A hotel disaster recovery plan is the document nobody reads until the forecast cone includes the property. At that moment, the general manager discovers whether the reservation system, the card terminals, the key encoder, and the internet connection will survive a few days of wind, water, and no power, and whether anyone knows what to do if they do not.
It is late October, and the forecast has changed.
At 4:00 on a Tuesday afternoon, the National Hurricane Center’s cone shifts west. Miami is inside it. The general manager walks the front desk and asks a simple question.
“If we lose power for four days, can we still check people in and out?”
The front desk supervisor hesitates. The property management system runs on a server in the closet behind the front office, the same one that holds the router, the phone gateway, and a stack of boxes. The closet is on the ground floor, a few steps from the loading dock. The server sits on the floor. A USB drive on top of it holds the backup, which nobody has checked since spring.
The hotel does have a generator. It runs the elevators, the emergency lighting, and the fire panel. Nobody can say whether the front office closet is on that circuit.
The internet comes from one provider, through one router, in the same closet. The payment terminals depend on it. So does the booking engine. The key encoder works, but the latest room assignments live in the system the hotel might not be able to reach.
The supervisor says what everyone is thinking. “I guess we’d go to paper. Do we have paper?”
The Season Is Not Over
This scenario is deliberately set in late October because it is the part of the calendar people forget. The Atlantic hurricane season officially runs through November 30, and a property that treats preparation as a June task is unprepared for the back half of the season.
The point is not to predict a storm. It is that disaster recovery planning belongs in the same category as fire protection: a system the property builds before it needs it, tests on a schedule, and keeps current.
Start With What Actually Stops the Hotel
Federal guidance is specific about the order of operations, and hotels benefit from following it.
Ready.gov, the federal government’s preparedness site, advises that an information technology recovery plan should be developed together with the business continuity plan, with IT priorities and recovery time objectives set during a business impact analysis. The recovery time for an IT resource should match the recovery time objective of the business function that depends on it. The analysis also defines the recovery point objective, which is how much data the business can afford to lose, and data restoration times should be confirmed against those objectives.
NIST’s contingency planning guide, which many organizations use as the technical baseline, follows the same structure: understand what is critical, decide how quickly it must return, choose recovery strategies to meet that, and test them.
For a hotel, the business impact analysis is a conversation, not a research project. List the functions, then ask how long the property can operate without each.
Check-in and check-out. Needs the property management system, or a printed substitute.
Room keys. Needs the key encoder, the lock system, and current room assignments.
Payments. Needs card terminals, a payment gateway, and internet or an approved offline procedure.
Reservations and distribution. Needs the booking engine, channel manager, and internet.
Communications. Needs phones, email, and a way to reach guests and staff.
Housekeeping, engineering, and food service. Need work orders and POS.
The answers set the priorities. A property that can survive a day without the booking engine but cannot survive an hour without the ability to check a guest out has just learned where to spend its effort.
Cloud and On-Premises Systems Fail Differently
A cloud-based property management system and a server in a closet need different plans, and many hotels have not noticed which one they have.
On-premises systems depend on the hardware at the property. The risks are physical: flooding in the server room, a roof leak above the rack, a power surge, and a lost or corrupt backup. The plan has to cover where the server sits, how it is shut down, where the backup lives, and how the system is restored on new equipment if the old one is destroyed.
Cloud systems move the data away from the storm, but they trade one dependency for another. They need power to the property’s network gear and a working internet connection. A cloud PMS is useless if the router is dead, the circuit is down, or the staff cannot get online. The plan has to cover backup connectivity, battery power for the network equipment, and an alternative way to reach the system.
Many properties run a mix: a cloud PMS, a local key system, and an on-premises POS. Each component needs to be assigned to one of these two plans.
The Closet Is the Problem
Server rooms and network closets are the most common single point of failure in a hotel’s technology, and the fixes are not exotic.
Get it off the floor. Equipment should sit on racks, shelves, or higher floors, away from doors, windows, plumbing, and rooms that flood. Check above the equipment as well as below.
Know what the generator covers. Confirm in writing which circuits the generator supports. Life-safety loads often take priority over the IT closet, and the closet is frequently not on the list.
Protect the network core. A battery backup, sized and tested, for the router, switches, firewall, and PMS server buys time to shut down cleanly or to keep operating through short outages. Test it under load before the season, not during it.
Shut down on purpose. Industry guidance for Florida businesses is consistent that a server shut down cleanly comes back reliably, while one that loses power mid-operation sometimes does not. The plan should say who shuts down which systems and at what trigger.
