The Importance of Data Security and Why Compliance is Critical to Your Business

When it comes to customer trust and loyalty, data security is an important building block. Depending on the size of your business, there are different levels of information security that are required to prevent breaches of sensitive information such as banking information, social security numbers, names and addresses. 

In 2020 alone, there were over 100 data breaches affecting over 155 million people in the United States (Statista). The top two industry benchmarks for data security in the U.S. are the Payment Card Industry Data Security Standards (PCI DSS) certification, and System and Organization Controls (SOC). In addition to the U.S. frameworks, the General Data Protection Regulation (GDPR) is the most restrictive framework worldwide, protecting organizations in the European Union. 

If you are wondering how PCI DSS, SOC and GDPR are connected, let us explain. 

PCI: What it does and why it’s important

PCI DSS is a set of operational and technical requirements established by the Payment Card Industry to help secure payment data within organizations that accept or process card payment transactions (PCI security standards). PCI DSS is a contractual agreement between organizations, their merchant bank(s) and the issuing card brands. The framework and accompanying guidance documents assist organizations in becoming and re-attesting for compliance if they accept credit or debit card payments for goods/services. To achieve and maintain PCI compliance, organizations must implement and continuously validate their adherence to the framework’s requirements. Validations must be conducted annually on the anniversary of the last passing PCI DSS compliance audit. 

The goals of PCI DSS compliance are as follows: build and maintain a secure network, protect cardholder data, maintain a vulnerability management program, implement strong access control measures, regularly monitor and test in scope networks, and maintain an information security policy. As part of meeting these goals, an organization’s annual validation may include an inspection and validation of compliance by an independent Quality Security Assessor. The validation of operational and technical requirements outlined in the PCI DSS framework is known as a Report of Compliance. This helps to ensure that an organization’s people, processes, and technology are aligned to protect customers’ payment data against potential exposures or card data breaches.

Components of SOC 2 and how it’s different than PCI DSS

System and Organization Controls, SOC, is an audit framework based on the Trust Services Criteria that are used to measure the effectiveness of organizations’ overall security controls. While similar control requirements exist as part of PCI DSS, the focus of a SOC 2 audit is overall security, availability, processing integrity, confidentiality and privacy of an organization’s systems and data. PCI DSS is solely focused on payment card data. 

For an organization to become SOC 2 certified, an extensive security audit is conducted by an independent firm of certified SOC auditors that is recognized by the American Institute of CPAs. A SOC 2 audit focuses on organizational security such as a safe operating environment and protecting the interests of an organization. 

There are two types of SOC 2 audits. The first is a review of existing security controls and design (SOC 2 Type 1). The second (SOC 2 Type 2) is an evaluation and validation of controls over an extended period, typically between 6 to 12 months. Different from a SOC 1 audit, which is surrounding financial processes and controls, a SOC 2 audit is not required under a compliance framework, making it optional. 

“As an organization grows, both organically and inorganically, its security and compliance responsibilities also grow,” said Bill Hanning, chief security officer at Groups360. “We continuously audit ourselves to ensure that what we are doing is what is expected, what is required, that we do it ethically and that we can we provide proof if requested.”

General Data Protection Regulation and how it works for U.S.-based organizations

If you are a United States-based organization that wants to conduct business in the European Union, you are required to adhere to GDPR. If you are unfamiliar with what GDPR is and why you must follow regulations established for countries in the EU, let’s get you up to speed. 

GDPR stands for the General Data Protection Regulation and is an international law formally enacted by member states of the European Union. The framework contains some of the most restrictive compliance and security requirements to date. GDPR was designed to protect the data of organizations in the European Economic Area and its private citizens, but compliance with the law is not limited to those organizations or individuals. 

As an American-based company, adherence to these regulations is required to work with EU-based organizations. GDPR enforces the required amount of protection that an organization must apply to safeguard against potential data breaches or unauthorized disclosures through security and privacy components. Some of the 10 key principles of GDPR that all organizations must comply with are data minimalization, accuracy and confidentiality. Failure to ensure compliance with any of the 10 principles can result in penalties or fines up to 20 million euros or 4 percent of the total global turnover of the preceding fiscal year, whichever is higher (GDPR-info). 

What does this mean for you as a business?

Implementing and following established security and compliance frameworks fosters trust and loyalty with consumers, such as event planners and attendees. When a company or hotel presents strong boundaries and resistance to potential cyber threats, it shows commitment to its clients. As a hotelier, you don’t want to break the trust of your event or meeting planners. Instead, you want to give them more reasons to come back in the future!

Compliance with data security frameworks can reduce exposure risks for a hotel and guests, decrease potential penalties or fines for non-compliance and ensure the reputation of the organization is maintained. In today’s world, bank cards are more frequently used as a form of payment over cash – noncompliance could be detrimental to your hotel’s success.

The benefits of being PCI, SOC, and GDPR compliant

When an organization is compliant with PCI, SOC and GDPR, it stands apart from its competitors. To be successful and competitive as a business, data security is a must. Guests will become aware of the value placed on the protection of their personal information, which builds trust between a company, such as a hotel, and a consumer, like event planners. Without data security, you risk losing clients’ trust and the credibility of your organization – resulting in a loss of business.  

