May 17, 2022
Hospitality Accounting Update
Spring 2022

© Deloitte Development LLC. All rights reserved. Hospitality Accounting Update 1
Corporate Travel in 2022 & Beyond
Maggie Rauch
Research Manager
Deloitte Consumer Industry Center
magrauch@deloitte.com

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 2
Key findings
Key
findings
COVID outbreaks decelerated travel spend
Corporate travel did not meet most companies’ expectations in the second half of 2021. One third of
travel managers surveyed in June 2021 expected to reach half of 2019 spend levels by the end of the
year. Only 8% reached that level by that time, as the Delta and Omicron variants put a crimp in plans.
COVID variants impact travel policies
COVID variants stalled the recovery significantly. Two thirds of companies say variants and outbreaks
in the second half of 2021 caused them to push back their timelines. Another 15% say variants
triggered a significant rethink of their travel policies.
Steady return expected in 2022
Corporate travel expected is expected to experience a steady, but not meteoric, rise this year. Spend
is projected to reach 36% of 2019 levels in Q2 ’22, and 55% by the end of the year. Full recovery to
prepandemic levels is at least two years away.
Health risk and directly pandemic-driven factors still present barriers to corporate travel but generate
less concern than in 2021. Increased travel prices, however, remain a persistent concern.
Higher travel costs persist as a concern
Europe expected to lead among international destinations for 2022
As international travel returns, Europe is expected to bounce back strongest for US-originating trips
in 2022. 1 in 4 respondents say they expect frequency of travel to Europe to near or exceed pre-
pandemic levels this year. Asia and Latin America follow in recovery expectations but remain far
behind.
Source: Deloitte Corporate Travel Survey 2022 “Reshaping the landscape: Corporate travel in 2022 and beyond”

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 3
Key findings
Key
findings
Industry events awaited and to return, but on a smaller scale
Conferences and events face another challenging year but should see improved attendance. Live
events moved up three spots among triggers to increase travel, entering the top five. And travel
managers rate content delivery more dependent on in-person events than they did in 2021.
Meetings contracts being modified in response to service cuts
Two lean years and a labor crunch have hotels cutting back on services and amenities. As travel
resumes, some companies are modifying their meetings contracts to ensure the availability of
desired amenities in the face of these service cuts.
Alternate lodging enters corporate travel but is still nascent
Alternative lodging options like private rentals are finding their way into corporate travel but remain
at a nascent stage. About one in 10 companies have non-traditional lodging in their booking tools.
But still, half of companies do not even reimburse employees for stays in non-hotel lodging.
Sustainability, still a priority, will push against future corporate travel spend. Three in 10 companies
expect sustainability to cause a 11-25% reduction in travel budgets by 2025.
Sustainability priorities to put a cap on the return of travel
Work-from-office dominant companies expected to recover faster
A quarter of companies say that more work from home means more trips to headquarters. However,
more WFH also means less travel overall. Companies that will be office-dominant in Q2 2022 are
twice as likely to expect travel spend to reach 2019 levels by the end of 2023 as WFH dominant ones.
Source: Deloitte Corporate Travel Survey 2022 “Reshaping the landscape: Corporate travel in 2022 and beyond”

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 4
Strong growth is expected through the rest of 2022, followed by deceleration in 2023. Corporate travel
spend is not expected to recover to prepandemic levels this year or next.
Source: Deloitte Corporate Travel Survey 2022, N=150 executives with oversight of business travel policy, spend and strategy
Questions: When did or do you expect your company’s quarterly travel spend to reach the following levels of 2019 spend?;
Has a new variant or a COVID outbreak since summer 2021 triggered changes to your corporate travel plans or policies?
Provided by
8%
13%
20%
25%
36%
45%
55%
59%
63%
66%
68%
Q2
2021
Q3
2021
Q4
2021
Q1
2022
Q2
2022
Q3
2022
Q4
2022
Q1
2023
Q2
2023
Q3
2023
Q4
2023
U.S. corporate travel spend as a % of 2019 spend
Deloitte projections by quarter, Q2 2021-Q4 2023

