What proof of PCI-DSS compliance status must a Cinnabon franchisee submit, and how often?

According to Cinnabon's 2025 Franchise Disclosure Document, franchisees must submit proof of their PCI-DSS compliance status annually. Cinnabon may also request evidence of compliance with applicable Privacy Requirements at any time. PCI-DSS refers to the Payment Card Industry Data Security Standards, which are enacted by applicable Card Associations. These standards may be modified over time or as successor standards are adopted.

In addition to submitting proof of compliance, Cinnabon franchisees are obligated to operate their franchised business in accordance with all applicable laws, including those related to labor, health, and safety. Franchisees must research and ensure their operations comply with various federal laws such as the ADA, CAN-SPAM Act, FACTA, and laws regulating data security and privacy. Franchisees must also comply with all laws and standards applicable to electronic payments that may be published by payment card companies.

Cinnabon may require franchisees to use specific vendors or approved suppliers to provide security services that align with Privacy Requirements. Currently, franchisees are required to use a managed firewall, conduct quarterly network scans, maintain anti-virus/anti-malware software, and use managed Wi-Fi. However, Cinnabon retains the right to modify these specific security measures.

Furthermore, Cinnabon may require franchisees to undergo periodic security audits conducted by approved vendors or suppliers to ensure adequate protection of personal data. Franchisees may also be required to provide copies of audits, scanning results, or related documentation to Cinnabon. Cinnabon may charge a reasonable fee, not exceeding 110% of their actual costs, to review systems and verify compliance with these requirements.