Do not power on blindly after the storm. Check for water intrusion before restoring power to any equipment.
Take the portable pieces. Laptops, external drives, and credentials should be moved off-site, or higher, according to a documented checklist.
Backups That Survive the Storm
An earlier article in this series made the point that a backup reporting “successful” is not the same as a backup that restores. A hurricane is where the difference becomes expensive.
A backup that sits on top of the server it protects floods with it. The backup that matters is stored away from the property, ideally outside the region, and has been restored successfully at least once.
Two numbers define the standard. The recovery point objective answers how much recent data the hotel can afford to lose, which for reservations is usually very little. The recovery time objective answers how long recovery can take. Both should be tested together: restoring a large dataset over a strained, post-storm internet connection takes longer than most people expect.
NIST’s contingency guidance treats backup testing as a core part of the plan, along with off-site storage and encryption, and recommends keeping copies of the plan and recovery materials at an alternate location, so they are not trapped in the system that just failed.
Build the Downtime Kit
When systems are unavailable, the hotel runs on paper. A well-built downtime kit means that is an inconvenience, not a crisis.
An arrivals and in-house list. Printed and refreshed on a schedule, including twice daily during storm watches, with names, room numbers, stay dates, and special needs.
Room status and inventory. Which rooms are occupied, vacant, out of order, or reserved for staff or emergency use.
Paper folios and a rate sheet. So charges can be recorded and billed later without guessing.
Key procedures. How to encode keys manually, where the mechanical override keys are, and who holds them.
Contact lists. Staff, department heads, vendors, utilities, the insurer, the bank, the payment processor, and the property management and key system support lines, on paper.
The payment procedure. Ask the payment processor in advance for its approved offline procedure. Paper card slips are still cardholder data, so they must be locked up, tracked, and destroyed according to payment card rules, and the number of days the property operates this way should be kept as short as possible. This connects to the earlier article in this series on hotel payment security.
The plan itself. A recovery plan stored only on the server that just went down is a well-written irrelevance. Keep printed and off-site copies.
The kit contains guest information, which makes it sensitive. Store it in a locked place, limit who can access it, and destroy outdated copies.
Keep the Connection Alive
For any hotel that depends on cloud systems, connectivity is a continuity requirement.
Add a secondary path that does not share the same failure point: a cellular failover device, a second provider on a different physical route, or a portable satellite terminal that can be stored until needed. Industry checklists for Florida businesses now commonly recommend portable satellite service as an affordable backup, and cellular failover can be configured to carry payments automatically.
Make sure the batteries on the network equipment will outlast the typical outage, and test the failover rather than assuming it works. Verify that the phone system can forward calls to mobile devices if the office loses internet, and that staff know how to reach the vendor’s support line without relying on the hotel’s own network.
The Security Risk After the Storm
Disasters change a hotel’s security position, and attackers know it.
Equipment that loses power and restarts may return with different settings, reopened remote access, or reset credentials. An earlier article in this series on hotel IoT devices described exactly this issue for room systems, and it applies to the front office as well. After any extended outage, check the firewall, remote access, and key system settings against a known-good configuration.
Review logs for unauthorized access during the outage, when no one was watching.
Be alert for post-disaster fraud. The Federal Trade Commission warns about disaster-chasing scammers who exploit the aftermath of storms. When staff are tired and systems are in flux, the verification habits covered in earlier articles in this series on vendor payment fraud matter even more: confirm any new invoice or bank change by calling a number you already have.
Restore in Order and Verify Before You Announce
Recovery has a sequence, and following it prevents a second failure.
Restore the network and connectivity first, then servers, then workstations. Verify that the most recent backup is complete and accessible before relying on it. Test the key applications, especially the PMS, payment processing, and key system, before telling staff that systems are available. Confirm that call routing, if changed for the storm, has been put back.
Then reconcile. Enter the paper folios, check the payments processed offline, compare the room status in the system to reality, and document what happened for the insurer.
Name an Owner Before the Season Starts
Disaster recovery fails for the same reason most hotel technology problems do: everyone assumes someone else has it.
Assign one person, such as the general manager’s designee, the director of engineering, or an outside managed IT services partner working with them, to own the recovery plan. That owner keeps the system inventory and the downtime kit current, schedules the annual exercise, tracks backup test results, and holds the vendor support numbers where the whole team can find them without the internet.
Pair the role with monitoring, so the property knows the state of its backups, batteries, and connections before the storm, not after it. Our cybersecurity services include that visibility, along with the post-outage security checks described above.
