---
title: "Managed hotel networks | DataRoad IT"
description: "Named PMS users, VLANs for guests, staff, payments and CCTV, PCI DSS without jargon and access closed on the day staff leave. No-obligation proposal."
language: en
url: https://www.dataroad-it.com/en/hotel-managed-network-vlans-pci-dss/
source: https://www.dataroad-it.com/en/hotel-managed-network-vlans-pci-dss/
publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal
---

> Named PMS users, VLANs for guests, staff, payments and CCTV, PCI DSS without jargon and access closed on the day staff leave. No-obligation proposal.

# Managed hotel networks: seasonal access, VLANs and PCI DSS

At a glance For decision-makers short on time.

- 01 One named user per employee in every system; no shared accounts at the front desk.
- 02 Guests, staff, operations, payments and CCTV on separate VLANs, with firewall rules.
- 03 Any hotel that accepts cards is covered by PCI DSS; leavers lose access the same day.

### In this article

For a hotel's management, high season brings a risk that rarely appears in the budget: dozens of new people logging into the systems within a few weeks, and many of them leaving without anyone cutting off their access. Control comes down to four decisions, a personal identity for every employee, permissions designed by role, a segmented network and a leaver protocol carried out on the same day, even when that day is a Sunday night.

## Where is the risk in a hotel at the height of the season?

In three characteristics that no other sector combines with the same intensity.

- **Teams that change all year round** Front desk, housekeeping, F&B and interns come and go continuously, with the biggest peaks between spring and summer.
- **A house that never closes** There are night shifts, weekends and public holidays when nobody from IT is in the building.
- **Critical information spread around** The PMS (the property management system, with bookings and guest records), card terminals, the reservations mailbox, CCTV and Wi-Fi.

The typical symptom is a generic user, something like "frontdesk1", shared by the whole team. With it, there is no longer any way of knowing who changed a booking, who issued a refund or who opened a guest's record. Worse: anyone who has left and knows that password keeps the door open from anywhere.

## What access should each role have?

The starting point is simple: one named user per person in each system, and only the permissions the job requires. A reference matrix:

| Role | In the PMS | In email | In payments | Wi-Fi network |
| --- | --- | --- | --- | --- |
| Front desk (seasonal contract) | Check-ins, check-outs and booking management | Accesses the shared front desk mailbox with their own user | Takes payments on the terminal; cannot void or refund | Staff |
| Front desk manager | As above, plus rates and corrections | Personal address | Can void and refund | Staff |
| Housekeeping and F&B | Room status or posting charges, where needed | Only when justified | None, or only the restaurant POS | Staff |
| Administration and management | Configuration and reports | Personal address protected by MFA | View and reconciliation | Administration |

The matrix is adjusted to each property's organisation chart. The principle stays the same: least privilege necessary.

### Does the reservations mailbox have to stop being shared?

No. The "reservations@" or "frontdesk@" address keeps working as always. The difference is in the access: each employee signs in with their own credentials and is given delegated access to that mailbox. On the day they leave, the delegation is removed, the mailbox and its history remain, and no password has changed hands.

Some credentials cannot be individualised, such as those for a tour operator's portal. For these, a [business password vault](https://www.dataroad-it.com/en/business-password-manager/) lets people use the password without seeing it and cuts access immediately. For management and for email, [two-step verification (MFA)](https://www.dataroad-it.com/en/mfa-business-14-day-plan/) is not optional.

## How do you isolate guests, staff, payments and CCTV?

With VLAN segmentation. Over the same cabling and the same access points run several logical networks that cannot see one another, like wings of a building with security doors between them. A guest's laptop is confined to its wing and has no path to the PMS, the terminals or the cameras.

The minimum configuration we recommend for a hotel has five segments:

- **Guest network** Internet access and nothing else.
- **Staff network** Staff smartphones and tablets, with its own password renewed whenever someone leaves.
- **Operational network** The PMS and front desk and back-office workstations.
- **Payments network** Terminals and POS, with communications reduced to what is strictly necessary.
- **Video network** Isolated CCTV, with image viewing restricted and logged.

The rules between segments are enforced by the firewall. We explain how a [DataRoad managed firewall](https://www.dataroad-it.com/en/managed-firewall-services-portugal/) works, and what a visitor network should have, in [how to protect business Wi-Fi and the guest network](https://www.dataroad-it.com/en/secure-business-wifi-guest-network/).

