Card payments, guest Wi-Fi, property systems and seasonal staff, protected by Sophos and sized by a partner serving Canada and the United States. Sophos Silver Partner. Offices in Markham, Ontario and Dallas, Texas. Quotes in CAD and USD, shipping to Canada and the United States. Three questions every hospitality owner asks. Tap a card to jump to the detail. Each row shows what can go wrong, which rule or standard expects you to control it, and the products that do. The tags under each risk show where Sophos or TrendAI name the same risk on their own industry pages or in their research. Terminals, back office and guest Wi-Fi share one network, and card data walks out. Rules and standards What fixes it Reservations, room keys and billing stop while the hotel is full. Exploited vulnerabilities started 30% of ransomware attacks on retailers, the closest sector Sophos reports. Source Rules and standards Shared logins and people two weeks into the job are easy targets for booking scams. 62% of breaches involved the human element (all industries). Source Rules and standards What fixes it Booking, loyalty and POS vendors keep access, and guest data falls under privacy law. Rules and standards Orange links are Sophos, 1Password, N-able and Axcient products; blue links are TrendAI. A product supports the control; meeting a rule also takes your own policies and records. What breach and ransomware research says about this sector. Every figure links to its source. Figures are the all-industry 2026 DBIR baselines; Verizon publishes retail, not accommodation, as a separate snapshot. Sophos does not publish a hospitality report. Its retail report, 361 IT and security leaders in 16 countries, covers the same point-of-sale and guest-data exposure. Source: Sophos The same four stages appear in nearly every breach. Each stage below shows what it looks like in this sector and the control that breaks the chain. The rules and expectations that shape a security purchase in this sector, in both countries. Status is as of September 2026; check the linked source before relying on a date. What the rules above ask you to do, in everyday words. Three dates and numbers to know first, then the requirements that come up again and again. PCI DSS expects security logs for card systems to be reviewed at least once a day A firewall at every site, and sensitive systems kept on their own separate network. Covered by: Sophos Firewall (XGS), Sophos Switch, AP6 wireless A password alone is not enough. Staff, admins and anyone working remotely confirm each sign-in with a phone app or key. Covered by: Sophos ITDR finds who is missing it; 1Password; Sophos Workspace Protection Every laptop, desktop and server runs protection that blocks and rolls back ransomware. Covered by: Sophos Endpoint and Endpoint for Server; MDR watches it 24/7 Systems log sign-ins and changes, and the logs are kept long enough to investigate. Covered by: Sophos Next-Gen SIEM, Sophos XDR A risk assessment and regular scans, with the most dangerous gaps fixed first. Covered by: Sophos Managed Risk, TrendAI Vision One CREM A written plan for a breach, people to carry it out, and notices sent to regulators and customers within the deadline. Covered by: Sophos MDR Plus responds 24/7 and documents the incident Suppliers with access to your systems or data are vetted, and their access is limited and removed when no longer needed. Covered by: Sophos Workspace Protection limits vendor access; ITDR finds stale accounts The tags show which rule or buyer asks for each item. Insurers, investors and large customers often ask for the same controls even where no law requires them. Each row is one job your security has to do, in plain words. Pick one product per row from the vendor you prefer: Sophos and TrendAI cover most rows; N-able Cove or Axcient cover backup; 1Password covers passwords. The last column shows the hospitality rule each row helps with. Decide who is responsible, which rules apply and what is allowed. List what you have and find the gaps before attackers do. Firewall, email and device protection, safe logins and remote access. Watch accounts, networks and logs for signs of an attack. Contain an attack fast, work out what happened, and