The Vault
1,412 standards across 47 departments. Search is free for everyone — type it the way you'd say it.
9 standards for “employee separation”
Employee access removal
Remove all system access the same day employment ends, for every separation type, with documented verification across every platform. Access is individual, auditable, and dies the day employment ... works here. Same-day removal protects guest data, cash controls, and the departing employee, who can no longer be blamed for what happens next
Phishing email reporting
Give every employee a fast, blame-free way to report phishing and social-engineering attempts before anyone clicks, pays, or discloses. Attackers target hotels through the very helpfulness ... callers posing as vendors or IT. The property's best sensor is an employee who reports in seconds without fear of looking foolish. Punishing reporters silences the alarm
Same-Day Access Provisioning and Deprovisioning Tied to HR Status
Requires that system access is created, changed, or removed the same day an employee's HR status changes, driven by an HR-to-IT notification feed. Access follows ... account is a door left unlocked in the name of convenience, and terminated-employee access is the finding auditors and insurers punish hardest. Speed here is a security
Phishing Incident First Response and Containment
Directs the first thirty minutes after an employee clicks a phishing link, opens a malicious attachment, or surrenders credentials. Reporting a phish is step zero; the damage clock ... click. The hotels that survive credential theft are the ones where the employee who clicked tells someone within minutes, because leadership made honesty cheaper than hiding. Containment speed
Password and authentication standards
individual authentication is the cheapest security the property owns. It also protects honest employees, because a credential only they hold is proof of what they
Event Ticketing System Access
security gap. An unrevoked account after a role change can let a former employee comp tickets or view guest data long after they've left the function. Clean
Vendor remote access
through a vendor's always-on connection. Vendors deserve the same rule as employees: access is individual, auditable, and dies the day the relationship does. An open tunnel
Technology disposal
destroyed, documented, and removed from asset inventory. Guest folios, card tokens, and employee records outlive the hardware they sit on. A retired workstation sold with its drive intact
Guest Wi-Fi Outage Triage and Vendor Escalation
slowest; a review mentioning dead internet outlives the outage by years. Triage discipline separates a five-minute fix from a five-hour vendor ping-pong. Every minute without