Hotel cybersecurity checklist for owners and general managers
A practical hotel cybersecurity checklist for owners and general managers. It covers accounts, devices, network separation, backups, staff training, and a one-page incident plan.
Contents
Key takeaways
- A hotel's realistic risk is money and disruption, not espionage: a changed supplier bank account, a locked front desk, a stolen guest list.
- A login shared by a whole shift cannot be audited, so nobody can say who cancelled the reservation or changed the rate.
- A backup that has never been restored is a hope, not a backup; the copy must sit away from the property and survive the systems being locked.
- Any change of bank details is confirmed by a phone call to a number you already had, never to the number printed in the message.
- The bad-day plan fits on one printed page: who calls whom, how the hotel works on paper, and what guests are told.
Hotel cybersecurity is the set of controls that keep a hotel's bookings, guest data and money out of the wrong hands: one login per person with two-step sign-in, supported and updated devices, guest Wi-Fi separated from staff and payment systems, backups copied away and tested, controlled remote access, trained staff and a one-page plan for the day systems are locked.
The reception computer is six years old, the front desk login is shared by the whole shift, and the booking extranet password is on a note stuck to the monitor. None of this shows up in a guest review. All of it shows up on the morning the systems stop. This article gives you a checklist you can run without an IT department: seven areas, the question to ask in each, and the order to fix things in.
What does hotel cybersecurity actually cover?
It covers seven things, and only one of them is technical: who can log in, whether devices are still supported, how the network is split, whether backups can be restored, who has remote access, what staff do with a suspicious message, and what happens on the bad day.
The realistic threat for a hotel is money and disruption: a supplier invoice with new bank details, a locked front desk in high season, a copied guest list, a cancelled reservation nobody can explain. Four data sets carry most of the risk: guest identity and contact data, payment and billing records, reservations and rates, and staff accounts that reach all three.
A hotel without an IT department still has an IT provider. Your job is not to configure anything; it is to ask seven questions and read the answers. The decision rule is simple: if a question below cannot be answered in one sentence, that is the item to fix first, whatever else is on the list.
In Türkiye every stay involves a payment, a fiscal document (an invoice or e-document), a guest identity notification (KBS) and personal data (KVKK), so a locked system is also a compliance problem, not only an operational one. Confirm your own duties with your accountant and legal adviser.
Use the table below as the agenda for one meeting with your IT provider, and ask for written answers you can keep.
| Area | What good looks like | The question to ask your IT provider |
|---|---|---|
| Accounts | One login per person, two-step sign-in on email, PMS and extranets | "Show me the list of active accounts and when each was last used." |
| Devices | Supported operating systems, automatic updates | "Which computers here no longer receive security updates?" |
| Network | Guest Wi-Fi separate from staff, PMS and payment terminals | "Is the guest network on the same segment as the front desk?" |
| Backups | A copy held away from the property, restore tested | "When did we last restore a backup, and how long did it take?" |
| Remote access | Named people, logged sessions, removed on exit | "Who outside this building can log in to our systems right now?" |
| People | Staff recognise fake booking messages and invoice changes | "When did we last run a short session on suspicious messages?" |
| Bad day | One page, named people, paper fallback | "Where is the one-page plan, and who keeps a printed copy?" |
Who can log in, and how do you know it is them?
Every person gets their own login, and every login that can reach money, guest data or rates has a second step: a code from a phone, not a password alone.
A shared reception login destroys the record. When a rate is changed or a reservation is cancelled, the system shows an account, not a person. Two-step sign-in (also called two-factor or 2FA) belongs on the email inbox, the PMS, every booking extranet, the bank and the e-invoice portal.
Email is the master key: password resets for everything else arrive there, so protect it first and hardest. Booking extranets deserve the same care as the PMS. A takeover there can create or cancel bookings and expose guest details, and the damage is visible to travelers before it is visible to you.
Leavers matter as much as joiners. Write account closure into the exit process and do it the same day, including the extranet, the bank's user list and any group chat that carries operational instructions. For passwords: one unique password per site, kept in a password manager, never in a notebook at the desk or a message to a colleague. For a fuller setup guide, see PMS user roles and permissions: a setup checklist for hotels.