## What does PCI DSS require of a hotel?

PCI DSS sets out the security requirements for card data defined by the PCI Security Standards Council, a body founded by the card networks. The Council itself makes clear that it applies to any entity that stores, processes or transmits that data, regardless of size. Accepting cards is enough to be in scope; how to demonstrate compliance, when required, is determined by the bank that supplies the terminals.

Translated into a hotel's daily routine, the Council's guidance for merchants comes down to four practices:

- **Strong, personal credentials** on every system linked to payments.
- **Remote access by exception**: only when needed and always with MFA.
- **Software always up to date**: patches applied as soon as they are available.
- **Periodic inspection of terminals**: to spot physical tampering.

Isolating payments on a dedicated network reduces the exposed surface. The other three practices remain mandatory.

## What does this look like in a real hotel?

In Lisbon's Baixa, between Rossio and Restauradores, DataRoad - IT Services and Consulting manages the network of six properties: Ouro Rossio Hotel, LX Arch Rossio Hotel, Nicola Rossio Hotel, Rossio Plaza Hotel, BeHotel and BePoet Hotel. Each one's guest network is kept apart from operations, so a guest device cannot reach the PMS, POS, CCTV or back-office workstations. Video runs on a dedicated logical segment, sharing the physical cabling, and anyone viewing recordings is logged. [Discover the project across the six Baixa properties](https://www.dataroad-it.com/en/six-hotels-rossio-restauradores-managed-network/).

The [Ouro Rossio Hotel case](https://www.dataroad-it.com/en/ouro-rossio-hotel-managed-network-wifi-cctv/) gives a sense of scale: 6 floors, 30 access points, 55 cameras and 10 switches, with an enterprise firewall handling segmentation and traffic control according to each user's profile. Once the installation was complete, the hotel moved onto an IT Unlimited contract.

## What protocol should you follow when someone joins or leaves?

### Joining

- **Written authorisation** Issued by management, with the role and the expected end date.
- **PMS user** Named, with the role's profile.
- **Email account** Microsoft 365 or equivalent, with MFA, only if the role requires it.
- **Delegated access to the shared mailbox** No password sharing.
- **Staff Wi-Fi** And never the operational segment.
- **A 15-minute awareness session** Phishing, passwords and what to do when faced with an unusual request.

### Leaving, always on the same day

- **Block users** PMS and email deactivated, active sessions ended.
- **Remove delegations** Shared mailboxes and shared folders.
- **Close the vault** Password manager access withdrawn and any passwords the person knew renewed.
- **Renew the staff Wi-Fi password** When it is common to everyone.
- **Collect equipment** Cards, keys, alarm codes and devices.
- **Document** When it was done and by whom.

The condition that fails most often is "the same day". A departure at a hotel can happen on a Saturday at 11 pm, and the protocol only works if it is written down and the IT partner is available at that moment. This is the reality the [Premium 365 plan](https://www.dataroad-it.com/en/premium-365-24-7-managed-it/) exists for, with cover at night, at weekends and on public holidays.

## Frequently asked questions

### Is it possible to have a PMS user for each receptionist?

Yes, on most professional PMS platforms, which support named users with profiles. If your system does not allow it or you are short of licences, sort it out with the supplier before next season.

### Is changing the guest Wi-Fi password every month enough?

No. Real protection comes from segmentation: even knowing the password, a guest must have no path to the PMS, the terminals or the CCTV.

### Is a small hotel covered by PCI DSS?

Yes. The PCI Security Standards Council exempts no one on grounds of size; how compliance is demonstrated is defined by the bank providing the terminals.

### How long does implementation take?

Named users and the leaver protocol are ready within a few days. Segmentation depends on the current network and may involve reconfiguring the firewall and access points, work we schedule for the quietest hours.

## Next step: an access and network audit of your hotel in 10 working days

Before next season, we review PMS, email and Wi-Fi users, segmentation and the leaver protocol, and deliver the fixes in order of priority. No-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support. See how we approach [managed IT and networks for hospitality](https://www.dataroad-it.com/en/hotel-wifi-and-it-services/).

