Access and permissions
Owner, Administrator and QA Tester roles are enforced on the server. Owners alone manage accounts and access changes.
Security and assurance
Clear controls. Honest readiness.
This public overview describes the security controls built into the SM Hotels and Conventions website and the work still required for formal vendor assurance.
SOC 2 Type IINot currently attestedReviewed 17 September 2026
Important: This is a point-in-time technical and vendor-readiness overview. It is not a SOC 2 report, certification, penetration-test result, legal opinion or guarantee of security. Detailed evidence and sensitive security material are not published on this page.
01 · Scope
What this overview covers.
The report covers this public website, its branded content administration area, the contact form, consent controls and the supporting website data services.
It does not assess external hotel or convention-center websites, booking engines, payment services, office networks, employee endpoints or third-party systems after a visitor follows an external link.
02 · Current technical controls
Controls currently built into the website.
These controls are implementation statements, not a substitute for independent validation or operating evidence.
Account protection
Administrative passwords require 15 or more characters, complexity, password history checks, slow salted hashing, sign-in throttling and account lockout controls.
Session management
Administrative sessions use opaque, revocable tokens in Secure, HttpOnly, SameSite cookies. Password changes and access resets revoke active sessions.
Input and upload controls
Public and administrative inputs are validated server-side. Media and QA evidence uploads are limited by type, size and metadata validation.
Change accountability
Administrative activity, account changes and publishing actions are recorded for operational review.
Privacy and analytics
Analytics remain disabled until a visitor accepts optional analytics cookies. Visitors can review or change their preference from the footer.
03 · Vendor-risk alignment
What remains before formal assurance.
Aligned to the SMHCC Vendor Risk Management and Security Review Guidelines, reviewed 17 September 2026.
Contractual confirmation required
IP ownership and handover
Once final handover is complete and subject to the executed governing agreement, the custom project source code, design assets, project content, repositories, administrator access and deployment documentation transfer to and are controlled by SMHCC or the relevant SM entity named in that agreement. Third-party software, services and licences remain subject to their own terms.
Not currently attested
Independent SOC 2 Type II report
A formal Type II examination must be performed by an independent licensed CPA firm over an agreed evidence period.
Required before vendor sign-off
Multi-factor authentication
The current role-based sign-in is password protected. MFA for owner and administrator accounts should be enabled through an approved identity solution before production acceptance.
Required before major release
Independent VAPT
Commission an independent vulnerability assessment and penetration test, then track remediation to closure.
Contractual action
Data Processing Agreement
SMHCC and the delivery vendor should execute a DPA that defines processing purpose, retention, subprocessor obligations and data-subject handling.
Contractual action
Incident response and notification
Agree an incident response playbook, named contacts, escalation route and a 24 to 72 hour notification commitment.
Contractual action
Service and offboarding terms
Set support SLA, patch timelines, secure vendor offboarding, subcontractor terms, cyber insurance and E&O requirements.
Evidence required
Third-party assurance
Maintain an approved vendor register and obtain current assurance documentation for in-scope hosting, identity, analytics and storage providers.
Formal review required
Accessibility and privacy review
Automated checks support the build, but an independent WCAG 2.2 AA review and legal approval against the Philippine Data Privacy Act remain required.
Evidence required
Open-source and AI governance
Keep a software bill of materials, dependency scan results, licence review and an approved record of AI-assisted development and human review.
04 · Recommended path
From readiness to independent assurance.
A SOC 2 Type II engagement becomes appropriate once the operating model, responsible parties and evidence period are defined.
- 01
Approve the production scope, data flows and vendor inventory.
- 02
Enable MFA for privileged accounts and document the complementary user controls SMHCC will own.
- 03
Complete independent VAPT and remediate verified findings before the next major release.
- 04
Execute the DPA, SLA, breach-notification terms, IP ownership and offboarding schedule, including the final SMHCC handover record.
- 05
Collect platform assurance documentation and establish a recurring vendor-review calendar.
- 06
Engage a licensed CPA firm when SMHCC is ready to define the SOC 2 scope and observation period.
05 · VAPT readiness
Ready for an independent assessment.
SM Hotels and Conventions has prepared an assessor handover pack that defines the approved website scope, safety rules, temporary-access approach, evidence checklist and remediation process for a vulnerability assessment and penetration test.
The detailed pack is shared securely with qualified assessors after scope, timing and written authorization are agreed. It is not published because it contains engagement procedures intended only for the assessment team.
Request the assessor pack →