Watch outThe shared shift login
An account used by six people is an account nobody owns. It can delete a reservation, move a rate or export the guest list, and no record will say who did it. One login per person costs a few minutes of setup and buys you an answer to "who".
Are the computers at the front desk still supported?
If a machine no longer receives security updates from its maker, it is a known open door, and antivirus does not close it. The fix is replacement, planned in the budget.
Walk the property and list every machine that touches guest or payment data: reception, back office, restaurant till, housekeeping tablet, the manager's laptop, the PC that runs the door-lock software. An unsupported operating system is a published list of weaknesses. Attackers do not need to be clever to use it, and no antivirus compensates for a system the maker has stopped patching.
Turn automatic updates on, then agree a restart window with the front office manager that avoids check-in and check-out peaks. Inventory the software: what is installed, who installed it, whether it is still needed, and remove remote-control tools nobody uses any more. The USB stick that carries the night audit report between machines is a device too. Decide where it may be plugged in, and where it may never be.
Checklist
- Walk every desk and back office and write down each machine's operating system and age.
- Mark any machine whose maker no longer issues security updates.
- Turn on automatic updates and set a restart window outside peak hours.
- List every USB stick and external disk used at the desk and decide where each may be plugged in.
- Remove software nobody uses, especially remote-control tools.
- Write a replacement year next to each machine in the budget.
Is guest Wi-Fi separated from the systems that take payments?
It is only separated if a guest laptop cannot reach the PMS, the payment terminal or the door-lock server. Sharing one network with guests puts a guest laptop on the same segment as the PMS, the payment terminal and the door-lock server.
A network segment (often called a VLAN) is a wall inside the same cabling. Guest Wi-Fi goes on one segment, staff devices on another, PMS and payment terminals on a third. The guest network must not reach the PMS, the office printer, the network storage or the door-lock system. Ask the provider to show this by testing it, not by describing it.
Change the guest Wi-Fi password on a schedule and whenever a staff member leaves; one password shared with every guest is a shared credential. On the router and firewall: change the default administrator password, switch off administration from the internet, keep the firmware updated.
Remote access belongs in this section. List every outside party who can connect in (PMS vendor, door-lock vendor, till provider, internet provider), how they connect, whether sessions are logged, and whether access is switched off between visits.
TipAsk for one page
Which devices sit on which network, and what each network is allowed to reach. A diagram you can read is worth more than a policy you cannot, and it makes the next conversation with a vendor much shorter.
Do your backups survive the day the systems are locked?
Only if a copy exists away from the property, cannot be deleted by whoever locked the systems, and has been restored at least once with the time written down.
The practical test is not the backup schedule, it is recovery: with the building's systems unusable, can you rebuild reservations, guest bills and the arrival list, and how long does it take? Ransomware reaches connected drives, so the copy must be offline, append-only, or held by a provider with its own retention that a stolen password cannot wipe.
Test the restore, not the backup. Pick a date, restore to a spare machine, time it, and write the result and the date on one page. If the PMS is cloud-based, ask the vendor in writing about backup frequency, retention, where copies are held, and how one hotel's data is restored without touching other hotels' data. The same question applies to any system you share with other properties; see how each hotel's data stays apart in multi-tenant hotel software.
Keep a daily paper or exported fallback: today's arrivals, in-house guests, departures, and the balances on open guest bills, stored where the duty manager can find it without a login. Name two people who may authorise a restore at two in the morning, and give the provider their names in advance.
Key pointA backup you have never restored is a hope, not a backup
The only evidence that matters is a dated note saying what was restored, onto which machine, by whom, and how long it took.
For the wider question of running the desk when systems are down, see when the internet goes down: a front desk checklist.
Would your team recognise a fake booking message?
Most incidents start with a message a person believes: a booking enquiry with a link, an invoice with new bank details, or an extranet login page that is not the extranet.
