Hotel business continuity: the infrastructure that keeps operations running

What must keep working

A contingency plan sets out what staff do when a system fails. This guide covers the other half: the infrastructure that keeps operations going, or at least buys the team time to act, when the neighbourhood loses power, the internet provider goes down or the group's head office is offline. Manual procedures, the digital FNRH (Brazil's guest registration form) during an outage and questions for each system are in our guide to a hotel IT contingency plan.

These scenarios are not hypothetical. On 3 November 2023, a storm left 2.1 million Enel customers without power in the São Paulo metropolitan area, and some homes and businesses were without electricity for days, according to Agência Brasil (in Portuguese).

The starting point is to list what the hotel cannot stop doing and what each function depends on. The table below is an example; your hotel's list depends on the systems it uses.

Almost everything runs through three shared points: power, the internal network (switches and Wi-Fi) and the internet. That is where redundancy pays off.

Power: UPS, generator and surge protection

UPS: type and size

A UPS keeps equipment running through a power cut and delivers stable power. There are three types: offline (standby), which only takes over when the power fails; line-interactive, which also corrects voltage swings; and online double conversion, which feeds the load through its inverter all the time, with no transfer gap. For the main rack, an online UPS gives the best protection against swings and short cuts; at front desk positions, a line-interactive unit may be enough.

Sizing depends on two figures: the power the load draws, in watts, and the runtime the hotel needs. With a generator, the UPS only needs to hold until the generator takes over, with headroom for a failed start. Without a generator, runtime decides how long the hotel has to shut down safely and switch to manual procedures. Ask the supplier for the calculation in writing, with the list of connected equipment.

Batteries wear out with age and heat. Record the installation date, follow the service life the manufacturer gives and test the actual runtime, because a UPS with worn batteries may not even cover the generator start. If the unit has a network card, turn on alerts for power loss and low battery.

What goes on the UPS

A frequent mistake is to protect the server and forget the path to it. If the floor switch or the provider's equipment shuts down, a running server does not help. Include:

• Firewall and routers, including those for the second link.
• The provider's equipment installed at the hotel (ONT, modem or router). Agree with the provider where it sits and how it is powered.
• Core switches and PoE switches, which power access points, IP phones and cameras.
• Floor rack switches serving the front desk, back office and critical areas.
• Front desk PCs and printers, the key encoder and the lock server.
• CCTV recorder, phone system and local server, if there is one.
• Card terminals and restaurant POS, if they need to keep selling.

Equipment that draws a lot of power and is not critical, such as high-volume printers and digital signage, stays off the UPS, because it eats into runtime.

Generator and automatic transfer

For outages lasting hours or days, only a generator keeps the hotel running. The technical point is the changeover: the generator takes a few seconds to start and pick up the load, and the UPS covers that gap. Transfer should be automatic, through an automatic transfer switch (ATS), so it does not depend on someone walking to the plant room in the middle of the night.

Three questions decide whether the generator covers IT: which circuits it feeds (the main rack, the front desk and the floor racks need to be on them), how many hours of fuel are in the tank and who refuels in a long outage, and when it was last tested under real load. The generator and transfer switch are electrical installations: design and installation belong with a qualified electrical engineer and installer. IT's role is to say what needs to be on the circuit and to check it during testing.

If the generator feeds the rack but not the server room air conditioning, temperatures rise and equipment can shut itself down in a long outage. Put the server room cooling on the generator circuit or monitor the temperature with alerts.

Surge protection

Power returning after an outage and lightning during storms can cause surges that burn out power supplies and boards. Surge protective devices (SPDs) in the distribution board, proper earthing and protection on metal cables entering the building reduce this risk. Here too, the electrician sizes and installs them.

Internet: two links that do not fail together

Two links only protect the hotel if they do not fail for the same reason. Two fibre contracts with different providers can arrive on the same pole, through the same duct or over the same wholesale network, and go down together with the same fallen tree or the same roadworks.

