PCI DSS by industry
PCI DSS for hotels and travel businesses: card-on-file, the front desk and the franchise split
What changes when the merchant is a hotel, resort, airline, travel agency or online travel agency: who asks for PCI DSS, how the PMS and booking channels set the scope, where assessors sample, and how brand, management company and owner share the controls.
Key points
- A hotel takes cards at many touchpoints: the booking engine, the reservations phone line, the front desk, restaurants and bars, the spa and the guest folio held on file until check-out.
- The property management system and everything that can reach it usually decide the size of the cardholder data environment, so scoping starts with the PMS, not the payment terminals.
- Pre-authorisation and card-on-file make the ban on keeping sensitive authentication data after authorisation the rule that fails most often, in reservation notes, faxed forms and e-mailed card details.
- In a franchised or managed property, the brand, the management company and the owner each run part of the payment chain; each part needs a named owner and evidence.
Why hotels and travel businesses are asked for PCI DSS
The demand reaches a property through its acquirer, which sets the validation expected each year under the card brands' programmes. For a group of hotels, a chain of resorts, an airline, a travel agency or an online travel agency, that usually means one validation for the legal entity that holds the merchant agreement, however many outlets take cards under it.
Two other routes bring the question. Brands and management companies may also ask each property for evidence under the franchise or hotel management agreement. And online travel agencies, booking engines, channel managers and PMS vendors that handle card data on a hotel's behalf are service providers in their own right: their hotel customers ask them for an Attestation of Compliance before signing.
What changes here is variety: card data arrives by web, phone, e-mail, walk-in and third-party channels, is held for days and is charged by staff on rotating shifts. Whether you validate by questionnaire or assessment is covered in Do you need PCI DSS? Merchant levels, service providers and who decides.
What sits inside the scope for a hotel or travel business
For a hotel the scope means the booking engine and the channel manager feeding reservations in, the central reservations office and its call recording, the PMS holding the guest folio, the front-desk and food and beverage point-of-sale systems, the payment terminals, the back-office PCs that key in charges and the network they share.
Guest Wi-Fi, in-room entertainment, building management and staff networks must be shown to be separated from the payment systems, or they join the scope. The method is in PCI DSS scoping and segmentation: shrinking the CDE.
Four scope mistakes recur: treating the PMS as a hotel system rather than a payment system; forgetting the inboxes where guests and travel agents send card numbers; unmanaged call recordings of card details; and assuming the brand's systems cover the property's own network and terminals.
Where the requirements bite in hospitality
| Requirement area | What it means in a hotel or travel business | Evidence the assessor samples |
|---|---|---|
| Requirement 3 Protect Stored Account Data | Card-on-file for guarantees, deposits and incidentals is kept only as long as needed; security codes are never stored after authorisation, in the PMS, notes or paper forms | A retention rule for folios and reservations with purge records, data discovery across the PMS and shared drives, masked card numbers on screens and reports, tokenisation settings |
| Requirements 1 and 11 Network security and testing | Guest Wi-Fi, in-room systems and corporate networks are kept out of the card data environment, and that separation is proved by testing | Network and data-flow diagrams per property, firewall rules with a reason for each, segmentation test results, rogue wireless detection, quarterly scans |
| Requirement 9 Restrict Physical Access to Cardholder Data | Terminals at the front desk, restaurants, bars and pool are inspected for tampering; paper authorisation forms are locked away and destroyed | A device inventory with locations, inspection records, front-line training records, media destruction records |
| Requirements 7 and 8 Access and authentication | Front-desk, night audit, reservations and revenue staff see only what their role needs; shared PMS logins are removed; vendor remote support uses multi-factor authentication | User lists per system against the rota, access reviews with decisions, leaver removals, MFA configuration for remote and administrative access |
| Requirement 12 Third-party service providers | The PMS vendor, booking engine, channel manager, payment gateway and brand systems each have a written split of responsibilities | A provider register with current AOCs, responsibility matrices, annual monitoring records |
All twelve are explained in PCI DSS requirements explained, requirement by requirement.
Franchise, management company and owner: who carries what
In a branded property the payment chain is split. The brand may run the central reservation system and booking engine; the management company may employ the staff and run the network; the owner may hold the merchant agreement. The acquirer holds the merchant to account whoever operates the systems, so the responsibility matrix has to name, requirement by requirement, who operates each control and who holds the evidence.
Check that each provider's AOC lists the services the hotel actually uses; see How to verify a PCI DSS AOC and check a provider's compliance. Groups also holding ISO/IEC 27001 certification can run one set of policies and evidence for both; see PCI DSS vs ISO/IEC 27001 and SOC 2. Small independent properties using standalone terminals may qualify for a shorter questionnaire, covered in Which SAQ applies to you: eligibility explained.
What a hospitality engagement looks like
Duration depends on the number of properties and outlets, the split between brand and property systems, whether the PMS and gateway already tokenise, and how quickly vendors provide AOCs. The finance director, IT manager, front office, reservations and outlet managers and the owner's representative must be involved. With Design™, Sterling guides your team to own the controls across every outlet; with Drive™, Sterling carries more of the scoping, evidence and readiness work through peak season.
How Sterling works with hotels and travel businesses
Every card touchpoint traced, from booking to check-out.
Our expert and experienced consultants follow each card through your booking channels, PMS, outlets and providers, shrink the scope, close the gaps with your teams and keep the evidence in Effivity, included with the engagement. Sterling does not validate compliance; the QSA assesses and attests. We ensure successful validation for our clients.
Book a free discovery callPCI DSS for hotels: questions hospitality buyers ask
Is our property management system in PCI DSS scope?
Yes, if it stores, processes or transmits card data or is connected to systems that do. Tokenisation through the payment gateway can remove full card numbers from the PMS and shrink the scope considerably.
Can we keep guests' card details on file for pre-authorisation and no-show charges?
Yes, the card number can be kept if you need it, protected and deleted when no longer needed. The security code must never be stored after authorisation, including on paper forms or in reservation notes.
Does guest Wi-Fi bring our whole hotel into scope?
Not if it is properly separated from the payment systems. The separation must be designed, documented and tested, and the assessor will ask for the test results.
We are a franchised hotel. Does the brand's PCI DSS compliance cover us?
No, only the systems and services the brand's AOC lists. The property's own network, terminals, staff and paper records remain yours to evidence.
PCI DSS by industry
Every guide in the PCI DSS series is written for one question and links back to the hub for the whole picture.
- PCI DSS for banking and financial services
- PCI DSS for BPO and contact centres
- PCI DSS for e-commerce and retail
- PCI DSS for fintech and payment facilitators
- PCI DSS gap analysis
- PCI DSS for healthcare providers and insurers
- PCI DSS for hospitality and travel
- PCI DSS implementation plan
- PCI DSS in India
- PCI DSS internal audit and the ISA
- PCI DSS for software and hosting providers
Keep exploring
Explore more about PCI DSS
Watch a video on how to implement PCI DSS here.
Watch a video on PCI DSS requirements here.
PCI DSS resources
Services for PCI DSS
Talk to a consultant
Plan PCI DSS compliance across every property and booking channel.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice