members of management from diverse functional areas and business units, including risk, finance, legal, accounting, tax, operations, cybersecurity, privacy, human resources, and environmental sustainability. The Risk Council is responsible for identifying, assessing, prioritizing, and monitoring critical risks of the Company. The Risk Council meets quarterly and assesses risks based on potential impact to the Company, both in terms of inherent risk, or the risk exposure without consideration for how the Company manages the risk, as well as residual risk, or the risk exposure remaining after consideration of the Company's existing risk mitigation efforts. The Risk Council periodically reports to the board of directors and the Audit Committee regarding the Company's risk management processes and procedures .
Our CISO and cybersecurity and information technology governance departments collectively possess relevant expertise in cybersecurity architecture, engineering, governance, risk management, and compliance, operations, vulnerability
management, third-party risk management, threat intelligence, and cloud security areas. Our CISO and the personnel of our cybersecurity and information technology governance departments are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through various means, which include briefings with internal security personnel and external consultants and information from governmental, private, and industry threat intelligence sources, as well as through alerts and reports produced by security tools and technologies deployed in and around the information technology environment.
Fiscal 2023 Form 10-K, filed February 23, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CISO and cybersecurity department collectively possess relevant expertise in cybersecurity architecture, engineering, governance, risk management, and compliance, operations, vulnerability management, third party risk management, threat intelligence, and cloud security areas.”
Material incident
The filing states none
“We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 21, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Cybersecurity Risk Management and Strategy
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including guest information.
We design and assess our security program using an internally-developed risk management framework based on recognized industry security standards. The framework is the basis for our cybersecurity policy, cybersecurity standards, and our processes for managing exceptions to those policies. Additionally, a third-party assessment of our framework maturity is performed regularly by a professional advisory firm with cybersecurity expertise. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use recognized standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management program includes:
• a cybersecurity department principally responsible for (i) our cybersecurity risk assessment, management, and compliance processes, (ii) development and maintenance of our security controls, and (iii) our monitoring for and response to cybersecurity incidents;
• engagements with external professionals and internal subject matter experts designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment, including, but not limited to risk and compliance assessments, security scanning and testing, and periodic updating of our risk management framework;
• the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls, including, but not limited to cybersecurity tools and technology, cybersecurity services, threat intelligence information, professional services consulting, and contract staff augmentation;
• training of our employees in cybersecurity awareness and payment card compliance and additional training for cybersecurity personnel, software developers, and senior management in cybersecurity-related topics including, but not limited to, incident response, secure software development, and training commensurate with job responsibilities;
• a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and
• a third-party risk management program designed to evaluate the cybersecurity capabilities of new and existing centrally-managed vendors based on their criticality to our business and risk profile.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See Part I, Item 1A, "Risk Factors—Risks Related to Our Business—Cyber risk and the failure to maintain the availability or security of our systems or customer, colleague, or Company data could adversely affect our business, harm our reputation, and/or subject us to costs, fines, penalties, investigations, enforcement actions, or lawsuits."
Cybersecurity Governance
Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our board of directors and the Audit Committee receive periodic reports from our Chief Information Security Officer ("CISO") on our cybersecurity risks. In addition, our CISO updates the Audit Committee, as necessary, regarding significant cybersecurity incidents or updates.
The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives periodic briefings from management on our cyber risk management program. From time to time, board members receive presentations on cybersecurity topics from our CISO, internal cybersecurity personnel, and/or external experts as part of the board of directors' continuing education on topics that impact public companies.
Our cybersecurity department, comprised of various levels of management and led by our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The cybersecurity department has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants and suppliers. In addition, our cybersecurity department provides reporting to our Risk Council that is led by our Senior Vice President of Internal Audit and is comprised of certain members of management from diverse functional areas and business units, including risk, finance, legal, accounting, tax, operations, cybersecurity, privacy, human resources, and environmental sustainability. The Risk Council is responsible for identifying, assessing, prioritizing, and monitoring critical risks of the Company. The Risk Council meets quarterly and assesses risks based on potential impact to the Company, both in terms of inherent risk, or the risk exposure without consideration for how the Company manages the risk, as well as residual risk, or the risk exposure remaining after consideration of the Company's existing risk mitigation efforts. The Risk Council periodically reports to the board of directors and the Audit Committee regarding the Company's risk management processes and procedures .
Our CISO and cybersecurity department collectively possess relevant expertise in cybersecurity architecture, engineering, governance, risk management, and compliance, operations, vulnerability management, third party risk management, threat intelligence, and cloud security areas. Our CISO and cybersecurity department personnel are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through various means, which include briefings with internal security personnel and external consultants and information from governmental, private, and industry threat intelligence sources, as well as through alerts and reports produced by security tools and technologies deployed in and around the information technology environment.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.