Uncategorized

Almost every IT problem that ruins a service was detectable that morning. The card machine that fails at 8pm was already struggling at 4pm. The printer that stops sending tickets to the kitchen had run out of paper before anyone opened the doors. The Wi-Fi that collapses on a full room had been sitting on a router that quietly rebooted overnight and never came back properly. None of that is bad luck. It is timing. Problems surface when the system is under load, which in hospitality means the worst possible moment, in front of a full room. This restaurant IT checklist covers ten checks a duty manager can run before service. Most take under a minute. Together they catch the overwhelming majority of issues that would otherwise land at 7.30pm. Why pre-service checks matter more in hospitality In most industries, an IT problem means someone raises a ticket and works on something else for an hour. In a restaurant, an IT problem means guests are sitting in front of you with no way to order and no way to pay. There is no working on something else. There is no rescheduling. The revenue for that hour does not come back, and the guest who waited twenty minutes for a card machine to reconnect remembers it far longer than they remember the food. That asymmetry is why hospitality benefits from a pre-service routine more than almost any other sector. Ten minutes before doors open is worth an hour of firefighting during service. It is the same principle behind checking the gas, the fridges, and the floats. Technology deserves a place on the same list. The 10-point restaurant IT checklist Run these in order. Assign them to the opening manager and make them part of the standard opening routine. 1. Test a card payment on every terminal Not just one. Every terminal on the floor. Run a low-value transaction or use your provider’s test function. A terminal that has lost its connection will often look completely normal on screen until someone tries to use it. Finding that out with a guest waiting is the expensive version of this test. 2. Print a test ticket to every kitchen printer Send one ticket to each printer and physically walk the pass to confirm it arrived. Kitchen printers fail quietly. They run out of paper, drop off the network, or jam without anyone noticing. The failure only becomes visible when a table’s food never appears, by which point you are twenty minutes behind. While you are there, check the paper. Every printer, every day. 3. Confirm the EPOS is talking to head office Open your reporting or sync screen and confirm the last successful sync was recent. An EPOS that has stopped syncing will usually keep taking orders locally, which is why nobody notices. Then a week of trading data is missing, stock figures are wrong, and someone in finance is trying to reconstruct it manually. 4. Check the internet connection, properly Do not judge this by whether a phone shows bars. Run a speed test on a device connected to the venue network. You are looking for two things: that it works at all, and that the result looks like a normal day. A connection that has failed over to a backup line will often still work, just slower, and you want to know that before the room fills up rather than after. 5. Check guest Wi-Fi from the guest side Disconnect from the staff network, connect as a guest, and load a page. Guest Wi-Fi runs on separate configuration from staff Wi-Fi, so testing one tells you nothing about the other. The landing page can break, the daily reset can fail, and the network can look perfectly healthy from the office while being unusable at table twelve. 6. Confirm the booking system is live and synced Open the booking system and confirm today’s covers are showing correctly. Booking platforms sit between your website, third-party channels and the floor. When the sync breaks, the diary looks fine but the covers are wrong, and you find out when two parties arrive for the same table. 7. Glance at the CCTV feed Load the viewer and confirm every camera is showing a live image and recording. Cameras fail silently and nobody looks until something happens and the footage is needed. Ten seconds a day is a very low price for knowing the system is actually running. 8. Check the back office machine and any tablets are charged and online Handheld ordering devices, manager tablets, and the back office PC all need to be awake, charged and connected before service, not during it. Devices that spend the night on a shelf rather than a dock are the most common cause of a mid-service scramble for a working handheld. 9. Confirm music and screens are running Background music and digital screens are not critical systems, but a silent room at 6pm is noticeable and reflects on the venue. These usually run on their own devices and their own subscriptions, which means they fail on their own schedule and nobody owns them. Add them to the list. 10. Log anything unusual, even if it fixed itself This is the one most teams skip and the one that pays back the most. If a terminal needed restarting twice, or the Wi-Fi dropped for a minute, write it down. Intermittent problems are almost always early warnings, and a written record is what lets your IT provider find the cause instead of guessing. A short shared note or a channel in your messaging app is enough. It does not need to be a system. Make it a standard, not a good intention A checklist only works if it belongs to someone. Put it in the opening routine alongside the fridge temperatures and the float count. Name the role responsible, not the person, so it survives holidays and staff changes. Keep it to ten minutes, because a check that takes half an

