Accor partners withVerizon to meet thestandards of PCIcompliance
Learn how the hospitality group teamed up with Verizon to manage
the complex challenges of the Payment Card Industry Data Security
Standard (PCI DSS).

Challenge
Accor Group: 5,400 hotels, 10,000 bars and restaurants,
200 million meals served every year, 185,000 meetingrooms or workspaces, in 110 countries.
To deliver on its promise of “providing exceptional
experiences”, the world’s leading hotel group relies on its
290,000 employees and an organisation based on a skilful
blend of centralisation and autonomy. “Our organisation
requires different approaches in order to apply a consistentsecurity and compliance strategy, regardless of the status
or nature of the establishment”, explains Marie-Christine
Vittet, VP Compliance for Accor.
With more than 40 brands divided into two categories,
Luxury & Lifestyle and Premium and Midscale & Economy,
the Group caters for tourists, business travellers andteleworkers. “For each customer profile, in each country,
Accor adapts to very specific payment habits”.
These diverse experiences and consumer habits mustnevertheless meet the same security and compliancerequirements. Since 2008, Accor has taken a numberof initiatives to ensure the security of payments and its
information system. In 2012, Accor decided to go evenfurther and adopt the PCI DSS standard.

“The orchestration of our compliance programme is based asmuch on the intellectual agility of our teams as on technicalrigour. To achieve this, we rely on a number of standards andprocesses that are the best guarantee of service excellencein very different environments.”
Marie-Christine Vittet,
VP Compliance – Accor

Case study

Case study

SolutionResultsResponsible for coordinating the PCI DSS project for
the entire Group, Marie-Christine Vittet chose to entrust
the IT consulting assignment to Verizon. “The expertiseand support of a partner like Verizon, with whom we hadalready worked, seemed to us to be a solid basis for
deciphering the Standard and defining what our PCI DSS
roadmap would be based on a document called “PrioritisedApproach”, Marie-Christine Vittet and her teams laid thefoundations for compliance with the PCI DSS V2 standard.

In 2015, after 3 years of hard work, the first PCI DSS
certification exercise was launched. “The efforts madeby Verizon’s teams and experts paid off, as we obtained
our first certification. System changes, upheavals in usage
and behaviour, technical and financial investments - thetransformation was deep and contributed to the creationof the compliance department within the Accor group.

A working group was then set up to manage the project
over a three-year period. “We defined an ambitious roadmap
and set ourselves indicators to keep pace with a demanding
project that would not have been possible without thesupport of the IT teams”.

“This organisational change was important because it
demonstrated the strength of the change and the interest
it held for all our employees and partners,” emphasises
Marie Christine Vittet.

.

The driving force behind the approach: transparency
and the desire to give meaning to the project. At that time,
payment methods in the hotel industry were beginning tochange, with credit cards predominating over the chequesand foreign currency. “Welcome and payment in all of ourvenues are key moments in the customer experience.
Secure payment and reliable payments are clearlypart of the Accor group’s welcome experience,” notesMarie-Christine Vittet. Through PCI DSS, we haveabandoned old practices such as scanning bothsides of a credit card”.

“The Verizon teams played a key role at every stageof the project. Acting as a coach, and a partner, wechose each other because Verizon was one of the few
players to have a PCI DSS complianceprogramme.
We both came out of the partnership stronger.”Marie-Christine Vittet,
VP Compliance – Accor

Case study

Benefits
Partners who listen and adapt
Given the scale of the Accor Group and its highstandards, “we need partners who can listen and adapt”.
This is really key given the Accor international reach.
“Verizon’s international service coverage gives them abetter grasp of our issues and challenges, and we haveto recognize the work of the QSAs (Qualified SecurityAssessors), who can speak several languages andare highly adaptable”.
These are just some of the specific features thathave enabled Accor to meet the challenge of PCI DSS
compliance. “It’s a constant effort to challenge ourselves,
which is being reinforced with the imminent introductionof the PCI DSS v4”

Ongoing support
To guarantee its compliance with the PCI DSS standard,Accor carries out regular audits. Preparing for the audit
keeps the teams busy for 6 months. “We like to carry out
a pre-audit, which is training for the final audit.
It allows us to check what we have learnt and identify
any areas for improvement”. Following the pre-audit, aremediation plan can be implemented before the finalaudit, which can take up to 3 months. It represents morethan 50 interviews carried out, mobilising a large numberof teams, with weekly meetings.
“It’s an unfazed but continuous tension that enables us
to obtain our certificate of compliance, which opens to a
ROC (Report of Compliance)”. This report is then passed
on to Verizon’s Quality Assurance department, who’s
delivering the final certificate of compliance.

Planning for the future
The PCI DSS standard is evolving and Accor plans to
be compliant with PCI DSS V4 by 2024. Within the PCI
committee set up by the hotel group, a sharepoint has beencreated to coordinate a number of tasks and demonstrate
the improvements being made on a regular basis. “The PCI
DSS v4 standard includes an ‘action planning’ dimension,
which we have already taken advantage of to meet ourpromise of excellence”.

Learn more:
PCI Compliance© 2024 Verizon. All rights reserved. The Verizon Business name and logo and all other names, logos and slogans identifying Verizon’s products and services are trademarks and service marks or registered trademarks and service marks ofVerizon Trademark Services LLC or its affiliates in the United States and/or other countries. All other trademarks and service marks are the property of their respective owners.