Retail and hospitality security checklist

How quickly could you be trading again?

A checklist for access, vendors and recovery, the three things that decide how much a cyberattack costs a retailer or hotel. About ten minutes, no form to fill in.

By continuing, you agree to our cookie policy.

See all 14 questions

Access

  1. Does everyone who uses your ordering, payment or booking systems have their own login?
  2. Is multi-factor authentication on for every account that can reach payment systems?
  3. Is access removed the same day someone leaves?
  4. Are admin rights limited to the people who need them?

Vendors

  1. Do you have a current list of every vendor connected to your ordering, payment or booking systems?
  2. Do you know which of those vendors can reach your systems remotely?
  3. Have you asked each vendor how they protect access to your systems and how fast they'd tell you about a breach?

Recovery

  1. Do you have backups of your critical systems that an attacker couldn't reach or delete?
  2. Have you tested restoring from those backups in the last 12 months?
  3. Is there a written plan for what to do if your systems go down?
  4. Do you know who you'd call for help in the first hour?

Card payments online

  1. Do you keep an inventory of every script that runs on your payment page?
  2. Would you know if a script on your payment page changed without approval?
  3. Can you produce your PCI evidence without digging through inboxes?