You take card payments. That means PCI DSS applies to you. It applies whether you run one site or twenty, whether you use a full EPOS system or a card terminal on the bar, and whether anyone has ever asked you about it or not. Most restaurant operators know the acronym. Far fewer could say what it actually requires, and even fewer know where their business currently stands. That is not a criticism. It is a standard written by the card industry, in the card industry’s language, and nobody in hospitality signed up to become a security specialist. This guide explains what PCI DSS compliance for restaurants actually involves, where multi-site operators tend to slip, and what to do about it without turning it into a six-month project. What is PCI DSS? PCI DSS stands for the Payment Card Industry Data Security Standard. It is a set of security requirements created by the major card brands to protect cardholder data. It is not law. It is a contractual obligation that sits inside your merchant agreement with your acquirer or payment provider. Which in practice means it carries real consequences: monthly non-compliance fees, higher transaction charges, and in the event of a breach, fines and liability that fall on you rather than the bank. The current version is v4.0.1. Since 31 March 2025, requirements that were previously treated as future-dated best practice have been mandatory, and assessments now cover the full standard. The bigger shift is philosophical. The standard has moved away from an annual point-in-time validation model towards continuous evidence that controls are actually working across the year. That matters for hospitality more than most sectors, because a restaurant group changes constantly. New sites, new staff, new devices, new suppliers. A snapshot taken in January tells you very little about July. What does PCI DSS actually require? The standard runs to twelve requirement areas. For a typical restaurant or restaurant group, the ones that bite in practice are these. Network security. Your payment devices should not sit on the same network as guest Wi-Fi, back office machines, or the smart TV in the bar. Segmentation is the single most valuable thing most operators can do, because it shrinks the amount of your estate that falls in scope. Access control. Every person with access to payment systems needs their own login. Shared accounts, generic manager logins, and the password written inside the till drawer all fail. Multi-factor authentication is now expected for access into the cardholder data environment, not just for administrators. No storing what you do not need. Card numbers should not be written on paper for phone bookings, stored in a spreadsheet, or kept in a booking note field. If you do not store it, you cannot lose it. Patching and anti-malware. Every device in scope needs to be current. That includes the EPOS terminals, the back office PC, and the router. Logging and monitoring. You need to be able to show what happened and when. This is the requirement most operators discover they cannot meet, usually at the worst possible moment. Policy and training. Someone has to own this, staff need to know the basics, and it needs to be written down. You can read the full requirement set on the PCI Security Standards Council website, though be warned that it is written for assessors rather than operators. Where multi-site restaurant groups go wrong This is the part that catches good businesses out. Head office has strong processes. The finance team knows what it is doing. The policy exists and it is a genuinely decent policy. Then you look across the estate and every site is running slightly differently. Different EPOS versions because site four was refurbished two years later. Different network configurations because three different installers did three different fit-outs. Different Wi-Fi setups because one landlord insisted on their own provider. Different people, with different levels of understanding, doing broadly the same job in slightly different ways. None of that is anyone’s fault. It is what happens when a business grows one site at a time, with technology decisions made in the moment by whoever was closest to the problem. But PCI DSS does not assess your best site. It assesses your business. If site nine has a flat network and a shared admin login, that is your compliance position, regardless of how good site one is. Consider a nine-site group with an average of 600 covers a week per site. That is a lot of card transactions passing through nine different configurations. The risk is not evenly spread, and until someone maps it, nobody knows where it sits. The SAQ question Most restaurants validate compliance through a Self-Assessment Questionnaire rather than a full assessor-led audit. Which SAQ applies depends on how you take payments. If you use a standalone terminal with a dial-up or dedicated line and no electronic cardholder data storage, you are likely in the simplest bracket. If your EPOS is integrated, connected to your network, and handling card data, the questionnaire gets considerably longer. Two things worth knowing. First, the SAQ is a declaration. Signing it says the controls are in place. If they are not and a breach follows, that signature matters. Second, your acquirer decides which SAQ applies, not you. If you are unsure which one you should be completing, ask them directly. It is a five-minute email and it removes a lot of guesswork. Making compliance part of how the business runs The operators who find PCI DSS manageable are the ones who stopped treating it as an annual event. Practically, that looks like a handful of habits. That last one is the difference between a group that is compliant and one that hopes it is. This is the work we do with multi-site operators as part of ongoing cybersecurity support and our wider hospitality practice: building the same strong foundation into every site so that compliance is a by-product of good infrastructure rather than a separate project bolted