tell the people who need to know. Backups you have tested, so you can restore instead of paying. The six steps are the functions of the NIST Cybersecurity Framework 2.0. TrendAI equivalents appear in the table below. Source A dash means that vendor does not sell a product for that row through Nuformat. A product supports the control; meeting a rule also takes your own policies and records. All 17 Sophos product lines Nuformat sells, what each one does in this sector, and the standard or framework control it supports. This is a high-level map: products supply the technical safeguards, and compliance still depends on your policies, people and evidence. Section and control numbers point to the requirement a product helps with. Your auditor or assessor decides whether the control is met. Nuformat maps a specific questionnaire or assessment to these products on request. Cyber insurance pays for the cost of an attack or a data breach. Before quoting, insurers check a short list of security controls; missing ones raise the premium, cut the limit, or end the conversation. Policies differ. Read the exclusions, waiting period and sublimits, especially for ransomware and social engineering fraud. The list follows Marsh's twelve key cyber controls. Source Where insurers dig deeper: Hotels and restaurants are asked how card systems are separated from guest Wi-Fi, how third-party vendors connect, and whether payment terminals are kept up to date. A group with a head office, ten restaurants, about 250 staff and cloud POS would typically run: Licenses are sold in 1, 2 or 3-year terms or month to month through Nuformat. Hardware is bought outright or as Hardware as a Service. Every quote states the currency. Send us your site list, user count and any questionnaire you have been given. A Nuformat specialist maps the products to it and returns a quote within two to three business days. Available in Canada and the USA. Sophos Silver Partner. The main ones on this page are listed by country. In Both: PCI DSS v4.0.1, Franchisor and brand standards. In Canada: PIPEDA and Quebec Law 25. In the United States: State breach notification laws. Many organizations also organize the work with the voluntary NIST Cybersecurity Framework 2.0 and its six functions: govern, identify, protect, detect, respond and recover. Check the linked sources for current status and dates. Sophos covers the firewall, endpoint, email, identity, network detection and 24/7 managed detection and response, and TrendAI Vision One offers an alternative for most of the same needs, except the firewall itself. Neither Sophos nor TrendAI sells backup or a password manager through Nuformat, so N-able Cove or Axcient handle backup and recovery, and 1Password Business handles passwords. The feature match table on this page lists each need with the product from each vendor. PCI DSS v4.0.1 asks for network segmentation, firewalls, malware protection, MFA into the card environment, logging and monitoring. The XGS firewall provides the segmentation and IPS, Sophos Endpoint the malware protection, ZTNA the controlled vendor access, and Next-Gen SIEM the logging. Nuformat maps the products to the requirement numbers with the quote. Yes, on separate VLANs with rules that stop guest traffic reaching the payment or operations networks. That separation is the point of the design, and it is what a PCI assessor looks for. A desktop Sophos XGS 108, 118 or 128 with Xstream Protection covers a property with one internet connection; the w models add built-in Wi-Fi for small sites. Use the sizer on the Sophos firewall page. The vendor manages the terminals, not your network, your mailboxes or your back-office PCs. MDR Plus watches all of it 24/7 and responds when the vendor is closed. Yes. Nuformat is a Sophos Silver Partner with offices in Ontario and Texas, quoting in CAD and USD. It covers much of what insurers ask about: MFA visibility, EDR, email security, logging and 24/7 response through MDR. Backups come from N-able Cove or Axcient. Insurers decide coverage and price, so answer the application accurately; Nuformat can map your current controls to the questionnaire before you submit it.Cybersecurity for hotels, restaurant groups and venues.
