Restaurant IT Guide: POS, Network, Failover and PCI

Restaurant IT comes down to one question: can you keep taking orders and card payments through a full service? That depends on a wired, separated network for the point-of-sale (POS) system and kitchen, guest Wi-Fi that cannot reach it, a backup internet connection, reliable kitchen printers and displays, and staff logins you can switch off the day someone leaves. This guide covers each piece, the payment card rules that apply, and a checklist you can copy.

What Technology Does a Restaurant Actually Run?

Most restaurants run more connected equipment than a typical office, and much of it arrives from different vendors at different times.

System	Common examples	What it depends on
Point of sale	Toast, Square for Restaurants, Clover, Lightspeed Restaurant, TouchBistro, SpotOn	Stable local network and internet
Kitchen display system (KDS) and kitchen printers	Vendor KDS screens, Ethernet receipt and impact printers	The same local network as the POS terminals
Handheld ordering and payment devices	Toast Go, Square Handheld, Clover Flex	Strong Wi-Fi across the dining room and patio
Online ordering tablets	DoorDash, Uber Eats, Grubhub	Internet only
Guest Wi-Fi	Any business access point	Internet only
Security cameras	Network video recorder (NVR) or cloud cameras	Local network, storage, limited internet
Back office	Manager PC, accounting, scheduling, email	Internet and normal office security

The pattern to notice: only the POS terminals, handhelds, KDS screens, and kitchen printers need to talk to each other. Everything else just needs the internet. That is the basis for the network layout below.

How Should a Restaurant Network Be Laid Out?

Network segmentation means splitting one physical network into separate virtual networks (VLANs) so that devices in one group cannot reach devices in another. For a restaurant, a sensible layout is:

1. POS and kitchen: terminals, handhelds, KDS screens, kitchen and receipt printers. Nothing else joins this network.
2. Third-party tablets: delivery and online ordering tablets, which need internet access only.
3. Guest Wi-Fi: internet only, with client isolation turned on so guest devices cannot see each other.
4. Cameras: the recorder and cameras, with no path to the POS network.
5. Back office: the manager PC, office printer, and staff phones.

A business-grade firewall, a managed switch, and access points that support multiple Wi-Fi networks are what make this possible. Our guide to network segmentation for small businesses explains the concept in more depth.

Two vendor details matter before you change anything:

• Toast. Toast recommends hardwired connections for primary terminals, with Wi-Fi reserved for its handheld devices. Where Toast supplies and manages the router, its devices run on an encrypted network whose password Toast does not give out, for PCI reasons. Do not try to add your own devices to it. Build guest Wi-Fi, cameras, and office equipment alongside it.
• Any POS vendor. Ask for the vendor’s written network requirements before buying or reconfiguring equipment, and keep a copy. When a fault spans the network and the POS, that document settles whose problem it is.

What Happens When the Internet Goes Down?

Cloud POS systems have offline modes, and it is worth knowing exactly what yours does, because the risk shifts to you while it is active.

POS	What the vendor documents
Toast	Offline mode keeps order taking and card payments going, and kitchen tickets can print to backup printers if configured. Gift cards, loyalty redemption, house accounts, and logging in or out are unavailable. With local sync, a hardwired hub device relays orders to KDS screens over the local network. Toast warns against restarting the router during an outage.
Square	Offline payments must be uploaded within 72 hours on Register, Terminal, and Handheld (24 hours on readers and stands). Square states the seller is responsible for any expired, declined, or disputed offline payments. Gift cards and manually keyed cards are not supported offline.
Clover	Offline payments are allowed for up to 7 days by default on some devices, with configurable limits per transaction and in total. The card cannot be validated or checked for funds until the device reconnects.

Offline mode is a safety net. A second internet connection is the better fix, because payments keep authorizing in real time and nothing is left to settle later.

How Cellular Failover Works

A failover setup uses a firewall or router with two internet inputs: your main line (cable or fiber) and a cellular modem on a 4G or 5G data plan. The router tests the main line constantly and moves traffic to cellular when it fails, then moves it back.

To set it up well:

1. Confirm cellular signal strength at the spot where the modem will sit, not just at the front door.
2. Choose a data plan sized for payments and orders, and block guest Wi-Fi and camera uploads from using the backup link.
3. Put the modem, router, and main switch on a battery backup (UPS) so a short power flicker does not restart everything.
4. Test it every few months by unplugging the main line during a quiet period and running a small card transaction.

If your POS vendor manages your router, ask the vendor which failover options it supports before adding hardware.

What Does PCI DSS Require of a Restaurant?

PCI DSS (the Payment Card Industry Data Security Standard) is the security standard the card brands require of every business that accepts cards. It is a contract requirement enforced through your payment processor, not a law. The current version is PCI DSS v4.0.1; version 4.0 was retired on December 31, 2024, and the new requirements introduced in v4 became effective on March 31, 2025.

Small merchants usually validate with a Self-Assessment Questionnaire (SAQ). The PCI Security Standards Council describes the types; these are the ones a restaurant is most likely to meet:

SAQ	Who it is for
A	Card-not-present only (online ordering) with all card handling outsourced to a compliant provider
B	Standalone dial-out terminals or imprint machines, no electronic card data storage
B-IP	Standalone approved payment terminals connected over the internet, isolated from other devices
P2PE	Hardware terminals that are part of a validated, PCI-listed point-to-point encryption solution
C	Payment application systems connected to the internet, no electronic card data storage
D	Everyone who does not fit another type

Your processor decides which SAQ applies and whether you need to submit one at all. Modern all-in-one platforms take on much of the work:

• Toast says it is responsible for most PCI requirements on its platform, that most customers do not need to submit an SAQ, and that the restaurant remains responsible for Requirement 9, which covers physical access to cardholder data.
• Square says sellers who use Square for all card storage, processing, and transmission do not need to validate PCI compliance individually.