Three shapes cover most of it: a fake reservation enquiry carrying a link or attachment, a supplier invoice whose bank details have changed, and a message that appears to come from the owner or general manager asking for a payment or a password. The last category is covered in more detail in fake booking messages and extranet takeovers.
The callback rule: any change of bank details is confirmed by a phone call to a number you already had on file, never to the number in the message. Make this a written rule and repeat it to the accounts team. For extranet logins: type the address yourself or use a saved bookmark, never a link from a message. A copied login page looks exactly like the real one.
Short and repeated beats long and annual: ten minutes at the shift handover, one real example, and the three actions (do not click, tell the duty manager, keep the message). Agree what staff may paste into AI chat tools; guest names, passport details and rate sheets do not belong in a public chat window, and a short written rule is enough to start.
Make reporting safe. Nobody should be punished for reporting a click quickly; the cost grows with every hour it stays quiet.
What is the one-page plan for the day the systems are locked?
One page, printed, kept at the front desk: who calls whom, how the hotel keeps working on paper, and what guests are told.
Block one, stop and preserve: do not wipe machines, do not pay anything, do not restart systems repeatedly. Take advice before acting, from your IT provider and your insurer. Block two, the call list: IT provider, general manager, owner, insurer, bank and legal adviser, with names and numbers, in that order or your own.
Block three, the paper procedure: arrivals, departures, room assignment, charges written on a numbered sheet so the night audit can be rebuilt later, and a named person who reconciles it afterwards. Block four, one voice: decide in advance who speaks to guests and who speaks to the press, and what the first sentence to a guest is. Block five, personal data: a suspected breach brings notification duties, and the timing, addressee and form are questions for your lawyer, so write the question down now and write the name of the person who answers it.
Rehearse once: a thirty-minute table exercise with the front office manager, no systems, one scenario. Afterwards, a short written review and an updated page.
Checklist
- The stop-and-preserve instruction in three lines.
- The call list with names and numbers, including insurer and legal adviser.
- The paper procedure for arrivals, departures and charges.
- The approved first sentence for guests and the name of the only person who speaks.
- The personal data question and who answers it.
- The date of the last rehearsal and of the next one.
What to do next
Take the seven-row table from the first section into one meeting with your IT provider and ask for written answers. Then fix in this order: two-step sign-in on email and every extranet, a backup that has been restored once with the date written down, and the oldest unsupported machine at the desk. The rest of the list holds together only when those three do, because accounts, devices and backups are what turn a bad day into a recoverable one.
Frequently asked questions
Do small hotels really get targeted by cyber attacks?
Most attacks are opportunistic and automated, not personal: exposed logins, unsupported machines and fake invoices are tried at scale. A small property is reachable through its email, its booking extranets and its supplier payments, so the question is not whether anyone chose you but whether your doors are open. The checklist treats this as a maintenance problem, not a spy story.
Is antivirus software enough for a hotel?
No. Antivirus helps with known files, but it does not fix an unsupported operating system, a shared reception login, a guest network that reaches the PMS, or a backup drive that is plugged in and encryptable. Treat it as one layer among the seven in this article, and never as a substitute for updates and tested backups.
If we move to a cloud PMS, is security the vendor's job?
Partly. The vendor is responsible for the platform, its availability and its own backups; the hotel remains responsible for who has accounts, what devices staff use, what staff click on, and what the contract says about backup frequency, retention and restore time. Ask those questions in writing before signing, and ask how one hotel's data is restored without touching others.
What should a hotel with a small budget fix first?
Three things, in order: two-step sign-in on email and every booking extranet, one restored and dated backup held away from the property, and replacement of the oldest unsupported machine at the front desk. All three are cheap next to a closed front desk in high season, and each one closes a door that is otherwise open all year.
Do we need a certification such as ISO 27001 or PCI DSS?
These are worth asking your software and payment providers about, and a provider that claims one should show the certificate and the scope it covers. Whether your own property carries an obligation depends on your contracts, your bank and your payment setup, so confirm it with your legal adviser and your acquirer rather than treating a badge as the goal. The practical controls in this checklist matter more day to day than a certificate on a wall.