Travel Management Companies handle some of the most sensitive Personal Identifiable Information (PII) when making bookings and arrangements for their travellers.
Perhaps that’s why many in the travel industry use ISO 27001, the internationally recognised standard for Information Security, to demonstrate their commitment to protecting personal data.
Information Security Risks in the Travel Industry
ISO 27001 takes a risk-based approach to managing threats to the confidentiality, integrity and availability of the company’s information assets.
The Risk Assessment Process forms an integral part of an ISO 27001 Management System and our consultants have a good understanding of the global distribution system (GDS), the bill-back procedure and other Travel Management Company processes, making them well placed to help you manage the associated risks.
Key Themes of ISO 27001 for Travel Management Companies
ISO 27001 provides an annex of controls that can be used to reduce the risks identified in your risk assessment.
These controls include the physical security of your premises, screening and management of your staff, asset management, system development, supplier relationships and legal compliance.
Our Consultants can advise you on the most effective way to implement these controls for Travel Management Companies, and provide assistance in drafting policies.
We also provide legal updates through our Risk Briefing Service, and can provide on-going support through our Risk Assist Service Desk Process. We have a comprehensive approach to delivering professional services for you.
ISO 27001 Certification
UKAS Accredited Certification to ISO 27001 provides an independent audit of your Information Security Management System, permitting the use of a recognised Certification Mark to assure customers that you have processes in place to manage the risk to their data.
A Flexible Approach to ISO 27001
We are experienced in providing ISO 27001 for Travel Management Companies and can provide flexible solutions to help you implement and maintain a bespoke Management System to ISO 27001. Contact us to discuss your requirements.
Other Considerations for Travel Management Companies
PCI DSS for the Travel Industry
Many Travel Management Companies have a need to take credit card payments from their travellers and therefore must comply with PCI DSS rules. Our Consultants can help you compile the Self Assessment Questionnaire (SAQ) or report on compliance (RoC) as applicable.
Cyber Essentials
Many government tenders are requesting Cyber Essentials Certification, which can be a good lead into a full ISO 27001 Management System.