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 5
2021 vs 2022 surveys: Pace of recovery has not met expectations
Source: Deloitte Corporate Travel Survey 2022, N=139 executives with oversight of business travel spend and strategy; Deloitte analysis
Question: When do you expect your company’s quarterly travel spend to reach the following levels of 2019 spend?
In June ’21, 34% of corporate travel managers
expected to reach half of 2019 travel spend by the
end of 2021. However, only 8% did.
75%
36%
17%
30%
6%
19%
1%
11% 4%
2022
2021
Less than 25% 25-49% 50-74% 75-99% 100%
Rate of recovery
Projected quarterly spend as % of 2019, by quarter
Travel manager responses, 2022 vs 2021
Spend levels:
Q4 2021
35%
6%
39%
20%
17%
28%
6%
20%
3%
26%
2022
2021
Q2 2022
Over half of travel managers surveyed in 2021
expected to reach their 2019 quarterly spend by the
end of 2022. Now only 17% expect to reach that
target by the end of this year.

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 6
61%
29%
9%1%
Less than 10% 11 - 25% 26 - 50% More than 50%
Directly pandemic-related barriers to travel are fading, while higher travel prices persist as a concern
Top 5 factors that could slow business travel recovery
1
2
3
Travel restrictions
Employee unwillingness to travel
Client unwillingness to interact in-person
4 Delayed or online conferences, exhibitions
5 Increased travel prices
Source: Deloitte Corporate Travel Survey 2022, N=150 executives with oversight of business travel policy, spend and strategy
Questions: What are the external factors most likely to slow the increase of business travel for your company?;
Change in influence
vs April 2021
18%
18%
8%
23%
1%
Current ranking
Impact of sustainability on 2025’s travel spend
Expected to reduce by:

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 7
International business travel resumes as borders open and restrictions ease. However, some
geographies lag others in recovery.
Source: Deloitte Corporate Travel Survey 2022, N=150 executives with oversight of business travel policy, spend and strategy
Questions: What is the expected domestic vs international proportion of your company’s business travel spend?;
In 2022, how do you expect travel to trend to the following international regions?
In 2019, international travel accounted for over a quarter of
corporate travel spend. While it came to a near standstill due
to the pandemic, recovery is underway.
• Travel managers expect international trips to account for 21%
of overall business travel spend in 2022.
• Travelers gear up to cross borders as meeting clients and
leadership, and attending events becomes more attractive.
• The war that began in February will likely slow the resumption of
US-originating travel to Europe. As long as it does not spill over to
other countries, however, Europe should see the fastest
movement toward pre-pandemic levels.
22%
38%
52%
43%
54%
70%
54%
47%
36%
45%
36%
23%
24%
15%
13%
12%
10%
7%
Europe
Asia
Australia / Oceania
Latin America
Middle East
Africa
No / very little travel due to pandemic factors
Travel resumes but remains far from pre-pandemic levels
Travel near / likely to exceed pre-pandemic levels
Travel to Europe is expected to show the highest recovery. Asia is expected to follow.
Expected 2022 international travel spend, by geography

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 8
Pandemic concerns will have a lasting effect on how companies plan their events. While events will take
place, they will likely be on a smaller scale.
Source: Deloitte Corporate Travel Survey 2022, N=150 executives with oversight of business travel policy, spend and strategy;
Questions: Which of the following changes has your company made to your in-person events since Q4 2021? Has your company made or explored any of the following adjustments to future in-person events due to COVID-19 concerns?
Changes companies are making to in-person events since Q4 2021
57%
52%
44%
39%
16%
13%
Events that were either scheduled or
considered for in-person moved online
Planned in-person event attendance will
now be smaller, either because of limited
number of attendees or optional attendance
Exploring ways to make hybrid or satellite
events more effective
Events for Q1 and/or Q2 2022 cancelled or
postponed
Moving some events to warmer locations
Moving some events to warmer months
The rise of concerning variants in the second half of 2021 led many
companies to change their plans for in-person events. Events were
cancelled, postponed and moved online.
• Over half companies are transitioning their events to an online
format.
• The scale of in-person events expected to be smaller due to a cap
on attendance or companies making attendance optional.
• Companies are increasingly exploring ways to move to a hybrid
format and make it more effective.
• About 1 in 7 companies are moving events to warmer months
and/or to warmer locations due to COVID-19 concerns. These shifts
could increase competition for certain dates and venues, and
decrease demand for others.

