How long does a Petro Stopping Center franchisee have to provide answers to a risk assessment questionnaire?
Petro_Stopping_Center Franchise · 2025 FDDAnswer from 2025 FDD Document
You must comply in all respects with the information security standards set forth in the Petro System Standards. We have the right to complete an initial security review, including a risk assessment questionnaire. If a risk assessment questionnaire is requested, you must provide back answers within a reasonable timeframe, but no more than 20 calendar days from the date of our request. We may periodically perform security reviews. If any security review identifies any deficiencies, you will, at your sole cost and expense, promptly take all actions necessary to remediate those deficiencies. You will inform us within 48 hours of detecting an actual or suspected security incident, as defined as the act of violating an explicit or implied security policy or security requirement. You will inform us within 24 hours of detecting an actual or suspected security breach, as defined as a security incident that results in unauthorized access of data, applications, services, networks, and/or devices. In the event of a security incident or security breach, you will fully cooperate and provide us the necessary information and resources to perform a thorough investigation.
Source: Item 11 — FRANCHISOR'S ASSISTANCE, ADVERTISING, COMPUTER SYSTEMS, AND TRAINING (FDD pages 44–53)
What This Means (2025 FDD)
According to Petro Stopping Center's 2025 Franchise Disclosure Document, if Petro Stopping Center requests a risk assessment questionnaire, a franchisee must provide answers within a reasonable timeframe, but no more than 20 calendar days from the date of the request.
Petro Stopping Center has the right to complete an initial security review, including this risk assessment questionnaire. They may also periodically perform security reviews. If any security review identifies any deficiencies, the franchisee will be responsible for taking all necessary actions to fix those deficiencies at their own cost.
Furthermore, franchisees must inform Petro Stopping Center within 48 hours of detecting a security incident, which is defined as violating a security policy or requirement. They must also inform Petro Stopping Center within 24 hours of detecting a security breach, which is a security incident resulting in unauthorized data access. In the event of a security incident or breach, franchisees must fully cooperate and provide the necessary information and resources for a thorough investigation.