Company: TCOM
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001193125-25-078429
Chunk: 220

Company: Trip.com Group Ltd
Filing Date: 2025-04-11
Form: 20-F
Item: Item 16K
Chunk 220
---

ITEM 16K.   CYBERSECURITY
-------------------------
 Risk Management and Strategy  We have implemented robust processes for assessing, identifying, and managing material risks from cybersecurity threats and monitoring the prevention, detection, mitigation, and remediation of material cybersecurity incident. We have also integrated cybersecurity risk management into our overall enterprise risk management system.
We have established a dynamic and multi-layered cybersecurity defense system to effectively mitigate both internal and external cybersecurity threats. This comprehensive system spans multiple security domains, including network, host, and application layers. It integrates a range of security capabilities such as threat defense, continuous monitoring, in-depth analysis, and rapid response. Our approach to managing cybersecurity risks and safeguarding sensitive data is multi-faced, involving technological safeguards, procedural protocols, a rigorous program of surveillance on our corporate network and the connections with any third-party service providers, ongoing evaluation of our security measures implemented towards internal and external resources, a solid incident response framework, and regular cybersecurity training sessions for our employees. Our cybersecurity department is actively engaged in continuous monitoring of our applications, platforms, and infrastructure to ensure prompt identification and response to potential issues, including emerging cybersecurity threats. 
 We also engaged third parties in connection with the processes for assessing, identifying, and managing material risks from cybersecurity threats. For example, we engaged third parties for penetration test services, on-site security maintenance service, and cloud-based security services. 
 As of the date of this annual report, we have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition. 
 Governance  Our board of directors is responsible for overseeing our company’s cybersecurity risk management and be informed on risks from cybersecurity threats. Our board of directors will review, approve, and maintain oversight of the disclosure (i) on Form 6-K for material cybersecurity incidents (if any) and (ii) relating to cybersecurity matters in the periodic reports (including annual report on Form 20-F) of our company. 
 On the management level, we have established an information security committee comprised of senior principals of our information security department, technology department, and legal department, who collectively have diverse and extensive experience in their respective fields. The information security committee monitors potential cybersecurity risks, develops risk prevention and mitigation measures, ensures the duly implementation of all risk prevention and mitigation measures across our company, and introduces new technologies and innovative solutions for defending our company against cybersecurity threats. The information security committee reports to our executive officers and holds as many meetings