Tourism IT Checklist
Key IT, privacy, payments, Wi‑Fi, and continuity checkpoints for NZ tourism & hospitality operators
Purpose: This checklist helps accommodation providers, tour operators, attractions, and hospitality venues assess their IT readiness. Use it to prepare for audits, protect guest data, harden Wi‑Fi and payment flows, and reduce operational risk.
Governance & Operations
- Named Privacy/Security Lead and Board/Owner oversight of IT risks
- Acceptable Use, Remote Access, and BYOD policies in place and communicated
- Staff onboarding/offboarding checklists (accounts, keys, devices) enforced
- Supplier governance for PMS, OTA, gateway, Wi‑Fi managed service, and marketing partners
- Annual training (privacy, phishing, POS abuse) with tracked completion
Guest Data & Privacy (Privacy Act 2020)
- Collect only necessary guest data; purpose explained at booking/check‑in
- Consent captured and managed for marketing communications; easy opt‑out
- Retention schedule defined; secure deletion/archival of guest records
- Right‑to‑access/correction process with identity verification and response SLAs
- Breach‑response plan with OPC notification thresholds and guest comms templates
PMS, Booking Engine & Channel Managers
- Role‑based access and MFA enabled; shared logins eliminated
- Rate/inventory sync monitored; API credentials rotated and scoped
- Audit logs retained/reviewed for suspicious access or rate changes
- Daily backups/exports of reservations and folios; restore tests performed
- Downtime plan for check‑in/out (offline folios, manual receipts)
Payments & PCI DSS
- Payment flows documented: POS, online gateway, MOTO/phone bookings
- Appropriate SAQ maintained; ASV scans scheduled; CDE segmented
- Tokenisation where possible; no storage of PAN or CVV; masking rules applied
- Chargeback and fraud‑monitoring playbook; liability-shift understanding
- Reconciliation between PMS, POS, gateway, and bank statements
Wi‑Fi & Network Segmentation
- Separate VLANs/SSIDs for guest, staff, and IoT; captive portal with ToS
- WPA2‑Enterprise/WPA3 where supported; strong passphrases rotated
- Bandwidth management and content filtering on guest network
- Regular site surveys; AP placement/channel planning to reduce interference
- Wi‑Fi usage logs retained with clear privacy notice
Website, OTAs & Marketing Tech
- HTTPS and HSTS enforced; CMS, plugins, and themes patched promptly
- WAF/CDN enabled; uptime and defacement monitoring configured
- OTA credentials scoped; 2FA enabled; price‑parity rules reviewed
- Cookie banner and GA4/GTM tag governance aligned to privacy rules
- Web accessibility baseline applied (e.g., headings, alt text, color contrast)
Hospitality POS, Kiosks & Handhelds
- Tablets/kiosks locked down and managed via MDM; kiosk mode where applicable
- Auto‑logout and screen‑lock; least‑privilege roles for staff
- Order/print flows validated; spare printers/cables and rollback plan
- Integrations with PMS/stock apps change‑controlled and tested
- Tip/gratuity and surcharge settings configured and audited
Cybersecurity & Resilience
- Patch/vulnerability management with monthly reporting and risk‑based prioritisation
- EDR/AV deployed and centrally monitored; email security (SPF, DKIM, DMARC) validated
- Backups follow 3‑2‑1(+immutable) pattern; periodic restore tests
- Centralised logging and alerting for auth failures, admin changes, and payment anomalies
- Annual penetration test and external scan; remediation tracked to closure
Physical Security & IoT (Locks, CCTV, HVAC)
- Smart‑lock credential lifecycle (issue, revoke) and emergency override documented
- CCTV retention policy, signage, and secure remote access for vendors
- Guest privacy areas defined; camera placement avoids private spaces
- BMS/HVAC and door controllers segmented; default passwords changed
- Asset inventory with make/model/firmware; updates tracked
Health, Safety & Continuity
- DR plan for extreme weather, power/network outages, and staff shortages
- Offline check‑in/out procedures and manual payment contingencies
- UPS/generator coverage for critical systems (PMS, POS, network) with test schedule
- Crisis communications for staff, guests, and authorities; media response templates
- Post‑incident review feeding into training and control improvements
Third‑Party Risk & Insurance
- Due diligence questionnaires for PMS, gateway, OTA, Wi‑Fi MSP, and marketing vendors
- Attestations (SOC 2, ISO 27001, PCI) reviewed annually; breach notification timelines contracted
- Cyber‑insurance conditions mapped to implemented controls
- Right‑to‑audit clauses and performance SLAs monitored
- Exit/transition plans ensuring data portability and deletion on termination
Reputation & Customer Experience
- Review‑response SOP with escalation for safety/privacy incidents
- CRM/newsletter platforms configured for consent and suppression lists
- Brand monitoring for impersonation and phishing domains
- Social media account security (admins, 2FA, recovery contacts)
- Mystery‑guest/testing programme to validate digital touchpoints
Audit, Evidence & Improvement Roadmap
- Control library mapped to Privacy Act, PCI DSS, and internal standards
- Evidence register with owners and refresh cadence
- Quarterly leadership dashboard (KPIs, KRIs, open actions)
- 90‑day improvement plan prioritising high‑impact, low‑effort fixes
- Maturity model tracking: Minimum → Strong → Leading
- Local, responsive, and personalised service.
- Transparent pricing.
- Expertise across industries and platforms.
- Strategic, not just reactive.