Customers see one brand. Behind it sit dozens of independently run businesses with their own broadband, their own tills, their own wireless and often their own websites on hosting nobody at head office has heard of. When something goes wrong at one site, the brand carries the reputational damage, and the Information Commissioner’s Office will still ask who was responsible for the personal data involved.
Work out who controls what
Start with the data rather than the network. For each system, establish who decides why and how personal data is processed, because that determines who is the controller and where the obligation sits. A booking platform run centrally with franchisees as users is a different arrangement from each site running its own system and sending reports upwards. Write it down per system, since this analysis shapes both your contracts and your incident response, and doing it during an incident is far harder than doing it now.
Set a security baseline in the agreement
The franchise agreement is the only real lever head office has. Use it to require specific, checkable things: multi-factor authentication on the point of sale and email systems, supported operating systems, a separate network for public wireless, no shared administrative passwords across sites, and prompt notification of any suspected incident. Vague wording about maintaining appropriate security achieves nothing at renewal time. Where you can, provide the standard rather than requiring it, since a central deal on managed routers and endpoint protection is cheaper and more consistent than forty independent purchases.
“The pattern in multi-site brands is always the same. Head office has a decent security programme covering systems it owns, and the estate is compromised through a site that bought its own router in 2019. Sampling a handful of locations properly tells you more about your actual exposure than another test of the corporate network.”
William Fieldhouse, Director, Aardwolf Security Ltd
Testing an estate by sample
Testing every site is neither affordable nor necessary. Choose a representative sample covering the different builds in use, including the oldest, and rotate which sites are covered each year so every location is seen eventually. External penetration testing services can cover the internet-facing side of each sampled site, including any website the franchisee commissioned, and the findings usually repeat across sites built the same way, which makes remediation a programme rather than a series of one-off fixes.
Keeping visibility between tests
Monitor the estate centrally even where you do not manage it. Track domains and subdomains registered by franchisees using your brand name, since these appear without warning and are a favourite target for impersonation. Run vulnerability scanning for multi-site estates against the addresses you know about, and require sites to report changes of internet provider so the list stays accurate. Publish a short security guide written for a shop manager rather than an engineer, because most of what goes wrong at site level is a default password or an unpatched router. Two sides of plain instructions get read, and a forty page policy does not.
Frequently asked questions about franchise security
These questions come up when a brand reviews its distributed estate.
Can head office test a franchisee’s systems?
Only with written permission from the business that owns them, which is why the right to audit or test belongs in the franchise agreement. Without it, testing those systems is unlawful regardless of the brand relationship.
