# Audit PCI after a franchise flag change

Harbor by Signalry · hotel job `pci-after-flag-change`
https://harbor.signalry.ai/jobs/pci-after-flag-change

How and who for the hotel job—verified when attested. Advice unless labeled verified. This brief is a worksheet, not an appraisal and not a quote.

## The job

When the flag, the PMS, or the booking path just changed, I want a scope I can fund so card data is actually in a smaller box — not a scanner PDF in a drawer.

**Outcome the catalog names:** A card-flow diagram the owner can read, a remediation the GM can fund, and a watch on the new path — without buying a SIEM you will not staff.

**Desk:** tech
**Urgency on the catalog:** This quarter
**Typical budget band (catalog, not a quote):** $18–45k audit + remediation
**Typical timeline (catalog, not a promise):** 6–12 weeks to a funded plan

## Scoped brief

Trace the card. PMS, POS, booking path, call center, the tablet in the restaurant. Draw scope for the owner, not just IT. Remediate what is in the box. A franchise-mandated scanner can be theater — say so. A watch agent can alert on exceptions. It must not 'fix' a folio. Folio Security exists to write the plan; they do not sell the SIEM.

1. **Trace every place a card can live.** If you cannot draw it, you cannot scope it. Include the workaround the night audit invented in 2019. That is usually the finding.
2. **Write scope in owner language.** What is in, what is out, what it costs to make it smaller. A diagram that needs a CISO to read is not done.
3. **Fund remediation, not a logo.** Tokenization, a smaller CDE, training the desk. A dashboard nobody opens is not remediation. Folio will say when the franchise scanner is theater.
4. **Watch the new path.** After a flag or PMS change, drift is the risk. Folio Watch alerts. A person opens the ticket. Silent 'fixes' are how you create a second card flow.

## When not to buy

A scanner PDF that never traces the leftover call-center tape. A franchise scan is not the audit.

## Provider shortlist

- [Folio Security Advisors](https://harbor.signalry.ai/providers/folio-pci) — people · PCI & hotel cyber after flag change. Catalog score 8.7 (post-job shape, not a verification).
- [Folio Watch Agent](https://harbor.signalry.ai/providers/folio-watch) — agent · Inventory & card-flow watch. Catalog score 8.4 (post-job shape, not a verification).
- [Keystone Switch PMS](https://harbor.signalry.ai/providers/keystone-switch) — software · PMS cutover & parallel run. Catalog score 8.3 (post-job shape, not a verification).
- [Northline PMS](https://harbor.signalry.ai/providers/northline-pms) — software · Property management system. Catalog score 8 (post-job shape, not a verification).

## Success the brief names

- Card-flow diagram signed by GM and owner.
- Remediation priced and sequenced.
- Watch live on the new path within 30 days of change.

## Pitfalls

- Believing the franchise scan is the audit.
- A SIEM for a hotel that cannot staff tickets.
- An agent that auto-reconciles card exceptions.

---

Stable id: `pci-after-flag-change`
Source: Harbor by Signalry · https://harbor.signalry.ai
Verified Outcome is not insurance. Do not treat a catalog score as attested proof.