Hybrid Cybersecurity Compliance Audit Framework for an On-Premise Hotel Property Management System: Mapping NIST CSF 2.0 Controls to Indonesia's Personal Data Protection Law

Abstract

The accelerating digitalization of Property Management Systems (PMS) in the hospitality sector introduces substantial cybersecurity exposure, particularly concerning the protection of guests' personal data. This study audits the cybersecurity posture of an on-premise e-VHP PMS operated by an international chain hotel in Surakarta, Indonesia, whose local PMS core is integrated with cloud-based third-party Channel Manager and Online Travel Agency (OTA) platforms managed at the corporate level. A hybrid audit instrument was developed to bridge technical controls under NIST Cybersecurity Framework (CSF) 2.0 with legal obligations under Indonesia's Personal Data Protection Law (UU PDP) No. 27/2022. Primary data were collected through structured interviews with six informants representing three organizational layers: managerial (General Manager), technical (two IT Officers), and operational/front-line staff (Front Office, General Cashier/Accounts Payable, and Income Audit/Accounts Receivable), using a five-point maturity rubric (1 = Not Implemented to 5 = Optimized and Continuously Reviewed). Aggregated maturity scores showed that Detect (3.33) and Govern (3.00) achieved the highest relative maturity, whereas Respond (1.50) and Recover (1.89) showed the most severe capability deficits; Protect (2.50) and Identify (2.44) fell in between. Gap analysis against the optimal target (5.00) placed Respond at the highest remediation priority (Gap = 3.50), followed by Recover (Gap = 3.11). A cost-sensitive risk register identified critical exposure in endpoint backup failure and unmanaged credential sharing among front-line staff, alongside high power-management and integration-channel risks. Structural mapping shows these technical and behavioral gaps correspond to potential non-compliance with Articles 35, 39, and 46 of the UU PDP, exposing the organization to administrative fines of up to 2% of annual revenue. The study proposes a tiered Cybersecurity Governance Blueprint emphasizing local incident-response capability, standardized power-backup procurement, encrypted endpoint backup automation, and a structured security-awareness program for front-line personnel.