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 9
Benefits of higher workplace flexibility include less travel and cost savings. But it will also lead to
increased trips to the home office.
Source: Deloitte Corporate Travel Survey 2022, N=150 executives with oversight of business travel policy, spend and strategy
Questions: Please choose the workplace flexibility level that prevailed or that you except to prevail in your company at the given points of time.; How has the rise of work from home affected domestic
destinations your travelers visit?; When employees who recently relocated and now work remotely travel to headquarters, does your company cover travel costs for those trips?
Consistent productivity, optimally leveraging newer assets, and
achieved cost gains encourage companies to increase workplace
flexibility offerings as they plan and facilitate the return to office.
This will impact the travel types, destinations and
reimbursement patterns that companies account for.
Already…
Over 1 in 4 companies
say that the rise of work from home is responsible for additional
trips to the company headquarters by newly dispersed
employees
67% of these companies
are reimbursing these trips for employees who relocated away
from HQ. 29% leave employees to shoulder all or most of the cost
0.9
4.3
3.1
2.7
2.3
Pre-pandemic Mar 2020 -
Dec 2021
Q1 2022 Q2 2022 Expected future
model
Flexibility model: WFH days per week
2.5X

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 10
Alternative lodging products like private rentals are making their foray into corporate travel. But not all
companies embrace non-hotel options.
Source: Deloitte Corporate Travel Survey 2022, N=150 executives with oversight of business travel policy, spend and strategy;
Questions: When it comes to lodging products aside from hotels, what is your company’s approach?
49%
34%
23%
9%
Do not reimburse for stays in non-hotel lodging
Reimburse employees for most alternative
lodging, but have no agreements in place
Agreements with specific branded
apartment/home rental providers are in place
Non-traditional content such as
apartments/rentals is part of our corporate
booking tool
While the pandemic has definitely spurred high
demand for rentals on the leisure side, it has
not brought a big change in how corporations
treat alternative lodging. Only 1 in 10
companies say they developed their policy on
non-hotel lodging during the pandemic.
Approach to non-hotel lodging products

© Deloitte Development LLC. All rights reserved. Hospitality Accounting Update 11
SEC proposed climate and cyber disclosure rules:
What you can do now to prepare
Kristen Sullivan
Audit & Assurance Partner
Deloitte & Touche LLP
ksullivan@deloitte.com

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 12
Companies need to address data preparedness
• 57% of survey respondents indicate that data availability (access) and data quality (accuracy/completeness) remain their greatest challenges with respect to
ESG data for disclosure
• 89% note a likelihood that their organization will enhance its ESG control environment
Preparing for high-quality disclosures
Deloitte ESG Executive Survey
Governance and organizational capacity are critical to ESG efforts
• 21% currently have an ESG council or working group in place to drive strategic attention to ESG topics; 57% are actively
working to establish one
• 82% believe they will need additional resources to generate ESG disclosures that meet the information needs of critical
stakeholders
Companies should take a hard look at how technology may impact measurement, reporting, and disclosures
• 92% believe that their organization needs to invest more in technology to address demand for consistent and reliable
measurement, reporting, and disclosures
Companies are taking action by obtaining assurance on data reported
• Three out of four executives plan to obtain assurance over ESG disclosures in the next reporting cycle, indicating the
importance of applying independence and objectivity to enhancing the reliability of this information
2
1
3
4