• Different providers, ideally with different technologies: fibre for the main link and 4G/5G, fixed wireless or satellite for the backup.
• Different physical routes to the building, with separate entry points where possible. Ask each provider how its cable reaches you.
• The backup link equipment also on the UPS and the generator.
• For a mobile link, an external antenna and a signal test where the equipment will sit, because basement server rooms can have weak signal.

Automatic failover

The firewall, or an SD-WAN solution, continuously checks whether the main link responds and, if it does not, moves traffic to the backup with no one stepping in. When the main link returns, traffic moves back. Without this, the second link sits idle until someone notices the outage and swaps a cable.

Two details prevent surprises. First, the public IP address changes on failover: if the cloud PMS, the payment system or the head office VPN only allow access from the main link's IP, register the backup link's IP too. Second, test what happens to open connections, such as calls and transactions in progress, at the moment of the switch.

Priority for operations

The backup link may have less bandwidth than the main one. Set priority rules (QoS) so the front desk, payments, phones and PMS get guaranteed bandwidth, and limit or suspend guest Wi-Fi, backups and automatic updates while the hotel is on the backup link. If the backup is mobile with a data cap, this rule also avoids an unexpected bill.

When the outage is regional

In a power cut that hits the whole area, a hotel with a generator keeps its own equipment running, but the provider's street equipment and the mobile towers rely on the provider's own batteries and generators, which may not last through a long outage. So in a regional blackout, both links can go down while the hotel itself is still running. A satellite link, which does not depend on local infrastructure, is the option for hotels that need connectivity in that scenario. For everything else, the offline operation described below applies.

Redundant equipment and spares

Once power and internet are covered, the weak point becomes the single device: the firewall, the core switch or the only PC that cuts keys. Redundancy can be active, with a second device taking over on its own, or cold, with a configured spare on the shelf.

• Firewall: a high-availability pair or, at minimum, a spare unit with the current configuration saved.
• Core switch: two stacked or redundant switches, with critical equipment connected to both where possible.
• Dual power supplies: on servers and switches with two supplies, connect each one to a different circuit or UPS.
• Spares on the shelf: a floor switch, a few access points, a configured front desk PC, a receipt printer and, if possible, a second key encoder.
• Configuration backups: an up-to-date copy of the firewall, switch and Wi-Fi controller configuration kept off the device, so a replacement takes minutes, not days.

A spare only helps if someone can install it. Document the swap step by step, or agree in writing with the supplier the on-site response time and the hours it applies.

Working without internet: PMS, keys, payments and phones

PMS

With a cloud PMS, no internet means no PMS. Ask the vendor whether there is an offline or read-only mode and, whatever the answer, produce a report of arrivals, departures, in-house guests and balances at regular intervals, for example at each shift change, saved on the front desk PC and printed. With it, the front desk keeps serving guests and posts everything later. Full procedures, including the digital FNRH, are in the contingency plan guide.

Locks and keys

Battery-powered card locks with no network connection keep opening with keys already cut. The weak point is cutting new keys: the encoder may depend on the lock server, the PMS or the internet. Confirm with the vendor whether the encoder can cut keys without the PMS, and keep a stock of cards and an emergency procedure. Mobile keys and online locks depend on the network and, in some cases, the internet, as our guide to mobile keys and digital check-in explains; have a plan for guests who only use a phone key.

Payments

Card terminals with a data SIM from a different provider than the hotel's keep taking payments when the hotel internet goes down, as long as the mobile network is up. Pix, Brazil's instant payment system, needs the internet and confirmation in the system; without it, the hotel has no safe way to verify payment, and accepting a receipt sent by message opens the door to fraud, as our guide to Pix booking fraud shows. If the restaurant POS issues NFC-e invoices in contingency mode, confirm with the vendor how that mode works and test it before you need it.

Phones

IP phones stop if the PoE switch shuts down, and a cloud phone system stops if the internet goes down. Keep at least one charged mobile phone at the front desk, with a number staff and guests know for emergencies, and check whether the phone system can divert calls to mobiles when it loses connection.

Life safety

Fire alarms, emergency lighting, lifts and emergency exits are building systems, with their own standards and responsible engineers, and are not part of IT. IT's job is not to create dependencies: a door that only releases through the access control system, or an alarm that only alerts by email, needs reviewing with whoever is responsible for the building.

