- an Information Security Program (ISP), including incorporation of zero-trust principles, regular reporting, and employee training
- encryption practices, critical patch management policy and procedures, unauthorized user detection and user access controls, logging and monitoring users and files within the network
- vendor and franchises oversight, risk assessments for critical information technology vendors
- M&A controls to assess any prospective acquired entity’s information security program and identify gaps or deficiencies when integrating with Marriott’s network
- Assessments by an independent third party of Marriott’s ISP every two years for 20 years
As part of the settlement agreement, Marriott will additionally:
- give consumers protections including a data deletion option (even if their state law does not provide for this)
- offer MFA (multi-factor authentication) for loyalty rewards accounts, and
- conduct reviews of those accounts for any suspicious activity.
Lessons for Companies Handling Consumer Data
The Marriott breach underscores the importance of a proactive approach to data security. Failure to comply with data protection laws can result in significant financial penalties, regulatory scrutiny, and loss of consumer trust. To avoid these pitfalls, companies must:- Implement comprehensive information security programs and regularly review and update them.
- Ensure sensitive data is encrypted and access is tightly controlled.
- Monitor networks continuously for unauthorized access and respond swiftly to potential vulnerabilities.
- Assess the security practices of vendors and partners, especially during mergers and acquisitions.
- Engage independent third-party experts to assess the company’s security posture regularly.