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 13
Overview of the key challenges of Travel & Tourism businesses
Internal and External Challenges Outlined by the World Travel and Tourism Council
Internal Challenges External Challenges
Target & Strategy Definition Measuring & Monitoring Information & Customer Behaviour
Difficulties with defining a
long-term net-zero target
Difficulty in measuring ESG
data across the company and
value chain
Lack of
transparency
in sustainability
information display
High costs
associated with
sustainability
premium
Limited willingness
to pay
for
sustainable products
Selecting the right key levers
and initiatives
Difficulty in measuring the ROI
from carbon-related efforts
Technology & Infrastructure
Financing
& Budgeting
Leadership
& Organization
Affordability
of available
technologies
Lack of
understanding
of emerging
technologies
Dependency on
infrastructure
Lack of financial resources.
No budget allocation for
climate related activities
Limited dedicated team,
organisational knowledge,
or sufficient capabilities
Regulation & Reporting
No clear link to business value
or competitive advantage
Lack of support
from leadership
Insufficient
regulatory
incentives to
support transition
Lack of
transparency
regarding upcoming
regulations
Inconsistency of
carbon metrics and
methodologies for
reporting

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 14
Industry
Scope 1
(average share in %)
Scope 2
(average share in %)
Scope 3
(average share in %)
Accommodation 8%
On-site gas and fuel consumption, on-site vehicles
37%
Building energy consumption (in-house laundry,
lighting, energy use), office heating, cooling, and
electricity
55%
External laundry services, waste disposal, F&B supply
and production, staff travel
Tour Operators
(asset light – do not own hotels,
airplanes, or cruise ships)
2%
Office gas consumption and owned vehicle emissions
6%
Office heating and energy consumption
92%
Business travel, commute, transport & distribution,
electricity, brochures, waste
Tour Operators
(asset heavy –own hotels,
airplanes, or cruise ships)
95%
Fuel, on-board power generation, vehicle emissions,
major & retail premises gas and fuel consumption
1%
Major premises energy consumption, office heating,
cooling, and ground & port electricity
4%
Business travel, commuting, F&B supply and
production, waste disposal, up and downstream
transportation & distribution
Aviation 80%
Aircraft fuel, vehicles in airport operations
<1%
Office heating and energy consumption, ground
electricity
20%
Supply chain fuel, capital goods, purchased goods,
downstream transport, and distribution
Cruises 99%
Ship fuel, on-board power generation for support
functions
1%
Office heating, cooling, and electricity, port electricity
<1% or not disclosed
Commuting, passenger transportation F&B supply
& production, fuel transport, waste
OTAs/Tas 9%
Office gas consumption and owned vehicle emissions
55%
Office/data centre heating, cooling,
and electricity
36%
Business travel, staff commuting, waste management,
purchased goods and services
Overview of reported emission profiles of the Travel & Tourism industries in focus
Internal and External Challenges Outlined by the World Travel and Tourism Council
Note: The emission profiles are estimates based on a sample of business emission analysed for this report. Selection metrics varied by industry: for details, please see Exhibit 33). Although the profiles have been discussed and verified with companies directly, considering
the wide variety of business models even within each focus industry and differing approaches to calculating Scope 1, 2, 3 emissions, they should only be seen as indicative profiles.

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 15
In March 2022, the SEC began issuing proposed rulemaking that would require registrants to provide enhanced ESG
disclosures with more expected in the coming months related to human capital and governance
SEC Rule Making Update
Cybersecurity
Proposed March 9th , 2022
Enhanced disclosures on cybersecurity
incidents and cybersecurity risk,
management, strategy and governance
Climate
Proposed March 21st , 2022
Enhanced and standardized climate
disclosures related to Climate and Risk
Strategy, Targets & Metrics, Scope 1, 2 &
3 GHG Emissions
• Potential impact to quarterly 10-Qs and annual 10-K
• 60-day comment period from date of proposal
• Climate disclosure rule comment period extended to June 17, 2022
• Cyber disclosure rule comment period is over
• Disclosures will be both qualitative and quantitative
• Impacts all types of periodic SEC filers, including domestic registrants, certain foreign
private issuers, smaller reporting companies, and emerging growth companies.