Call +351 211 459 950 * or write to sales@dataroad.pt.

**Call to a Portuguese landline.*

## Sources

- PCI Security Standards Council resources for merchants: [pcisecuritystandards.org](https://www.pcisecuritystandards.org/merchants/)

Chosen by respected and international companies

★★★★★ 5,0 · 52 Google reviews

★★★★★ 5,0 · 52 Google reviews

DataRoad

## Related articles

[Business Wi-FiHow many access points does your business Wi-Fi need?Too many access points waste budget; too few leave rooms without signal. Walls, density and usage weigh as much as floor area, and only a si…27 August 2026 · 3 min read](https://www.dataroad-it.com/en/enterprise-wifi-access-points-sizing/)[Business Wi-FiHotel Wi-Fi: from guest complaints to guest praiseA two-star review about Wi-Fi stays online for years. A well-designed hotel wireless network turns a reason to complain into a selling point…27 August 2026 · 2 min read](https://www.dataroad-it.com/en/business-wifi-hotels-guest-reviews/)[Business Wi-FiWi-Fi site survey: measure before investing in business wirelessA site survey measures the real Wi-Fi coverage of a space and tells you how many access points you need and where. It is the difference betw…27 August 2026 · 2 min read](https://www.dataroad-it.com/en/wifi-site-survey-enterprise-wireless/)[Business Wi-FiWi-Fi dead zones at work: measure, fix and manageA Wi-Fi dead zone almost always comes from poor network design, not a lack of equipment. Measure first with a site survey, then fix.27 August 2026 · 2 min read](https://www.dataroad-it.com/en/business-wifi-dead-zones-site-survey/)[Business Wi-FiHome router or business Wi-Fi: the 5 differences that matterA router that works at home is a single point built for a few devices. In the office, business Wi-Fi uses several managed access points, wit…27 August 2026 · 2 min read](https://www.dataroad-it.com/en/home-router-vs-business-wifi-office/)[Business Wi-FiNearshoring in Portugal: network and IT to head-office standardAn engineer who loses the connection mid-meeting with New York does not blame the carrier: they question the decision to come. The Portugues…17 August 2026 · 3 min read](https://www.dataroad-it.com/en/nearshoring-portugal-managed-it/)[Business Wi-FiUnstable business Wi-Fi: the 7 design mistakes behind itA poor wireless network rarely fails by bad luck: it fails the day it is installed. All seven mistakes share one origin, skipping the covera…17 August 2026 · 2 min read](https://www.dataroad-it.com/en/business-wifi-design-mistakes/)[Business Wi-FiManaged business Wi-Fi: why installing it is not enoughA network with no owner degrades in silence. With managed Wi-Fi you pay a fixed fee and get a service, not just equipment.17 August 2026 · 2 min read](https://www.dataroad-it.com/en/managed-business-wifi/)[Business Wi-FiIndustrial Wi-Fi for warehouses: designed for peak stockIn a logistics hall, Wi-Fi is the production line. A full warehouse does not behave like an empty one, so the network is measured and design…17 August 2026 · 2 min read](https://www.dataroad-it.com/en/industrial-wifi-warehouses-factories/)

Numbers you can verify

**11** years in business

**232** clients

**< 10 min** average response time

**15+** IT vendor certifications

**10+** Countries with clients supported

**5.0 ★** 52 Google reviews

Transparency

## What many providers hide, we publish.

[See plans and prices →](https://www.dataroad-it.com/it-unlimited/)

- **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200.
- **No lock-in** Annual contract, no lock-in and no joining fees.
- **Everything in writing** What is included, the scope and the price, before you sign.
- **Support without counted hours** Remote and phone in every plan; on-site support from Premium.

Partners and certifications

DataRoad · Industries

## One StepAhead of IT.

Hotels, clinics, embassies and multinationals trust us with their daily operation. Every industry has its rules and we already know them.

- **232** clients under management
- **0** DataRoad security incidents in 11 years
- **PT · EU · US** remote and on-site support

We do **IT** right.

DataRoad IT Unlimited

## Operational continuity is not luck. It is method and contract.

IT Unlimited reduces risk and shows in writing what changed.

[Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente)

---
Versão HTML desta página: https://www.dataroad-it.com/en/hotel-managed-network-vlans-pci-dss/