In this article
For a hotel's management, high season brings a risk that rarely appears in the budget: dozens of new people logging into the systems within a few weeks, and many of them leaving without anyone cutting off their access. Control comes down to four decisions — a personal identity for every employee, permissions designed by role, a segmented network and a leaver protocol carried out on the same day, even when that day is a Sunday night.
Where is the risk in a hotel at the height of the season?
In three characteristics that no other sector combines with the same intensity.
- Teams that change all year round Front desk, housekeeping, F&B and interns come and go continuously, with the biggest peaks between spring and summer.
- A house that never closes There are night shifts, weekends and public holidays when nobody from IT is in the building.
- Critical information spread around The PMS (the property management system, with bookings and guest records), card terminals, the reservations mailbox, CCTV and Wi-Fi.
The typical symptom is a generic user, something like "frontdesk1", shared by the whole team. With it, there is no longer any way of knowing who changed a booking, who issued a refund or who opened a guest's record. Worse: anyone who has left and knows that password keeps the door open from anywhere.
What access should each role have?
The starting point is simple: one named user per person in each system, and only the permissions the job requires. A reference matrix:
| Role | In the PMS | In email | In payments | Wi-Fi network |
|---|---|---|---|---|
| Front desk (seasonal contract) | Check-ins, check-outs and booking management | Accesses the shared front desk mailbox with their own user | Takes payments on the terminal; cannot void or refund | Staff |
| Front desk manager | As above, plus rates and corrections | Personal address | Can void and refund | Staff |
| Housekeeping and F&B | Room status or posting charges, where needed | Only when justified | None, or only the restaurant POS | Staff |
| Administration and management | Configuration and reports | Personal address protected by MFA | View and reconciliation | Administration |
The matrix is adjusted to each property's organisation chart. The principle stays the same: least privilege necessary.
Does the reservations mailbox have to stop being shared?
No. The "reservations@" or "frontdesk@" address keeps working as always. The difference is in the access: each employee signs in with their own credentials and is given delegated access to that mailbox. On the day they leave, the delegation is removed — the mailbox and its history remain, and no password has changed hands.
Some credentials cannot be individualised, such as those for a tour operator's portal. For these, a business password vault lets people use the password without seeing it and cuts access immediately. For management and for email, two-step verification (MFA) is not optional.
How do you isolate guests, staff, payments and CCTV?
With VLAN segmentation. Over the same cabling and the same access points run several logical networks that cannot see one another — like wings of a building with security doors between them. A guest's laptop is confined to its wing and has no path to the PMS, the terminals or the cameras.
The minimum configuration we recommend for a hotel has five segments:
- Guest network Internet access and nothing else.
- Staff network Staff smartphones and tablets, with its own password renewed whenever someone leaves.
- Operational network The PMS and front desk and back-office workstations.
- Payments network Terminals and POS, with communications reduced to what is strictly necessary.
- Video network Isolated CCTV, with image viewing restricted and logged.
The rules between segments are enforced by the firewall. We explain how a DataRoad managed firewall works, and what a visitor network should have, in how to protect business Wi-Fi and the guest network.
What does PCI DSS require of a hotel?
PCI DSS sets out the security requirements for card data defined by the PCI Security Standards Council, a body founded by the card networks. The Council itself makes clear that it applies to any entity that stores, processes or transmits that data, regardless of size. Accepting cards is enough to be in scope; how to demonstrate compliance, when required, is determined by the bank that supplies the terminals.
Translated into a hotel's daily routine, the Council's guidance for merchants comes down to four practices:
- Strong, personal credentials on every system linked to payments.
- Remote access by exception — only when needed and always with MFA.
- Software always up to date — patches applied as soon as they are available.
- Periodic inspection of terminals — to spot physical tampering.
Isolating payments on a dedicated network reduces the exposed surface. The other three practices remain mandatory.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
What does this look like in a real hotel?
In Lisbon's Baixa, between Rossio and Restauradores, DataRoad - IT Services and Consulting manages the network of six properties: Ouro Rossio Hotel, LX Arch Rossio Hotel, Nicola Rossio Hotel, Rossio Plaza Hotel, BeHotel and BePoet Hotel. Each one's guest network is kept apart from operations, so a guest device cannot reach the PMS, POS, CCTV or back-office workstations. Video runs on a dedicated logical segment, sharing the physical cabling, and anyone viewing recordings is logged. Discover the project across the six Baixa properties.
The Ouro Rossio Hotel case gives a sense of scale: 6 floors, 30 access points, 55 cameras and 10 switches, with an enterprise firewall handling segmentation and traffic control according to each user's profile. Once the installation was complete, the hotel moved onto an IT Unlimited contract.
What protocol should you follow when someone joins or leaves?
Joining
- Written authorisation Issued by management, with the role and the expected end date.
- PMS user Named, with the role's profile.
- Email account Microsoft 365 or equivalent, with MFA, only if the role requires it.
- Delegated access to the shared mailbox No password sharing.
- Staff Wi-Fi And never the operational segment.
- A 15-minute awareness session Phishing, passwords and what to do when faced with an unusual request.
Leaving, always on the same day
- Block users PMS and email deactivated, active sessions ended.
- Remove delegations Shared mailboxes and shared folders.
- Close the vault Password manager access withdrawn and any passwords the person knew renewed.
- Renew the staff Wi-Fi password When it is common to everyone.
- Collect equipment Cards, keys, alarm codes and devices.
- Document When it was done and by whom.
The condition that fails most often is "the same day". A departure at a hotel can happen on a Saturday at 11 pm, and the protocol only works if it is written down and the IT partner is available at that moment. This is the reality the Premium 365 plan exists for, with cover at night, at weekends and on public holidays.
Frequently asked questions
Is it possible to have a PMS user for each receptionist?
Yes, on most professional PMS platforms, which support named users with profiles. If your system does not allow it or you are short of licences, sort it out with the supplier before next season.
Is changing the guest Wi-Fi password every month enough?
No. Real protection comes from segmentation: even knowing the password, a guest must have no path to the PMS, the terminals or the CCTV.
Is a small hotel covered by PCI DSS?
Yes. The PCI Security Standards Council exempts no one on grounds of size; how compliance is demonstrated is defined by the bank providing the terminals.
How long does implementation take?
Named users and the leaver protocol are ready within a few days. Segmentation depends on the current network and may involve reconfiguring the firewall and access points, work we schedule for the quietest hours.
Next step: an access and network audit of your hotel in 10 working days
Before next season, we review PMS, email and Wi-Fi users, segmentation and the leaver protocol, and deliver the fixes in order of priority. No-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support. See how we approach managed IT and networks for hospitality.
Call +351 211 459 950* or write to sales@dataroad.pt.
*Call to a Portuguese landline.
Sources
- PCI Security Standards Council resources for merchants: pcisecuritystandards.org