When head office goes down

In hotel chains and groups, part of a hotel's IT may depend on head office or a group data centre. If head office loses power or internet, or suffers an attack, the hotels can stop with it, even with nothing wrong locally. Check four points:

• Internet breakout: if all hotel traffic goes over the VPN to head office before reaching the internet, a head office outage cuts access to the cloud PMS, payments and email. With local internet breakout for cloud systems, protected by the hotel's own firewall, operations continue.
• Sign-in: if staff accounts are only validated by a server at head office, sign-ins can fail. Consider a local domain controller, cached credentials on critical PCs or a cloud identity, plus securely stored local emergency accounts.
• Local services: the hotel's DHCP, DNS and printing should not depend on a remote server.
• Documents and contacts: contingency procedures, supplier contacts, support contracts and the extension list need to be at the hotel, printed or offline, not only on the head office intranet.

Beyond the technology, there is authority: the plan should say who at the hotel can authorise manual procedures, call in an emergency service or shut down a system when head office does not respond.

Cloud or on-premises: what changes

Neither model removes the risk; each moves it somewhere else. An on-premises system keeps working without the internet, as long as the server, network and server room have power, but backup, updates and security are the hotel's responsibility. A cloud system stays up when the hotel loses power, but the front desk loses access when the internet goes down.

Hotels tend to run a mix of both. The useful exercise is to mark, for each critical system, which column applies and what protection covers each row. For the attack risk, see our guide to ransomware in hotels.

Test before you need it

Contingency infrastructure that has never been tested is a gamble. Agree the tests with staff and suppliers, at a time of low occupancy:

• Cut the mains power: check what stays on, for how long, and whether the generator takes over on its own.
• Internet failover: disconnect the main link and check that the front desk, payments, phones and PMS keep working, and that everything switches back on its own when the link returns.
• Generator under load: test with the hotel's real load, not just an unloaded start, and check the fuel.
• UPS runtime: compare actual runtime with the calculated figure; if it has dropped a lot, the batteries are near the end of their life.
• Tabletop exercise: walk the front desk team through a night with no systems, from check-in to payment.

Run the tests at least once a year and after any significant change, such as a new internet provider, PMS or network equipment. Record the results and what was fixed.

Questions for your suppliers

1. Internet providers: how does the cable reach the building, what repair time is in the contract, and how long does the local network keep running in a power cut?
2. Network integrator: is failover configured and tested, are the backup link IPs registered with each system, and are the configurations backed up?
3. PMS vendor: is there an offline or read-only mode, and which reports can the front desk produce and keep?
4. Lock vendor: can the encoder cut keys without the PMS and without the internet?
5. Electrical maintenance: which circuits does the generator feed, how many hours of fuel does it hold, and when was it last tested under load?
6. Head office or group IT: what at the hotel depends on head office, and what happens if it goes offline?

Quick checklist

• UPS on the main rack, floor switches, front desk and the provider's equipment, with batteries within their service life.
• Generator with automatic transfer feeding IT and the server room cooling.
• SPDs and earthing reviewed by an electrician.
• Two links from different providers, routes and technologies, with tested automatic failover.
• Priority for operations and limits on guest Wi-Fi on the backup link.
• Configured spares and backups of the network configuration.
• PMS reports produced every shift and kept offline.
• Key encoder tested without the PMS, and card terminals with a data SIM.
• Local internet breakout and sign-in working without head office.
• Power, internet and generator tests at least once a year, with results recorded.

Next steps

The first step is to know where the hotel stands: which equipment is on the UPS, what the generator feeds, whether the second link is independent and what depends on head office. Our IT assessment maps these points in 2 to 4 weeks and delivers a prioritised list. HotelTI specifies what needs to be done, coordinates the suppliers and checks the result during testing; installation is carried out by the electrician, internet provider and integrator the hotel chooses. We do not resell software or hold agreements with specific suppliers. For ongoing support, our Virtual IT Manager keeps the plan, the tests and the suppliers up to date. Talk to our team.