The page in 30 seconds
See the top risks →
See what they ask for →
See the feature match →1. The problem: your top 4 risks, the rule behind each, and what fixes it
1Card data stolen at the point of sale
2Ransomware at the front desk
3Phishing aimed at new and seasonal staff
4Vendors, franchisors and guest privacy
The risk in numbers
If ransomware hits a retailer, the closest sector Sophos reports on
How an attack unfolds here, and where Sophos stops it
What you have to comply with
Where Rule or expectation What it asks for Both PCI DSS v4.0.1 Every property that takes cards. Network segmentation, firewalls, malware protection, MFA into the card environment, logging and quarterly scans. The future-dated requirements became mandatory March 31, 2025. Source Canada PIPEDA and Quebec Law 25 Guest personal information must be safeguarded; breaches reported to the commissioner and affected guests. Source United States State breach notification laws All 50 states require notification of affected residents; several set security-program duties for businesses holding personal data. Source Both Franchisor and brand standards Hotel brands and restaurant franchisors set minimum network and PCI standards for properties. Source 2. The rules, in plain English
1Fence off your network
2Lock every login with a second step
3Stop malware and ransomware on every computer
4Keep a record of who did what
5Find and fix weak spots on a schedule
6Have a plan, and report on time
7Check your vendors
Feature match: what you need, and who covers it
How the pieces fit together
Set the rules
Know your weak spots
Keep attackers out
Spot what gets through
Stop it fast
Get back to work
What you need Sophos TrendAI Backup: N-able Cove or Axcient 1Password Helps meet
ProtectSophos Firewall (XGS) TrendAI Network Security (intrusion prevention, used alongside a firewall) – – PCI DSS Req. 1 and 11.5; CIS 12
ProtectSophos Endpoint
Sophos Endpoint for ServerTrendAI Endpoint Security – – PCI DSS Req. 5
ProtectSophos Email TrendAI Email and Collaboration Security – – PCI DSS 5.4.1 anti-phishing; CIS 9
Detect and RespondSophos MDR TrendAI MDR – – PCI DSS 12.10 incident response; Law 25 confidentiality incidents
Protect and DetectSophos ITDR TrendAI Identity Security – 1Password Business PCI DSS Req. 7 and 8; PCI DSS 8.2 and 8.3
DetectSophos NDR TrendAI XDR for Networks (NDR) – – PCI DSS 11.5; CIS 1
ProtectSophos Workspace Protection (ZTNA) TrendAI ZTSA Private Access – – PCI DSS 8.4 MFA; CIS 6
IdentifySophos Managed Risk TrendAI Cyber Risk Exposure Management – – PCI DSS 11.3 vulnerability scans
Protect and DetectSophos Next-Gen SIEM TrendAI Agentic SIEM – – PCI DSS Req. 10
Protect and Recover– – N-able Cove for Microsoft 365
Axcient x360Cloud– PCI DSS 12.10.1 incident response plan (business recovery and data backup); PIPEDA 4.7
Protect and Recover– – N-able Cove for PCs, Macs and servers
Axcient x360Recover– PCI DSS 12.10.1 incident response plan (business recovery and data backup)
Protect– – Axcient x360Sync – PIPEDA 4.7; Law 25
Govern and ProtectSophos AI Defense TrendAI ZTSA AI Service Access – – PIPEDA 4.7; NIST AI RMF
ProtectSophos Mobile TrendAI Mobile Security protects phones from malicious apps but does not manage, lock or wipe them. – – PCI DSS Req. 2 and 5; CIS 4 Every Sophos product line, mapped to hospitality (17 lines)
Sophos product line Use in hospitality Helps meet Sophos Firewall (XGS)Protect Property perimeter, guest Wi-Fi isolation and SD-WAN to head office. PCI DSS Req. 1 and 11.5; CIS 12 Sophos Virtual FirewallProtect Protects cloud property management and reservation systems. PCI DSS Req. 1; CIS 12 Webserver Protection add-onProtect Protects booking engines and loyalty sites. PCI DSS 6.4.2 automated protection for public web apps Sophos SwitchProtect Keeps POS, PMS, cameras and guest networks on separate VLANs. PCI DSS Req. 1 (segmentation) Sophos AP6 wirelessProtect Property-wide guest Wi-Fi isolated from back-of-house systems. PCI DSS Req. 1 and 11.2 (wireless) Sophos EndpointProtect Protects front desk, back office and POS workstations. PCI DSS Req. 5 Sophos Endpoint for ServerProtect Protects PMS and