You’ve signed the lease. The fit-out programme is agreed. The opening date is in the diary and the marketing has gone out. Then someone asks about the internet. If you’re ordering a leased line at that point, you’re already behind. So how long does a leased line take to install? In the UK, typically 60 to 90 working days, and sometimes considerably longer. That’s three to five months of calendar time, not weeks. Here’s what actually happens during that period, what causes the delays, and when you need to place the order to open on a proper connection rather than a temporary one. How long does a leased line take to install in the UK? Most UK providers quote a standard lead time of 45 to 90 working days. In practice, a realistic planning assumption for a new site is 90 working days from order to live. The range is wide because no two installations are the same. Here’s roughly how it breaks down: Stage Typical duration Order processing and provider survey 5–10 working days Desktop planning and route design 10–15 working days Wayleave agreements (if required) 20–60+ working days Civil works (digging, ducting) 10–30 working days Fibre installation and testing 5–10 working days Router configuration and handover 2–5 working days Some of these run in parallel. Others don’t start until the previous one finishes. Wayleaves in particular can stop everything dead. If your site already has fibre to the building and spare capacity in the duct, you might be live in six weeks. If your site is a listed building on a high street with a landlord in another country, you might be looking at six months. Why does it take so long? A leased line isn’t broadband. Broadband shares an existing connection with everyone else on your street. A leased line is a dedicated physical fibre run from the exchange to your building, uncontended, symmetrical, with a service level agreement behind it. That physical run has to be planned, permitted, and often dug. Which means several things have to go right. Wayleaves A wayleave is legal permission to install cable across land you don’t own. If the fibre route crosses a car park, a neighbouring property, or a landlord’s common area, someone has to sign. This is the single biggest cause of delay on leased line installs. Not because it’s technically difficult, because it’s an administrative process that sits with people who have no deadline pressure. A landlord who takes three weeks to reply has just added three weeks to your opening. Civil works If there’s no existing duct to your building, Openreach or your provider’s contractor needs to dig one. That means street works permits from the local authority, traffic management if it’s a busy road, and a crew booked in. Permit lead times vary by council. In some areas it’s two weeks. In others it’s considerably more, particularly if your site is in a conservation area or a pedestrianised zone. Site readiness The fibre terminates somewhere physical. That location needs power, needs to be accessible, and needs to exist by the time the engineer turns up. Openings often fall down here. The comms room is still a stud wall on the day the install is booked, so the engineer leaves and you go back into the queue. What happens if you order too late? You open on 4G or a temporary broadband line. That’s the honest answer. Picture a 90-cover restaurant on a Saturday night. Card payments, EPOS syncing to head office, CCTV recording to cloud, guest Wi-Fi, background music streaming, the booking system, and staff devices. All of it running through a consumer broadband router or a 4G dongle. It usually holds until it doesn’t. Peak service is exactly when contended connections fall over, and that’s the moment you find out. Card machines time out. Orders don’t reach the kitchen. Guests notice. You also end up paying twice, the temporary line, then the leased line, and running a second migration a few months after opening when the team is already stretched. When should you order? The 90-day rule Order your leased line at least 90 working days before your planned opening date. For a multi-site group, build it into the standard site opening process so it happens automatically. The best trigger point is the moment the lease is signed. Not when the fit-out starts. Not when the build programme is agreed. At heads of terms, you know the address, and the address is all the provider needs to start a survey. If you’re working backwards from an opening date, here’s the sequence: Order a backup connection at the same time. A 4G or 5G failover circuit costs very little and means a single fibre fault doesn’t stop trade. Who owns this in your business? This is the part that catches multi-site operators out. The building has a main contractor. Someone owns the programme, coordinates the trades, and answers for the date. The technology usually has three or four separate suppliers, all working to their own timelines, with nobody joining them up. The leased line provider doesn’t know when the EPOS is being installed. The EPOS supplier assumes the network is ready. The CCTV installer turns up expecting cabling that nobody ordered. Somebody has to own the technology programme the way your contractor owns the build. On the openings we run for multi-site hospitality groups, that’s the role we take, one point of contact, one programme, costed upfront and planned around the build. Site five then runs smoother than site one, because the process is the same every time. You can read more about how we approach IT projects for new site openings and our work across multi-site hospitality. The short answer Leased lines take 60 to 90 working days in the UK, and longer if wayleaves or civil works are involved. Order at lease signing, plan for 90 days, get a 4G failover as standard, and give one person ownership of the whole technology