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 16
1. 2022 Deloitte CxO Sustainability Report. Deloitte. 2022.
2. ESG Reporting and Attestation: A Roadmap for Audit Practitioners CAQ. 2021.
3. The Enhancement and Standardization of Climate-Related Disclosures for Investors. SEC. March 21, 2022.
Today…
• Oversight of ESG is often not clearly established
or defined, though governance and organizational
capacity are critical to managing climate-related
efforts.1
• Timeliness for data collection and reporting
typically extend beyond current 10-K filing deadlines.2
• Data processes and controls over climate-related
information are generally not as mature as financial
reporting processes and controls.1
• Climate-related disclosure is voluntary.
Companies use a variety of sustainability reporting
frameworks and standards, and disclosure outlets.2
• Assurance—an avenue to quality, accurate, and
reliable disclosure—is currently not required.1
Under the proposed rule, registrants
would be required to disclose3…
1. Governance of climate-related risks, how identified climate-related
risks have or are likely to have a material impact on a company’s
strategy, business model, outlook over short-, medium-, or long-term,
and risk management processes.
2. Climate-related financial statement metrics (e.g., disaggregated
climate impacts on financial statement line items) and impact of
climate-related physical events and transition activities on
estimates and assumptions.
3. Greenhouse gas (GHG) emissions, including Scope 1 and 2 (and
Scope 3 phased in if material or if registrant has Scope 3 target).
4. Reasonable assurance, phased in for accelerated and large
accelerated filers over certain GHG emissions disclosures; limited
assurance precedes.
5. Information about climate-related targets and transition plans.
Call to Action: What this means for your organization
SEC Proposal: Enhancement and Standardization of Climate-Related Disclosures

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 17
Financial Statements Outside the Financial Statements
Disclosure Required
For climate-related events and transition activities:
(1) financial impact metrics
(2) expenditure metrics
(3) discussion of the impact on financial estimates and
assumptions
• GHG emission disclosures for Scopes 1, 2 and 3
• Climate governance
• Climate-related risks and opportunities
• Climate risk management
• Climate targets and goals
Controls and procedures Subject to internal control over financial reporting Subject to disclosure controls and procedures
Attestation Part of financial statement & ICFR audit
Phase-in to reasonable assurance over Scope 1 & 2 GHG emission disclosures for
large accelerated and accelerated filers
Timeline for Proposed Climate Rule (Illustrative timeline for calendar year end filers)
2021 Report
(filed in 2022)
2022
(filed in 2023)
2023
(filed in 2024)
2024
(filed in 2025)
2025
(filed in 2026)
2026
(filed in 2027)
2027
(filed in 2028)
Large accelerated filers
with reasonable
assurance
All disclosures excl.
Scope 3 for large
accelerated filers
Proposal
release
60-day comment period
(extended through
June 17, 2022)
All disclosures for large
accelerated filers with
limited assurance
All disclosures excl.
Scope 3 for
accelerated filers
All disclosures for
accelerated filers with
limited assurance
Accelerated Filers with
reasonable assurance
All disclosures excl.
scope 3 for
nonaccelerated filers
All disclosures for
nonaccelerated
filers
All disclosures excl.
Scope 3 for smaller
reporting companies
Proposed disclosure location and timeline
SEC Proposal: Enhancement and Standardization of Climate-Related Disclosures

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 18
• GHG information to
be disclosed:
• Disaggregated by each
greenhouse gas
• In the aggregate
• Gross, excluding offsets
• Intensity (per $ revenue and
per economic unit)
• Methodology (e.g.,
approach, assumptions)
• Safe harbor for Scope 3 GHG
emissions disclosures
• No attestation requirement
• Voluntary GHG reporting
compared to reporting in
financial filings –differences
that impact materiality:
• Users of the disclosures
• Disclosure requirements
• Scope 3 GHG emissions
disclosure is required:
• If material
• If registrant has set a GHG
reduction target
• GHG Protocol: Company may
apply; 1) equity share or a 2)
control approach
• SEC proposed rule:
• Boundary must be
consistent with
consolidated financial
statements
• Registrants already
reporting under GHG
Protocol will need to revise
boundary to align with
financial statements
• Scope 1 and 2 GHG emissions
subject to limited assurance
(phase-in period), followed by
reasonable assurance.
• Requirements for attestation
are consistent with the
standards issued by the
AICPA, PCAOB, and IAASB.
Assurance
Organizational Boundary
Materiality Scope 3 GHG emissions
Proposed disclosure location and timeline
SEC Proposal: Enhancement and Standardization of Climate-Related Disclosures