Test It Before It Is Real
A plan that has never been exercised is a theory.
A tabletop exercise, in which department heads talk through a scenario, takes an hour and exposes most of the gaps. Functional tests, such as restoring from backup and switching to the secondary internet connection, confirm that the technical pieces work. NIST’s guidance recommends testing the plan, the backup media, and the alternate arrangements, and updating the plan after tests and after major changes.
Schedule the full exercise before June 1 each year, and repeat the relevant pieces after any change to the PMS, the network, the vendors, or the staff.
What This Means for Miami and South Florida Hotels
South Florida properties live this risk more directly than most.
Many hotels sit in coastal and low-lying areas where ground-floor equipment rooms are at risk of storm surge and flooding, and where barrier island evacuations can remove staff and guests on short notice.
Building generators are typically sized for life safety, not for the whole property, so it matters exactly what the IT closet is connected to.
A large share of guests are international travelers who cannot easily be reached once local networks are down, which makes the guest communication plan, including email, text, and printed notices, part of the technology plan.
After a storm, rebooking demand surges and the property that can access its reservation data first has an advantage. Cloud systems hosted outside the region help, provided the property can still reach them.
And insurance matters. Business interruption claims depend on documentation, so record the outage timeline, the decisions, and the damage. Ask your broker how coverage treats a loss caused by a vendor’s outage as well as your own.
Ask Your IT Provider Questions Like These
Which of our systems are cloud-based and which are on premises, and have we written a recovery plan for each?
Where is our server and network equipment physically located, and what protects it from flooding, leaks, and power loss?
Which circuits does our generator support, and is the IT closet one of them?
When did we last restore from backup, and is a copy stored outside our region?
Do we have secondary internet that does not share the same failure point, and have we tested it?
Do we have a printed downtime kit, and when was it last updated and tested?
If your IT provider cannot answer these clearly, the answer to the general manager’s question at the beginning of this article is probably no.
The Time to Ask Is Before the Cone Moves
Nobody builds a recovery plan during a warning. The property that checks in guests on the day after the storm is the one that answered the supervisor’s question months earlier.
ITva Technologies provides managed IT and cybersecurity services for hospitality properties across Miami-Dade and Broward, with specific experience planning and testing the recovery of the systems a hotel cannot run without.
Our managed IT services include a business impact analysis for your property, backup design and restore testing, secondary connectivity, and a documented downtime kit that matches how your front desk actually works.
Our cybersecurity services include post-outage security checks, monitoring for unauthorized access during recovery, and incident response planning that accounts for storm-related fraud.
Because many hotels use Microsoft tools for email and collaboration, our Microsoft 365 services keep communication and documents reachable from anywhere when the property network is not.
If your property has never asked what happens when the closet floods or the circuit goes down, that is worth doing before the next advisory.
Schedule a free hotel disaster recovery assessment with ITva.
We will walk your property, map what stops the hotel, and show you what to fix before the next storm.
Because the forecast will change.
The plan should already be written.
Frequently Asked Questions
What should a hotel disaster recovery plan include?
It should start with a business impact analysis that identifies critical functions such as check-in, billing, keys, payments, and communications, sets recovery time and recovery point objectives for each, and then covers backups, power, connectivity, a printed downtime kit, roles and contacts, restoration order, and regular testing.
How is disaster recovery different for a cloud PMS and an on-premises PMS?
An on-premises system depends on hardware at the property, so the plan must address flooding, power, and backups. A cloud system moves the data away from the storm but depends on power to the property’s network equipment and a working internet connection, so the plan must address backup connectivity and battery power.
What is a downtime kit?
It is a printed set of materials the hotel can use when systems are down, including an arrivals and in-house list, room status, paper folios and a rate sheet, manual key procedures, contact lists, and the payment processor’s offline procedure. Because it contains guest information, it must be stored securely and updated regularly.
How should a hotel handle card payments if systems go down?
Ask your payment processor for its approved offline procedure in advance and follow it. Paper card slips are still cardholder data, so lock them up, track them, destroy them according to payment card requirements, and keep the offline period as short as possible.
What should we do after the power returns?
Check for water intrusion before powering equipment, restore the network first, then servers, then workstations, verify backups, test key applications before announcing that systems are available, review security settings and logs, reconcile paper records, and watch for storm-related fraud.
When does hurricane season end?
The Atlantic hurricane season officially runs through November 30, so preparation and testing should continue throughout it. Many hotels aim to complete their full recovery exercise before June 1 and repeat key pieces after any major change.