reservation servers. PCI DSS Req. 5 and 6 Sophos XDRDetect Investigates alerts across many properties from one console. PCI DSS Req. 10; CIS 8 Sophos MDR and MDR PlusRespond 24/7 response for a business that never closes. PCI DSS 12.10 incident response; Law 25 confidentiality incidents Sophos ITDRDetect, Respond Removes shared front-desk logins and stale vendor accounts. PCI DSS Req. 7 and 8 Sophos NDRDetect Watches door locks, cameras and building systems that cannot run an agent. PCI DSS 11.5; CIS 1 Sophos EmailProtect Stops booking scams and fake supplier invoices. PCI DSS 5.4.1 anti-phishing; CIS 9 Sophos Next-Gen SIEMDetect Central logs across properties for PCI and brand audits. PCI DSS Req. 10 Sophos Managed RiskIdentify Finds exposed systems across properties and ranks fixes. PCI DSS 11.3 vulnerability scans Sophos Workspace Protection (ZTNA)Protect Access for property managers and vendors to specific systems only. PCI DSS 8.4 MFA; CIS 6 Sophos MobileProtect Manages staff tablets and phones used for check-in. PCI DSS Req. 2 and 5; CIS 4 Sophos AI Defense Quote on requestGovern, Protect Policy for AI tools used in guest messaging and marketing. PIPEDA 4.7; NIST AI RMF Cyber insurance: what it pays for and what insurers check
Your own costs
Claims against you
The 12 controls insurers look for
A worked example: a restaurant group with ten locations
Where What runs there Head office XGS 2100 with Xstream, Sophos Endpoint, MDR Plus, Next-Gen SIEM Ten restaurants XGS 108 or 118 with Xstream, AP6 access points; POS, staff and guest VLANs POS vendor and franchisor access Sophos ZTNA, per application Manager mailboxes Sophos Email Plus plus MFA Microsoft 365 and back office Cove backup with a tested restore Get this sized and quoted for your organization
Frequently asked questions
Which cybersecurity rules and frameworks apply to hospitality?
Which products cover the main cybersecurity needs for hospitality?
How does Sophos help with PCI DSS?
Can guest Wi-Fi and POS share one firewall?
What firewall fits a single restaurant or small hotel?
Do we need MDR if the POS vendor manages the terminals?
Do you serve properties in both countries?
Will Sophos help us get or renew cyber insurance?
Industries · Hospitality · Canada and USA
In plain terms: Hospitality runs card payments and guest Wi-Fi on the same buildings, often on the same network. The job is to keep the payment environment small and separate, watch it, and make sure the front desk, the POS and the reservation system stay up through a busy weekend.
1The problem
2The rules
3The fix
PCI DSS Req. 1 network security controlsPCI DSS Req. 5PCI DSS 11.5
PCI DSS 12.10 incident response
PCI DSS 5.4.1 anti-phishingPCI DSS Req. 8
PIPEDA 4.7 safeguardsQuebec Law 25PCI DSS Req. 8
48%
of breaches involved ransomware (all industries)
Verizon 2026 Data Breach Investigations Report
62%
of breaches involved the human element (all industries)
Verizon 2026 Data Breach Investigations Report
48%
of breaches involved a third party (all industries)
Verizon 2026 Data Breach Investigations Report
31%
of breaches began with an exploited vulnerability (all industries)
Verizon 2026 Data Breach Investigations Report
Most common way in30%Exploited vulnerabilitiesthe most common way in
What it costs$1Mmedian ransom paid
And then$1.65Maverage cost to recover, ransom not included
1Entry
What happensPhished manager login or a POS vendor's remote tool
What stops itSophos Email Plus; XGS firewall with IPS; ZTNA for vendors
2Foothold
What happensA back-office PC
What stops itSophos Endpoint stops exploits and card-scraping malware
3Spread
What happensToward the POS and property management segments
What stops itFirewall VLANs keep POS, guest and operations apart; NDR watches
4Impact
What happensCard theft, encryption of the PMS
What stops itMDR Plus responds 24/7; Cove restores; PCI evidence in SIEM
Dailylog review
PCI DSS
PCI DSS
PCI DSS
PCI DSS
PCI DSS
PCI DSSPIPEDAState laws
PCI DSSBrand standards
Not sure which of these you already cover?Send us what you run today. A Nuformat specialist marks each requirement as covered, partly covered or missing, at no charge.
