Virtual CISO, in-house CISO or just a SOC: who is accountable for security at the hotel

Three roles with similar names

A SOC (Security Operations Center) is a technical service, usually hired from an external supplier: it monitors alerts from the systems connected to it, investigates whatever looks suspicious and carries out the technical containment set out in the contract. It is security operations.

The CISO (Chief Information Security Officer) is a leadership role: accountable to the board for the hotel's information security programme. The CISO sets security priorities and budget, looks after compliance with the LGPD (Brazil's data protection law) and PCI DSS, keeps the incident response plan and chooses and manages the security suppliers, including the SOC itself. The role can be filled by an employee (in-house CISO) or by contract, on an interim or fractional basis (virtual CISO).

In practice, the SOC watches and reacts, while the CISO decides and answers to the board. The two roles complement each other, and one does not replace the other.

Side-by-side comparison

Why having a SOC does not mean security is taken care of

A SOC only sees what has been connected to it. If the cloud PMS, the POS, the guest Wi-Fi or the OTA accounts were left out of scope, alerts from those systems never arrive. Someone has to decide what to monitor, and that decision should not rest only with the supplier that charges according to the scope monitored.

Several areas also sit outside a SOC's scope: the backup policy and whether restores have been tested, front desk training against phishing and phone scams, contracts with suppliers that access guest data, the answers on the cyber insurance questionnaire and LGPD compliance. And when the SOC raises a serious alert at two in the morning, someone at the hotel needs the authority to decide whether to isolate the PMS, who tells the guests and when to involve the lawyers. If that person has not been named beforehand, the decision is improvised.

Finally: who checks whether the SOC is delivering what was contracted? Without security leadership, nobody reviews the reports, the response times or whether the scope still covers the hotel's current systems.

What a CISO does that a SOC does not

• Runs the security programme: roadmap, investment priorities, budget and indicators for the board
• Guides compliance with the LGPD and PCI DSS, and alignment with good practice such as ISO 27001 where it applies
• Keeps and tests the incident response plan, including tabletop exercises with the leadership
• Sets the monitoring scope, selects the SOC and holds it to its contracts, SLAs and performance
• Prepares the cyber insurance answers and prioritises fixing the gaps that can push up the premium
• Builds the security culture: phishing simulations and clear rules for the front desk and back office

In-house CISO or virtual CISO?

The responsibility is the same; the format changes. A full-time in-house CISO makes sense when the operation has reached a size or regulatory complexity that calls for exclusive dedication: several properties, international exposure or an extensive PCI DSS scope. For many independent hotels and small chains, the volume of security work does not justify a dedicated position, and the fractional format covers the same responsibility with proportionate time. The interim format covers a departure, setting up the role for the first time or a scheduled audit. We describe the service in virtual CISO for hotels: when it makes sense (in Portuguese) and on our Virtual CISO page.

How a SOC and a CISO work together

In a well-structured model, each role has a clear owner. The CISO, in-house or virtual, decides what needs to be monitored, chooses the detection and response supplier, writes the incident plan and answers to the board. The external SOC runs the monitoring and technical containment. The hotel's IT team or MSP carries out the fixes and the recovery. When an incident happens, the SOC detects, the CISO decides and coordinates, and whoever executes already knows what to do.

That is how HotelTI works: we do not operate a SOC or carry out technical containment. We take on the hotel's CISO role, select and supervise the external SOC and coordinate the response, with technical operation in the hands of the contracted supplier and the hotel's support team. Our coordination happens during business hours; for alerts outside those hours, the response plan sets out in advance who at the hotel decides and what the SOC can contain on its own. Legal duties in an incident, such as notifying the ANPD (Brazil's data protection authority), should be confirmed with the hotel's own lawyers.

Questions to assess your hotel's security

• Who, by name, is accountable to the board for the hotel's information security?
• Which systems are connected to monitoring, and who decided that scope?
• If the SOC raises a serious alert out of hours, who has the authority to decide what to do?
• When did someone last review the SOC's reports and SLA?
• Has the incident response plan been tested with the leadership?

Next steps

The right combination of SOC, in-house CISO and virtual CISO depends on the size of the hotel, its regulatory exposure and what is already contracted. In an initial call, our team looks at the current situation and suggests the format that fits best. Talk to our team.