What stays with you in every case: keep terminals physically secure and check them for tampering, never write card numbers on paper or in a notes field, keep the payment network separate from guest Wi-Fi, use unique logins, and remove default passwords from network equipment. Segmentation is what keeps your cameras, tablets, and guest network out of PCI scope (the set of systems the standard applies to). Our PCI DSS guide for small businesses covers the wider picture.

How Do You Keep Kitchen Printers and KDS Screens Reliable?

A kitchen printer that stops mid-rush is often a network problem rather than a printer problem. The common causes are fixable:

• Use wired Ethernet for kitchen printers and KDS screens. Kitchens are full of steel and moving bodies, which is hard on Wi-Fi.
• Give every printer a fixed address. Reserve an IP address for each printer in the router (a DHCP reservation) so it never changes after a restart.
• Configure a backup printer route in the POS if the vendor supports it, so tickets for a failed printer come out at another station.
• Keep heat and grease in mind. Mount screens and network gear away from fryers and steam, and use cable rated for the run.
• Label everything. Every cable, port, and printer gets a label that matches its name in the POS.
• Hold spares. One spare printer, one spare patch cable of each length, and paper stock cost little next to a stalled line.

Guest Wi-Fi, Cameras, and Staff Logins

Guest Wi-Fi. Keep it on its own network with client isolation, a bandwidth limit per device, and a password you can change without touching anything operational. If the dining room Wi-Fi is weak for handhelds, our post on why business Wi-Fi keeps dropping covers placement and channel planning.

Cameras. Put cameras and the recorder on their own network, change default passwords, and use the vendor’s app or a VPN for remote viewing instead of opening ports on the firewall. Two California rules affect camera setup: Penal Code 632 restricts recording confidential conversations without the consent of all parties, so leave camera audio off unless you have legal advice that says otherwise, and Labor Code 435 bars employers from recording employees in restrooms, locker rooms, and changing rooms. See our security camera guide for storage and placement.

Staff logins. Give every employee an individual POS PIN or login so actions are traceable. Turn on multi-factor authentication (MFA, a second proof of identity such as an app code) for the POS back-office portal, email, payroll, and delivery platform accounts. Disable access the same day someone leaves. Our onboarding and offboarding checklist has a template.

Restaurant IT Checklist

Copy this list and work through it once, then review it every six months.

• POS terminals, KDS screens, and kitchen printers are wired where the vendor recommends it
• POS and kitchen devices are on their own network, separate from everything else
• Guest Wi-Fi is isolated, rate limited, and uses a different password from staff Wi-Fi
• Delivery tablets and cameras each sit on their own network
• A second internet connection fails over automatically, and it was tested this quarter
• Staff know what offline mode allows and who decides when to use it
• Modem, firewall, switch, and one POS terminal are on battery backup
• Every printer has a reserved IP address and a label
• A backup printer route is configured in the POS
• Every employee has an individual POS login, and former staff are removed
• MFA is on for POS admin, email, payroll, and delivery platform accounts
• Default passwords are changed on the router, switch, access points, and cameras
• Payment terminals are checked regularly for tampering
• You know which SAQ your processor expects, and when it is due
• A one-page contact sheet lists the ISP, POS vendor, processor, and IT support, with account numbers

Questions to Ask Any IT Provider

• Have you read my POS vendor’s network requirements, and will you follow them?
• How will the POS and kitchen network be separated from guest Wi-Fi and cameras?
• What failover connection do you recommend here, and how will it be tested?
• Will I receive a network diagram and all admin passwords?
• How is work scheduled around service hours?
• What is the process when a fault sits between the network and the POS vendor?
• How is the scope and price agreed before work starts?

When You Do Not Need All of This

A coffee cart or small counter with one Square or Clover device running on its own cellular connection, no kitchen printer, and no guest Wi-Fi has very little to segment. Strong account security (unique logins and MFA) and a charged spare device cover most of the risk. The full layout above starts to pay off once you have multiple terminals, a kitchen printer or KDS, guest Wi-Fi, or cameras sharing one internet line.

Common Questions

Can guest Wi-Fi and the POS share one router?

Yes, if the router or firewall supports separate networks and the guest network is isolated from the POS network. They can share the internet line and the hardware. What they must not share is the same network segment, because a guest device could then reach payment equipment.

Is cellular failover fast enough for card payments?

Card authorizations are small amounts of data, so a 4G or 5G backup link with usable signal handles them comfortably. The backup link is not meant for guest Wi-Fi or camera uploads. Restrict it to POS, KDS, and online ordering traffic so the data plan lasts through a long outage.

Do I still have PCI obligations if I use Toast or Square?

Yes, though fewer. Both vendors document that they handle most requirements when you use their hardware and processing. You remain responsible for physical security of the terminals, for how staff handle card details taken by phone, and for keeping the rest of your network from undermining the payment devices.

Should kitchen printers be on Wi-Fi?

Wired Ethernet is the safer choice. Kitchens have metal surfaces, heat, and interference that weaken Wi-Fi, and a printer that drops off the network holds up the whole line. If a cable run is truly impossible, use a dedicated access point close to the printer.

How Coastal Growth Co. Can Help

We can review your restaurant’s network against your POS vendor’s requirements, separate POS, guest, tablet, and camera traffic, set up and test internet failover, and document everything so faults are quicker to trace. Work is scheduled around your service hours, with scope and price agreed first. See our networks, security, and cameras service or get in touch through the contact page.