Govern
Sophos AI Defense
Identify
Sophos Managed Risk
Protect
Sophos FirewallSophos EndpointSophos Endpoint for ServerSophos EmailSophos ITDR1Password BusinessSophos Workspace ProtectionAxcient x360SyncSophos Mobile
Detect
Sophos NDRSophos ITDRSophos Next-Gen SIEM
Respond
Sophos MDR
Recover
N-able Cove M365Axcient x360CloudN-able CoveAxcient x360Recover
Block attacks at your internet connectionChecks traffic coming in and going out and blocks attacks. A firewall also keeps parts of the network apart; TrendAI Network Security is intrusion prevention that works alongside a firewall.
Stop ransomware and malware on computers and serversProtection on each laptop, PC and server that blocks malicious software and stops files being encrypted.
Stop phishing and fake-invoice emailsChecks email before it reaches staff and blocks phishing links, malware and impersonation.
Experts watching for attacks around the clockA security team monitors your systems 24/7 and acts on attacks, including nights and weekends.
Protect logins and passwordsSpots stolen or risky accounts and missing multi-factor authentication, and gives every person a unique, strong password.
Watch devices that cannot run security softwareWatches network traffic to spot attacks on cameras, scanners, medical or plant equipment and other devices with no protection of their own.
Safe remote access for staff and vendorsLets people reach only the applications they need from home or on the road, instead of the whole network.
Find and fix weak spots before attackers doFinds exposed systems and missing patches, and ranks what to fix first.
Keep logs as proof for auditors and insurersCollects and keeps security records, so you can show what happened and when.
Back up Microsoft 365 or Google WorkspaceKeeps a separate copy of email and cloud files, so a deleted mailbox or an attack does not mean lost data.
Back up servers and PCs, and restore fastBacks up whole machines so you can restore files or entire systems after ransomware or a hardware failure.
Share files with clients and partners securelyControlled file sharing with permissions, instead of email attachments or personal cloud drives.
Control the AI tools staff useShows which AI tools people use and keeps sensitive data out of the ones you have not approved.
Manage, lock and wipe phones and tabletsKeeps company phones and tablets set up securely, and locks or wipes them if they are lost.
Want this priced for your sites?Pick a column or mix them. Tell us your sites, users and servers, and we quote Sophos and TrendAI side by side in CAD or USD within two to three business days.
1
MFA for remote and privileged (admin) accessSophos ITDR shows gaps; 1Password; Workspace Protection
2
Email filtering and web securitySophos Email; Sophos Firewall web filtering
3
Secured, encrypted and tested backupsN-able Cove; Axcient x360Recover and x360Cloud
4
Privileged access managementSophos ITDR flags admin accounts; 1Password vaults admin credentials
5
Endpoint detection and response (EDR)Sophos Endpoint with XDR, or MDR
6
Patch and vulnerability managementSophos Managed Risk; TrendAI CREM
7
Incident response planSophos MDR Plus includes incident response
8
Security awareness training and phishing testsA staff training program; Sophos Email cuts the volume
9
Remote desktop (RDP) lockdown and hardeningSophos Firewall; Workspace Protection replaces exposed RDP
10
Logging and monitoringSophos Next-Gen SIEM; MDR
11
Replace or protect end-of-life systemsFirewall segmentation; Sophos NDR watches what cannot be patched
12
Supply chain and vendor riskWorkspace Protection limits vendor access; ITDR removes stale accounts
Answer the application accurately. In 2022 an Illinois manufacturer's application said it required MFA for email and remote network access. After a ransomware attack, the insurer said MFA was only on the firewall and asked a court to cancel the policy. On August 26, 2022 the court entered judgment rescinding the policy, with the company's agreement, leaving it without coverage. Source
Renewing or applying for cyber insurance?We map your current setup to the twelve controls before you fill in the application, so the answers are accurate and the gaps are known.
Sources