Groups360 goes above and beyond to ensure the confidentiality, integrity, and availability of the data it receives and maintains from its clients. 

As Groups360 continues to engage with clients across the globe, benchmarking ourselves against the most stringent of security and compliance requirements shows our commitment to our client’s security. This sets us apart from other platforms, opening us up to greater relationships and a larger search base for clients. Groups360 is committed to doing all it can to ensure that our customers’ information, both during and after transactions are completed, remains safe and secure, no matter where they are in the world.

Make sure you consult a professional who is licensed or knowledgeable in PCI DSS, SOC or GDPR.  Users should be aware that the information presented does not constitute legal advice and the creator will not be held accountable for any legal actions the reader may take.

No meeting space? No problem – How to increase group bookings

Group business represents a significant portion of many hotels’ revenue, but smaller hotels and motels often lack the meeting space to go along with a room block. However, there still are numerous ways that hotel owners can attract group business and cash in on this lucrative sector of the industry.

Small Meetings on the Rise

As pandemic recovery picks up speed, smaller meetings are the first to return. According to a recent Global DMC Partners survey, 75% of planners expect to hold face-to-face meetings in 2021, but 67% of these meetings will host fewer than 250 attendees.

By capitalizing on the return of these smaller groups and meetings, small and independent hotels can increase occupancy, create consistent and predictable revenue, and speed their post-pandemic recovery.

5 ways to increase group business

Planners often source smaller hotels thanks to their lower rates, proximity to venues, complimentary breakfasts, happy hours, and free parking, which all add up to significant savings on their overall spend. Here are five ways to attract more of this group business to your property.

1. Consider groups that don’t need meeting space.

Groups that need room blocks but not meeting space include sports teams, wedding parties, religious organizations, fraternities or sororities, military, family reunions, parents and guests for graduations, and students and their families moving in and out of colleges and universities.If you have an on-site bar, restaurant, or café, these groups will drive ancillary revenue in addition to the room block.

2. Make the most of the space you have.

Hotels with a cafeteria or lounge area could transform the open space into an informal reception area. Given the ongoing pandemic, many planners have opted to set up events on lawns and other outdoor spaces.

3. Cultivate local business relationships.

Hotel managers can form ties to local event venues, meeting spaces, and convention centers for group referrals, as well as hotels that could refer any overflow.
Join and advertise with a local CVB to boost your visibility to incoming groups. Hotel managers also can join the city council, mayor’s advisor board, and other professional groups that widen your referral network.
Partner with transportation companies. Hotels can add value to their group packages by offering shuttle service to and from the event venue or convention center, as well as key points in the surrounding city.

4. Reach out to part-time planners.

Many executive assistants, office managers, and human resources personnel plan multiple smaller events and meetings each year, but planning is only one of their many tasks.
The best way to reach them is through direct email campaigns and advertising in publications aimed at groups such as the American Society of Administrative Professionals, the Association of Executive and Administrative Professionals, and the Society for Human Resource Management.

5. Automate manual tasks.

Given the current lack of staff at hotels of all sizes, managers who implement technology can book more business, while freeing up time and energy. Consider platforms that streamline digital RFPs from prequalified planners and offer instant online booking for groups.
Hotel staff can also implement room-block management software that allows group guests to book and manage their own reservations online. Any initial learning curve on these kinds of tools will reap a significant return in saved time, reduced labor costs, and increased income.

Implement Financial Protections

When a group represents a significant portion of the overall hotel room count, managers should ensure they have adequate contractual protections to shield them from the inherent financial risk.

These include:

• Attrition clauses allow for a certain percentage of rooms in the room block to go unsold without financial penalty. This incentivizes the planner to fill the block and protects the hotel from lost revenue from unsold rooms withheld from inventory.
• Cutoff dates for room blocks are usually 21 to 30 days before the group actualizes. Any rooms not sold by that date are returned to inventory and sold to transient travelers or other groups.
• Cancellation policies ensure that any group that doesn’t actualize at all will lose their nonrefundable deposit.

If your hotel is integrated with an online group booking system, the booking process should include a standard terms-and-conditions clause that outline any consequences for cancellation.

At the same time, hotel managers should be as flexible as possible with planners who might need to make last-minute changes given the ongoing uncertainty around the pandemic.

Be Mindful of COVID-19 Protocols

Even as the pandemic begins to recede, travelers still expect a much higher level of cleanliness. Meeting planners and group organizers have additional needs and concerns that go along with bringing people together in a public environment. If you haven’t done so already, implement stringent cleaning protocols and consider property improvement plans (PIP).

Current hotel practices include:

• A clearly communicated cleaning regimen in rooms and public spaces
• Masks on hotel staff to protect guests
• Automated processes such as check-in and checkout when possible
• Prepackaged food and beverage offerings
• Clean filters in packaged terminal air conditioners (PTAC)
• PIPs and renovations to remove room carpeting and improve ventilation by installing more robust HVAC systems, more modern PTACs, and commercial-grade air purifiers

The hospitality industry will continue to recover, so now is the best time to position your hotel and motel properties to make the most of group revenue as meetings and events get back to business.

Originally published in Today’s Hotelier.