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 19
Establish or Refine
Climate Governance
• Identify Board and Management oversight
on climate-related matters and define
clear roles, responsibilities, and charters.
Establish Controls over
Climate-Related Data
• Assess the strength of processes and controls over climate-
related data, leveraging existing financial reporting controls.
Think Strategically
• Understand disclosure requirements for climate targets,
preparing for transparency on progress and transition plans.
Identify Climate Risks and Opportunities
• Identify physical and transition risks and opportunities
(e.g., legal/policy, market, product, physical hazards)
to business.
Be Transparent
• Prepare for accelerated reporting timelines, similar to
financial reporting, and establish plan to obtain and/or
increase the level of assurance.
1
2 Include the Right People
• Perform stakeholder engagement, including
education on climate-related risks, data
collection, and target setting.
3 Build Reporting Agility
• Enhance data quality, timeliness,
automation, and relevance by
standardizing governance and controls to
prepare for assurance-ready disclosure.
4
5
6
7
Climate
Considerations
7
What now? How to prepare in 7 steps
SEC Proposal: Enhancement and Standardization of Climate-Related Disclosures

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 20
Internal control related questions and actions to take
Governance is a key component of disclosure
Climate- and Cyber-Related Governance
Have you evaluated the maturity of
existing controls to enhance data
accuracy and completeness?
• Inspect methodologies for data
collection, measurement and/or
estimation (i.e., disparate data
sources, varying units, conversion
factors)
• Define internal process controls
and general IT controls (GITCs) to
mitigate identified climate and
cyber-related risks
3. Identify controls
1. Define disclosure objectives
Have you established, documented
and communicated internal and
external climate and cyber-related
data timelines, aligned with
financial reporting?
• Review the current-state of
processes and controls around
existing climate and cyber
disclosure
• Understand existing quantitative
and qualitative data governance
structures to identify gaps and
meet near- and long-term
reporting requirements
2. Assess disclosure risks
Have you identified potential risks
that could impact climate- and
cyber-related reporting objectives?
• Determine relevant data
sources, systems, and process
owners via walkthroughs
• Obtain end-to-end climate and
cyber processes through
narratives and flowcharts
• Identify and document data and
IT system limitations,
assumptions, and estimates​
4. Evaluate effectiveness
Have you responded to feedback
and remediated control gaps and
deficiencies?
• Assess design, implementation,
and operating effectiveness
of controls
• Inquire on remediation of
control gaps and deficiencies
timely and implement ongoing
process improvements
• Assess whether controls over
climate and cyber disclosure are
integrated into enterprise risk
management and Internal Audit
plans
Internal Controls over Climate- and Cyber-Related Data

© Deloitte Development LLC. All rights reserved. Hospitality Accounting Update 21
Cyber Defense
Mehdi Houdaigui
Advisory Principal
Deloitte & Touche LLP
mhoudaigui@deloitte.com

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 22
Agenda
Cyber Defense Landscape Overview
How cyber incidents may impact organizations and why is cyber defense important?
How can organization strengthen their Cyber defenses?
1
2
3

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 23
Cyber Defense Landscape Overview
Market forces have changed the way organizations operate . . .
Constant data flow across organizations
enables new ways of value creation,
connecting lines of business and using
customer data to enrich experiences.
Today’s organizations run an array of technologies
that combine on-premises infrastructure with hybrid
information technology (IT) and an assortment of
third-party cloud providers.
The rapid transition to remote work becoming a
permanent feature of employment has increased
organization’s attack surfaces with little time to
consider security implications
. . . Inadequate cyber defense can have lasting impact on an organization . . .
Business Operation Disruption
Inadequate business continuity plans may
inhibit organizations’ ability to recover
from potential incidents leading to loss of
business
Vulnerability Exposure
Unpatched IT systems and zero-day
vulnerabilities can risk introducing back-
doors that can allow threat actors to gain
access and exfiltrate sensitive
information
. . . which has increased their attack surface
Organizations have increased their
reliance of 3rd party vendors, which
increases the risk of exposure through
them
3rd Party &
Vendor Risk
Sophisticated Hackers/Hacktivists/Nation
State threat actors have increased their
surveillance on hotels and their guests to
track high-profile targets
Cyber Espionage

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 24
17%
The following are key statistics that provide a high-level overview of what the cybersecurity defense landscape looks in its current state
among the “Deloitte 2021 Future of Cyber Survey”1 participants.
How cyber incidents may impact organizations and why is cyber defense important?
32% 22% 19% 17% 17%
16% 14% 3%
1Note – This survey was commissioned by Deloitte LLP and published in 2021. C-level executives at companies with at least $500M in annual revenue were surveyed, resulting in 600 individuals from organizations across EMEA, the Americas, and Asia Pacific. Please see this document for additional information.
Operational
Disruptions
Intellectual
Property Theft
Drop in Share
Price
Loss of Customer
Trust/Negative Brand
Change in
Leadership
Regulatory
Fines/Reputation Loss
Loss of Revenue
Negative
Talent/Retention
Impact
Other

© Deloitte Development LLC. All rights reserved. Hospitality Accounting Update 25
How can organizations enhance their Cyber defenses?

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 26
The role and position of the CISO has become increasingly important as the cyber landscape broadens,
It starts at the top- “Empower your CISO”
Resources
The CISO should have the necessary
budget for resource and talent
investments to properly safeguard the
organization
Authority
The CISO should have the authority to
influence all lines of business and
efficiently gather information across
the organization Communication
The CISO should have direct
communication and relationships
with the CEO, Board, and Senior
Management
TECHNOLOGY
OPERATIONS
AND SYSTEMS
DEVELOPMENT
Chief Information Security
Officer (CISO)

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 27
Organizations must be able to assess risk in terms they can understand and translate them what is important for their business
Assess your Cyber Risk – “Understand your weakness and develop a pan”
Assess your Cyber Risk
• Organizations should conduct assessments (e.g., cyber maturity
assessment, risk analysis, threat modeling) to assess risk throughout
their environment
• Organizations should utilize results from the assessments and compare
against current cyber threats to understand their current risk landscape
• Organizations will be able to determine where to best invest resources to
properly mitigate any identified risks
Assess
Comprehend
Invest

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 28
Evolve risk management
processes to achieve
end-to-end visibility
Create effective governance
across lines of business lines
Keep C-Suite and the board
informed on your Cyber
portfolio and requirements
Security should not be a blocker, but a business enabler. In order to achieve this its important to have appropriate governance and
communication throughout the organization
Communicate – “Make Cyber collaborative”
Challenge
Given the rise of hyper digitization and move to hybrid work environment, businesses have been forced to rapidly scale
up to cope with the ‘new normal’. These changes often result in security being left behind or considered as an
afterthought. The best way to address this challenge is by communicating and partnering with the business
continuously.
Approach
1 2 3

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 29
Cybersecurity skills CRISIS
Too few
professionals
Too many
THREATS
© Deloitte Development LLC. All rights reserved. Hospitality Accounting Update 29

Hospitality Accounting Update
© Deloitte Development LLC. All rights reserved. 30
To thrive in the digital age, businesses will need
significant support from the broader technology
and security community.
Technology vendors, network and
communications vendors, security consultants
and payment ecosystem participants will all play
an integral role in helping businesses achieve
their strategic goals while simultaneously
protecting PII, intellectual property and product
safety.
35%
33%
32%
Current cybersecurity capabilities
In-house
Co-sourced
Outsourced
‫‏‬Source: Deloitte’s Cyber Risk in Consumer Business Study
Bridging the Gap

About Deloitte
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of
member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred
to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of
DTTL, their related entities that operate using the “Deloitte” name in the United States and their respective affiliates. Certain services may not
be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/about to learn more about
our global network of member firms.
Copyright © 2022 Deloitte Development LLC. All rights reserved.
This presentation contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business,
financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or
services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any
action that may affect your business, you should consult a qualified professional advisor.
Deloitte shall not be responsible for any loss sustained by any person who relies on this publication.