Sample hotel IT assessment report
This is what the report at the end of an IT assessment looks like: findings in order of priority, a map of suppliers and contracts, recommendations by time frame and an initial roadmap so the board can decide where to invest first.
The hotel, the suppliers and the figures on this page are fictional. We put the example together to show the format and level of detail of the report, not to describe a client. Suppliers appear as A, B, C, and there are no amounts in reais: what each recommendation costs depends on the hotel and the quotes it receives.
The hotel in the example
An independent 140-room hotel in inland São Paulo state, with a restaurant, event rooms and an administrative office in the same building. Day-to-day IT is handled by an outsourced support company, and there is no IT manager. The board asked for the assessment after two booking engine failures in one quarter, and because three technology contracts expire within the next six months.
The assessment took three weeks: interviews with the board and the team, a review of documents and contracts, spot checks at the hotel and the final presentation.
Summary for the board
The report recorded 10 findings: 3 high priority, 4 medium and 3 low. The three high-priority findings make a security incident more likely or more damaging, and two of them can be fixed within a few weeks without buying equipment.
- The office server, which holds finance and the team's shared folders, is backed up, but nobody has tested a restore in the last 12 months. The PMS is in the cloud, and its contract does not say how quickly Supplier A recovers the data after a failure.
- Six former employees still have access to the PMS or email, and email does not use multi-factor authentication (MFA).
- In the restaurant, the POS terminals sit on the same network as guest Wi-Fi. That exposes the POS and widens the PCI DSS scope.
- The IT support contract renews automatically in March and has no measurable SLA. It is the contract with the most room to negotiate over the coming months.
Prioritised findings
Each finding shows the assessment area, what could happen if nothing changes, the priority and the estimated effort to fix it. Low effort means weeks and little or no purchasing; high effort means a project, a budget and a supplier.
| Finding | Area | Risk if nothing changes | Priority | Effort |
|---|---|---|---|---|
| Backup with no restore test, and no defined PMS recovery time | Security and compliance | After ransomware, the hotel may find the server backup does not work; if the PMS fails, it does not know when bookings and folios will be back | High | Low |
| Former employees' accounts active, and email without MFA | Access and data | Unauthorised access to guest data, and email accounts used for supplier payment fraud | High | Low |
| Restaurant POS on the guest Wi-Fi network | Network standards | A guest device can reach the card terminals, and the PCI DSS scope extends to the guest network | High | Medium |
| PMS and booking engine integration fails without an alert | Core systems and cloud | Wrong availability on the channels and overbooking, as in the two failures last quarter | Medium | Medium |
| Support contract with no measurable SLA and automatic renewal | Contracts, suppliers and costs | Another year with no defined response times and no basis for holding the supplier to account | Medium | Low |
| No incident response plan | Security and compliance | During an attack, the team does not know whom to call or what to switch off, while the 3-business-day deadline to notify the ANPD runs | Medium | Medium |
| 11 of 38 computers on an operating system without security updates | Assets, patching and hardening | Known vulnerabilities left unpatched, including on the front desk computer that manages the door locks | Medium | High |
| Copies of guest documents in a shared folder | Security and compliance | Personal data kept indefinitely and open to the whole team, while the LGPD calls for access control and disposal once the purpose ends | Low | Low |
| Software licences paid for with no user | Contracts, suppliers and costs | Nine office licences paid every month for accounts nobody uses | Low | Low |
| No separate IT plan or budget | IT strategy and governance | Technology purchases keep reacting to failures, with no link to the hotel's business plan | Low | Medium |
Supplier and contract map
Every active technology supplier, with the renewal date and what the contract says about response times. In a real report the suppliers appear by name.
| Service | Supplier | Renewal | SLA in the contract | Note |
|---|---|---|---|---|
| PMS (cloud) | Supplier A | August 2027 | Availability defined; data recovery time not defined | Support in business hours only, with no night cover for the front desk |
| Booking engine and channel manager | Supplier B | Monthly | Not defined | The PMS integration failed twice in the quarter |
| IT support | Supplier C | March, automatic | Not defined | 60 days' notice needed to stop the renewal |
| Internet | Supplier D | May | Repair time defined | Single link; no backup connection |
| Guest Wi-Fi | Supplier E | June | Not defined | The contract covers the network the POS terminals are on |
| Restaurant POS | Supplier F | Annual, automatic | Support in business hours | Integrated with the PMS to post charges to the room account |
| Electronic door locks | Supplier G | No maintenance contract | None | The software runs on an out-of-date front desk computer |
Recommendations by time frame
Short term: up to 3 months
- Test a restore of the server backup with Supplier C and repeat the test every quarter.
- Ask Supplier A, in writing, how long it takes to recover the PMS data after a failure.
- Remove the six former employees' accounts, turn on MFA for email and agree a leavers' checklist with HR.
- Separate the POS terminals from the guest network, with Supplier E.
- Tell Supplier C, before the notice deadline, that the hotel wants to renegotiate support with an SLA.
- Cancel the nine unused licences.
Medium term: 3 to 12 months
- Renegotiate or replace IT support, with response times by severity and a monthly report.
- Write a one-page incident response plan per scenario and test it with the team in a tabletop exercise.
- Ask Supplier B for an alert when the PMS integration stops.
- Replace or upgrade the 11 computers, starting with the front desk computer that manages the door locks.
- Decide which guest data the hotel keeps, where and for how long, and dispose of document copies that no longer serve a purpose. With the digital FNRH, the hotel no longer needs to keep copies for the guest registration form.
Long term: more than 12 months
- A three-year IT plan linked to the hotel's business plan, with its own budget.
- Consider a second internet link and a Wi-Fi replacement during the next floor renovation.
- An annual review of suppliers and contracts, ahead of the renewal dates.
Initial investment roadmap
The roadmap puts in order what needs money or a new contract. Amounts come later, with the suppliers' quotes; at this stage the board sees what needs budget, when, and of what kind.
| Item | When | Type of cost | Depends on |
|---|---|---|---|
| Restore test, MFA and account removal | Month 1 | No purchase; hours from current suppliers | Availability of Suppliers A and C |
| Separating the POS network | Months 1 to 2 | One-off service, possibly with a switch replacement | Quote from Supplier E |
| New support contract with an SLA | By March | Recurring; may replace the current fee | Renegotiation or quotes from other suppliers |
| Replacing or upgrading 11 computers | Months 3 to 9 | One-off purchase, can be phased | This year's budget |
| Incident response plan and exercise | Months 4 to 6 | Consulting hours | Team availability |
| Second internet link | From month 12 | Recurring | Technical availability at the address |
The board meeting
The report is presented to the board in a meeting, and the conversation ends with decisions. In this example, the board would need to decide:
- Whether to approve the short-term actions that need no purchase.
- Whether the hotel renegotiates support with Supplier C or gets quotes from other suppliers before the March renewal.
- How much to set aside in this year's budget for the computers and the POS network.
After that, the hotel can carry out the plan with its own team and current suppliers, or hire HotelTI to lead the work, for example as Virtual IT Manager. The assessment does not depend on that choice.
What this example leaves out
A real report is longer. It names the systems and suppliers, records what was checked for each finding and lists the documents behind each recommendation. The assessment is also not a formal certification audit, and we make no changes to the hotel's systems during the work.
Want a report like this for your hotel?
Talk to our team and book the initial assessment call.