Most small hospitality networks grew one device at a time. The internet came in, a router went on the wall, and everything since has plugged into whatever port was open. The card terminals, the office computer, the kitchen printer, the cameras, and the guest Wi-Fi all share one network. It works until somebody asks you to answer a PCI questionnaire honestly.
The problem is not that guests are malicious. Most are not. The problem is that a flat network lets every device on it reach every other device on it. A guest laptop carrying malware, a compromised phone, an employee's tablet with a bad app: all of them sit on the same network as the terminal processing a card, with nothing between them.
What flat costs you on PCI
PCI DSS does not strictly require segmentation. What it does is put everything connected to the cardholder data environment in scope. Flat network, one scope, and that scope includes guest Wi-Fi you have no control over.
Segmentation is how you shrink that. When the POS VLAN is isolated by enforced controls, systems on other VLANs can be kept out of the cardholder data environment, as long as they cannot reach it or affect its security. That can affect which self-assessment questionnaire you qualify for, how much of your network is in scope, and how much you have to document. If your processor offers a PCI-listed point-to-point encryption (P2PE) solution, ask about it too, because it can reduce scope further. Which questionnaire you end up on depends mostly on how cards are handled. Segmentation keeps the rest of the network from being dragged into scope.
The split that makes sense
Four segments cover most hospitality sites.
Guest Wi-Fi gets its own VLAN with a route to the internet and nothing else. Turn on client isolation so guest devices cannot see each other either. Add bandwidth limits if lobby streaming is eating the upload your card processing needs.
POS gets its own VLAN, and it should be the most locked-down thing in the building. Terminals and the POS server talk to each other and to the processor. That is the list. No web browsing, no email, and no reason for that VLAN to reach anything else.
Back office is the workstations, the printer, file storage, and whatever the manager uses for scheduling and payroll. It needs normal internet and normal internal services, which is why it should not sit next to the card terminals.
Cameras and building devices go on their own VLAN, usually with no outbound internet. Cameras are a common weak point because they ship with default credentials and firmware that rarely gets patched. An isolated segment, reached through the NVR rather than exposing each camera, is the safer setup.
The rules between them
VLANs alone are not segmentation. If the firewall or layer 3 switch routes freely between them, you have organized the network without protecting it. The rules are the actual control.
Start with default deny between segments, then open only what has to work. Back office needs to reach the POS server for reports, so allow that host on that port and nothing else. Somebody needs to view cameras from the office, so allow the office VLAN to reach the NVR and leave the cameras themselves unreachable. Guest reaches the internet and nothing internal, including the printers people will try to use.
Then log the denies, and have someone look at the logs.
What a reviewer looks at
Whether it is your acquiring bank, a QSA, or a penetration tester, the questions are predictable. Show the network diagram and the data flow for a card transaction. Show the firewall rule set and explain each allow rule. Show that a device on the guest VLAN cannot reach the POS VLAN, tested rather than assumed. Show that default vendor passwords are gone from the switch, firewall, access points, and cameras. Show that wireless carrying anything sensitive uses current encryption, and that somebody checks for rogue access points. Note that the quarterly external scans from an approved scanning vendor look at you from the internet. They do not test your internal segmentation.
The diagram trips people up more than the technology does. Plenty of sites have decent segmentation and nothing documenting it.
Doing this without replacing everything
This does not always mean new equipment. A managed switch and a firewall that supports VLANs will carry most restaurants and small hotels. What usually needs replacing is the consumer gateway acting as router, switch, and access point at once, because it cannot enforce rules between segments.
The other common gap is cabling. Segmentation assumes the terminals and access points land on ports you control. If a card terminal hangs off an unmanaged switch someone added in the back room, the VLAN design ends at that switch.
None of this makes a business PCI compliant on its own. It is the network groundwork the standard expects, and it makes the rest of the questionnaire much easier to answer.
Who we are
West Texas Wi-Fi & Networking is a veteran-owned contractor in Lubbock. We design and install commercial Wi-Fi, cameras, access control, and cabling across West Texas, and we hold a Texas Department of Public Safety security license (B31108601) for the camera and access control work. If you want a second set of eyes on your building, book a free site survey or call (806) 370-9434.