Fractional CTO for healthcare and hospitality SMEs.
Home · Method · Healthcare · Hospitality · Engagement · About · Book a discovery call
Same engagement: Learn, Assess, Strategy, Translate, and DevOps. This page names the estate. Hotel owners who will not fund a full-time technology executive are the usual sponsor. The sequence does not change because the property is smaller.
One property, one stay type. An OTA leisure stay, from reservation creation to a settled folio, is a usable charter. Walk-ins are a different process. Groups and banquet stay off this map.
The chain is reservation, pre-stay, check-in, in-house, check-out, post-stay. Check-in splits into two clocks: the guest standing at the desk, and the registration work with nobody in front of the clerk. Time them separately. Guest-facing time is the service. The time worth attacking is often the second one.
People and paths to stand next to:
Systems on the arrows when you see them: channel manager, PMS, payment gateway, door locks, POS. The property clock runs through night audit. A map drawn in office hours hides the Saturday failure.
Value demand: book, modify within policy, check in, a real service request, check out.
Draw the cardholder data environment before anyone talks about a new booking path. PCI SSC’s small-merchant guide treats the payment system as the whole path: terminal, register, devices on the same network, and the connection to the merchant bank. Ask where a card number is typed besides the payment field. Notes, email, and group-sales sheets count. Compare the drawing to the last SAQ the acquirer accepted. A mismatch is a finding. Completing an SAQ is not this engagement.
Reconcile one day of arrivals across the PMS, the channel manager, and one channel. Room type, rate, and whether the room was sellable in more than one place at once. The finding is the mismatches in that day and which interface has no owner.
Guest messaging or a CRM beside the PMS needs an exit test: a sample export of profiles, preferences, and message history, and what the desk still has the week after the contract ends.
One arrival path at one property, executable by the desk and the floor. Direct bookings that the desk cannot honor, because housekeeping never sees the arrival, are a diagnosis. The order is: one arrival record from booking to a ready room, connect that time to the housekeeping turn, and only then automate a request the staff already handles. Card numbers stay in the processor the property already uses.
PMS replacement, a guest-data platform, and a concierge bot are the examples of what that strategy declines. A new path that stores, processes, or transmits cardholder data expands PCI DSS scope to the systems connected to it. Keep new card data out of the bet when a compliant processor already has it.
The property names its peaks in week 0 of DevOps: weekends, local events, holidays, and the daily check-in rush. Booking, PMS, POS, locks, and the network a guest needs in order to stay change outside that rush, on a day when a rollback can still be watched. A back-office report can move on a Wednesday morning. A failed check-in on a Friday afternoon is the outage that matters.
The call is to decide whether this engagement fits. The answer can be no.