Implementation Checklist (Wyndham (FTC Section 5))

A practical rollout plan with measurable proof for hospitality network/payment control maturity and repeatable assurance.

0–30 days (stabilize + baseline)

• Inventory internet-facing hospitality systems and segmentation boundaries
• Baseline network and payment security policies in governed repositories
• Set approval gates for high-risk network and access changes

Deliverables - Boundary baseline repository and owner sign-off - Critical change approval workflow for high-risk controls - Security log-source coverage report

30–60 days (control effectiveness)

• Enable drift detection for segmentation and access controls
• Run least-privilege access reviews for sensitive systems
• Deploy detections for abnormal lateral movement and privileged activity

Deliverables - Drift metrics and alert procedures - IAM review package and remediation tickets - Detection rule validation results

60–90 days (evidence readiness)

• Dry-run 48-hour evidence-pack assembly for injunction/assessment readiness
• Add independent testing checkpoints for key boundary controls
• Issue quarterly executive report on control effectiveness and residual risk

Deliverables - Evidence-pack artifact map and custodians - Mock audit/regulator drill outcome summary - Quarterly governance reporting template

Ongoing metrics (prove it's real)

• % high-risk boundary changes with approval evidence
• Segmentation drift MTTR
• Privileged access exception count
• Coverage % of critical network/auth logs
• Closure SLA attainment for severe findings