Hotel Cybersecurity Checklist
25 identity, network, supplier and compliance controls organised into four areas. See the full list below and download the PDF guide for why each item matters, how to assess your operation and the steps to fix it.
A technical PDF guide, free of vendor jargon, covering 25 controls linked to the failures that recur in public hotel incidents: identity and access, network and infrastructure, suppliers and integrations, and compliance with PCI DSS and the LGPD (Brazil's data protection law). For each one: why it matters, how to assess your operation and the steps to fix it.
What the guide covers
Identity and access
- Multi-factor authentication enabled on the PMS, corporate email and admin dashboards
- No logins shared between staff on PMS or POS systems
- Former employees' access revoked on the day they leave
- Monitoring for leaked credentials or credentials exposed on the dark web
- PMS and POS access restricted by role, with no admin permissions by default
- OTA extranet accounts (Booking.com, Expedia and similar) protected with MFA, and staff trained against targeted phishing
Network and infrastructure
- Guest Wi-Fi segmented and isolated from the operational network and the PMS
- POS terminal network isolated, within the defined PCI DSS scope
- Default credentials changed on TVs, locks and smart room devices
- Active vulnerability scanning beyond a standard firewall and antivirus
- Backups tested regularly, with a copy offline or isolated from the main network
- Endpoint detection and response (EDR) on front desk, back-office and finance computers
- Firmware on electronic locks and other IoT devices kept up to date
Suppliers and integrations
- Supplier contracts with clear security clauses and a right to audit
- Supplier access to the PMS and loyalty systems reviewed regularly
- Integrations between the PMS, booking engine and distribution channels audited
- Incident notification deadlines set in contracts with critical suppliers
- A central record of which suppliers have remote access to the hotel's systems
Compliance and incident response
- An up-to-date map of which guest personal data is collected and where it is stored
- An incident response plan that is documented and tested, not just written
- PCI DSS scope defined, with the SAQ or QSA assessment up to date
- A procedure ready to notify the ANPD, Brazil's data protection authority, within the 3 business days required by Resolution CD/ANPD No. 15/2024
- Phishing training updated to recognise AI-generated attacks
- Email authentication (SPF, DKIM and DMARC) configured on the hotel's domain
- Security monitoring with 24/7 coverage, usually through an external MDR service, not just alerts that nobody reviews
Why this matters
Hotels connect the PMS, POS terminals, guest Wi-Fi, smart room devices and supplier systems on a single operational network. Each category above is an entry point or lateral movement path already confirmed in real hospitality incidents, and the controls listed here address the failures that recur in those incidents.
Download the complete PDF guide for why each item matters, how to assess your operation and the steps to fix it. If you have already reviewed all 25 items and want to go further, talk to our hotel cybersecurity team about a full assessment of your operation.
Want a full assessment, not just the checklist?
Talk to our team and find out where the missing controls are in your operation.