The FTC will require Marriott and its subsidiary Starwood Hotels & Resorts to implement an information security program following three data breaches.