A hotel group deal rarely dies in the demo. It slows down in the weeks after the commercial sponsor says yes, when IT sends a long security spreadsheet and the vendor's founder spends several evenings filling it in. By the time the answers go back, the budget window has moved and the champion has other priorities.

The fix is preparation. Security reviews in hotel deals follow a predictable pattern, and almost every question can be answered before the questionnaire arrives. This checklist sets out what to have ready, grouped by stage. Tick each item off once it exists as a document you could send today.

Why hotel groups ask harder questions now

Hotel IT teams have watched their own sector's breaches closely. In October 2024 the FTC announced action against Marriott and Starwood over three breaches from 2014 to 2020 affecting more than 344 million customers worldwide, alongside a separate $52 million penalty paid to 49 states and the District of Columbia. The order requires Marriott to run a comprehensive information security program with an independent assessment every two years.

Vendors are directly in scope of that concern. In January 2025 Infosecurity Magazine reported that a threat actor had accessed hotel software provider Otelier and taken customer data from brands including Marriott, Hilton and Hyatt. Have I Been Pwned loaded 437,000 customer email addresses from the breach. Researchers quoted in the report linked it to infostealer malware that exposed credentials for Otelier's GitHub and Atlassian instances.

So when a group's IT director asks how you manage staff credentials, they are not being difficult. They are asking about the exact route used in a breach at a vendor in their own market. Our post on what a hotel IT director needs from a vendor covers the wider relationship.

Know which questionnaire you will get

Most hotel groups use one of three formats. Knowing which one changes how long the work takes.

The descriptions above come from Shared Assessments' guide to choosing a SIG, which describes SIG Core as typically used for organisations that "store or manage highly sensitive data or regulated information", and the Cloud Security Alliance's CAIQ v4 page, which describes it as a set of Yes/No questions to check a cloud provider against the Cloud Controls Matrix. A hotel PMS, payment or CRM vendor should assume SIG Core or a deep custom review.

The readiness checklist

Stage 1: Before any deal asks

• [ ] A one-page security overview you can attach to a proposal: hosting, encryption, access control, backups, certifications.

• [ ] A maintained answer library covering the common SIG and CAIQ domains, with an owner and a last-reviewed date on every answer.

• [ ] Written policies for information security, access control, incident response, business continuity and vendor management.

• [ ] A current data flow diagram showing what guest and payment data enters your product, where it is stored and which integrations receive it.

• [ ] A sub-processor list naming your cloud host, payment partners, support tools and analytics providers.

• [ ] A named security owner, even if it is the CTO, who answers questions within two working days.

Stage 2: Payments and PCI DSS

• [ ] A clear statement of whether your product stores, processes or transmits cardholder data, or relies on a tokenising payment partner so that it never touches card numbers.

• [ ] Your PCI DSS Attestation of Compliance, or the AOC of the payment provider you rely on, with a note explaining the split of responsibility.

• [ ] Confirmation that you assess against PCI DSS v4.x. The PCI Security Standards Council notes that 51 of the 64 new requirements in v4.0 were future-dated and became effective on 31 March 2025.

• [ ] A responsibility matrix. The Council highlights that many new requirements focus on roles and responsibilities, and requirement 12.5.2 adds an annual scope confirmation.

Stage 3: Guest data and GDPR

• [ ] A data processing agreement template ready to sign. Article 28 of the GDPR says a controller "shall use only processors providing sufficient guarantees" and lists what the contract must cover.

• [ ] A sub-processor change process. Article 28 requires that, under general written authorisation, the processor informs the controller of intended changes and gives them the opportunity to object.

• [ ] A documented process for helping the hotel answer guest access and deletion requests.

• [ ] A written statement of how data is deleted or returned at the end of the contract, which Article 28 also requires.

• [ ] Hosting locations and the transfer mechanism you use for any data leaving the EU or UK.

Stage 4: Evidence and assurance

• [ ] An independent assurance report: SOC 2 Type II, ISO 27001, or both. If you have neither, a dated plan and an auditor's engagement letter.

• [ ] A summary of your latest penetration test, with dates and how high-severity findings were closed.

• [ ] Evidence of multi-factor authentication on all staff access to production, source code and admin tools. The Otelier report is the reason this question comes first.

• [ ] Cyber insurance details: insurer, limit and expiry.

• [ ] A trust centre page or secure portal where buyers can request documents under NDA.

Stage 5: During the review

• [ ] Ask at the first commercial meeting who runs security review and which format they use.

• [ ] Send the overview pack before the questionnaire arrives, so the reviewer starts with context.

• [ ] Track the review as a deal stage in your CRM with a date, not as a side task.

• [ ] Answer "no" honestly and add the compensating control or the dated plan. Reviewers trust a clear gap more than a vague yes.

• [ ] Offer a 30-minute call between your security owner and theirs to close open items in one go.

Where this fits in the deal

Security review is not a separate track from selling. It sits between the commercial yes and the signature, alongside procurement and legal. Our post on getting through procurement at a hotel management company covers the commercial side of that stage, and our hotel tech deal timeline shows where it usually falls. If the group also issues a formal RFP, the same answer library feeds your RFP response.

Whether you also need SOC 2 is a separate investment decision with its own trade-offs, which we cover in should hotel software get SOC 2 now. And because enterprise readiness shapes which segments you can sell to, it belongs in your wider hotel tech GTM strategy, not just your engineering backlog.

The short version

Hotel groups ask about credentials, payments, guest data and independent evidence because breaches at hotels and their vendors have made those risks concrete. Build the overview, the answer library, the PCI and GDPR documents and your assurance evidence before the deal asks, and the review becomes a short, planned stage instead of an open-ended stall.

If group deals keep slowing after the commercial yes and you are not sure whether security review is the cause, the free leak audit will show where the time goes.

Frequently Asked Questions