Vendors
Vendors are the quiet breach path. They need access to your systems, but they don’t live inside your controls. One weak vendor account can bypass staff training, bypass policies, and turn into a full incident. This page shows what vendor risk looks like in hotels, the controls insurers expect, and the proof you can hand to underwriting and audits.
Why vendor risk hits hotels harder than most industries
Hotels rely on third parties for operations: booking engines, channel managers, IT support, maintenance, payment providers, security systems, marketing platforms, and more. The problem is simple: vendors often get elevated access, and hotels rarely have clean accountability for who has access, how they log in, and when it gets removed.
- Vendor logins created as “admin” for speed
- Permissions never reduced after setup
- One account touches multiple properties
- No regular access review
- Remote desktop / support tools left enabled
- Shared credentials in tickets or email
- Support accounts bypass hotel controls
- Access used outside business hours
- MFA for third-party access
- Vendor inventory + owners
- Least privilege and offboarding
- Documented proof (not “we think so”)
What’s at risk when vendors aren’t controlled
Vendor compromise turns into guest data exposure, payment fraud, and operational downtime.
- Guest PII: profiles, booking details, exports
- Payments: refund abuse, invoice rerouting, chargeback disputes
- Email workflows: approvals, vendor impersonation, payroll redirects
- Regulatory & claims risk: notifications, legal, insurer scrutiny
- PMS/POS downtime (lost revenue + guest chaos)
- Ransomware pathways through remote support tools
- Network exposure via unmanaged vendor devices
- Multi-property blast radius when one vendor spans locations
OBRYN Guard vendor controls (governance + enforcement)
Simple rule: vendors only get the access they need, only when they need it, and you can prove every part of it.
- Vendor list (systems touched + purpose)
- Business owner + IT owner assigned
- Criticality tags (high / medium / low)
- Review cadence set
- Vendor register (exportable)
- Ownership record
- Risk tier list
- Review schedule
- Vendor roles (not staff roles)
- Scoped permissions (what/where)
- Access reviews (quarterly or insurer-driven)
- Offboarding rules for termination
- Access roster by vendor
- Role summaries
- Review logs + sign-off
- Offboarding records
- MFA required for vendor access
- Password rules aligned to underwriting
- High-risk logins blocked/challenged
- Exceptions tracked with owner + date
- MFA status report
- Policy export
- Exception list
- Remediation timeline
- Approved remote tools only
- Access windows (business hours rules)
- Logging expectations
- Disable unused remote paths
- Remote access control statement
- Window policy
- Log snapshots
- Disablement records
What your property gets (vendor proof pack)
Executive-clean artifacts you can hand to underwriting, auditors, or ownership.
- Vendor list + owners
- Systems touched
- Risk tiering
- Review cadence
- Access roster by vendor
- Role summaries
- Review logs
- Offboarding records
- MFA enforcement report
- Password policy export
- Exception list
- Remediation timeline