You’re paying for Microsoft 365 every month. But if your firm is like most in professional services, you’re using about 30% of it. Email. Word. Excel. Maybe Teams for the occasional call. The rest of the platform, SharePoint, Defender, Intune, Conditional Access, sits there, licensed and idle, on an invoice nobody questions. This post covers what Microsoft 365 for professional services firms should actually look like, what most firms are missing, and what it’s costing them in real terms. Why Most Professional Services Firms Underuse M365 It usually starts the same way. Licences were set up at the start, by a supplier, during a growth phase, or because someone made a recommendation at the time. Nobody came back to finish the job. The team adapted. Workarounds became habits. New starters learned the broken version of things from whoever sat next to them. The platform never got configured for how the firm actually works. It got configured once, loosely, and then left. This isn’t a technology problem. It’s a configuration problem. And it’s almost universal across firms in legal, accountancy, consultancy, and financial services. What Microsoft 365 Business Premium Actually Includes If your firm is on Business Standard or Business Premium, the following is already in your licence. No upgrade required. SharePoint for client file management. Every matter in a structured, permission-controlled library. Version history built in. No more shared drives with six copies of the same document. No more emailing attachments between colleagues. Microsoft Defender for Business. Endpoint protection across every device, included in Business Premium. Most firms have it assigned. Almost none have it configured. Assigned and configured are not the same thing. Microsoft Intune for device management. Enforce security policies across every laptop, desktop, and mobile that touches your network. Remote wipe a lost or stolen device before the data on it becomes a problem. Most firms discover they need this capability when someone leaves unexpectedly, not before. Teams channels per client or project. All messages, files, and notes for a matter in one place. Searchable. Accessible to the right people. Not scattered across email threads, WhatsApp groups, and someone’s local desktop. Conditional Access and MFA policies. Multi-factor authentication on for some users is not the same as a properly configured security baseline. Conditional Access is where the real protection sits, blocking sign-ins from unrecognised devices, enforcing compliant endpoints, restricting access by location. Most firms haven’t touched it. What Does Poor M365 Configuration Actually Cost a Professional Services Firm? The idle licence fee is one number. The bigger cost doesn’t appear on any invoice. Fee earners in professional services lose between 45 and 90 minutes a day to tasks Microsoft 365 is already built to handle. Hunting for the right version of a document. Chasing a file buried in a colleague’s inbox. Rebuilding work after a leaver’s account was removed and their files went with it. At a £60,000 salary, 45 minutes a day is roughly £6,000 per person per year in lost productive time. Across a 20-person firm, that’s £120,000 annually in hours that could be billable, or at minimum, better spent. Then there’s the compliance risk. Firms in legal and financial services operate under SRA Principle 7, FCA SYSC requirements, and ICO registration obligations, all of which carry expectations around how client data is stored, accessed, and protected. A SharePoint environment that hasn’t been set up correctly, combined with Defender sitting unactivated, is a gap that won’t show up until something goes wrong. According to the NCSC, the most common cause of data breaches in professional services is compromised credentials, typically from phishing. Properly configured Conditional Access and MFA policies are the most direct defence. Both are included in Business Premium. Both are consistently under-configured. Four Checks You Can Run This Week You don’t need an IT firm to tell you where your gaps are. These four checks take under an hour and will surface most of what you need to know. 1. Pull your licence report. Microsoft 365 Admin Centre, then Billing, then Licences. Check what’s assigned against what’s available. If you’re on Business Premium and Defender and Intune aren’t configured, that’s the gap confirmed in one screen. 2. Check your MFA status. Admin Centre, Users, Active Users, then Multi-factor authentication. Any user showing “Disabled” or “Not registered” means that account is one convincing phishing email away from being compromised. 3. Look at your SharePoint usage. Admin Centre, Reports, Usage, SharePoint. If active file count is low relative to your headcount, your team is storing files somewhere else, shared drives, local machines, inboxes — and you have no central visibility over any of it. 4. Ask what happens when someone leaves. When a member of staff exits, what happens to their files? If the answer is “IT removes their account,” ask specifically where their OneDrive and SharePoint content goes in that process. If nobody knows, that’s the answer, and it’s a risk worth understanding before it becomes a problem. What a Properly Configured M365 Environment Looks Like A professional services firm running Microsoft 365 properly looks like this. Client files live in SharePoint, structured by matter, with permissions set so only the right people can access them. Teams channels are set up per client or project. Defender is active and monitored across all endpoints. Intune enforces a security baseline on every device. MFA is on for every user, with Conditional Access policies blocking anything that doesn’t meet the firm’s baseline. When someone joins, they’re set up in minutes with access to everything they need and nothing they don’t. When someone leaves, their account is disabled, their files are transferred, and their access is revoked, with a full audit trail. That’s not a complicated setup. It’s what the licence is designed to deliver. It just needs to be configured. If you want to see what this looks like for a firm your size, our professional services IT page covers how we approach it. Is Microsoft 365 Enough for a Professional Services Firm on Its Own?