By Matt Dossey, Product Specialist Manager, Jonas Club Software
This article first appeared in Club Director, published by the National Club Association.
Private clubs hold more sensitive data than many leaders recognize, including member payment details, health information from youth camps, employee records, and guest data from international visitors. Yet, compliance is often treated as an occasional task rather than an ongoing operating responsibility. The greatest exposure lies in the gap between what a club believes it is doing and what it can demonstrate it is doing. That gap is increasing consequentially as AI-assisted attacks have accelerated the exploitation of software vulnerabilities from nearly one year in 2021 to a matter of hours in 2026.
At Avalon Yacht Club, General Manager Joseph Mendez operated his club as it was covered. “I assumed that we were minimally compliant. I was confident with Jonas and the cloud hosting, but not so much outside of that. I assumed my firewall and managed IT provider had us covered,” he said. A compliance assessment told a different story: an overall grade of D, with six gaps the club’s cyber insurer would likely flag during a claim review.
From AI Tools to Seasonal Staff Access: Where the Gaps Actually Hide
Compliance blind spots arise when a club’s practices don’t meet regulatory, insurance or industry requirements, and are rarely deliberate. Most emerge when compliance is addressed only during audits or renewals, rather than managed continuously.
Common blind spots include partially enforced multi-factor authentication, seasonal employee accounts left active, unverified insurance controls, and vendors with unchecked system access. AI use adds another risk: staff may enter member and financial details into AI tools without a policy defining acceptable use.
Avalon Yacht Club’s assessment surfaced several examples: no seasonal staff offboarding policy, unanswered questions on the club’s cyber insurance questionnaire, a marina vendor that had never received a security questionnaire, and employees permitted to change their own access passwords.
Why They Go Unnoticed
General managers balance food and beverage, membership, facilities, and staffing, leaving compliance until an auditor or insurer asks. Meanwhile, requirements change, and smaller clubs may rely too heavily on managed providers and firewalls without dedicated security oversight.
Turning Findings into Action
Closing blind spots begins with assessing current practices against recognized standards, identifying gaps, prioritizing actions, and documenting evidence. This assessment yields findings that need an owner, a completion date, and a method for verifying that the control remains in place. Otherwise, the gap analysis can become another static document rather than an operating procedure that is repeatable.
With the right expertise and policy tools, remediation can move quickly. Avalon Yacht Club created a seasonal staff offboarding policy in under five minutes, closed the three unanswered items on its insurance questionnaire, and sent its marina vendor a security questionnaire for the first time. Mendez called the rapid development of procedures “a game changer for a smaller club without a significant in-house team.”
The Insurance Question Most Clubs Can’t Answer
Many clubs sign off on insurance applications confirming they meet specific security conditions without verifying that their practices align. The discrepancy may only surface at claim time, when the club must demonstrate that the required controls were in place. Without this evidence, insurers can deny payment for claims. For that reason, club leaders should compare internal policies against the specific language of an insurance policy before renewal, not after an incident.
From Assumption to Assurance
Compliance blind spots are usually the byproduct of limited time, competing priorities, and requirements that change faster than most operators can track. Clubs that manage this risk most effectively treat compliance as a continuous process, built on regular assessment and a habit of revisiting policy against current standards. One club’s grade moved from a D to a B and then to an A on its next assessment, of demonstrating what consistent attention can accomplish.
Avalon Yacht Club’s experience offers a practical example of how a structured assessment can uncover overlooked risks and support measurable improvements.
Visit our website to read the full story and get a free assessment for your club: jonasclub.com/compliance