Football tournaments are not IT projects. Right up until something fails on a live broadcast watched by hundreds of millions of people. Then they are.

The FIFA Club World Cup in the UAE brought together the world’s top club sides across six venues on a tight programme schedule. The brief to our team was straightforward and uncompromising: build, run and tear down the IT infrastructure end-to-end. Reliable networks for fans, dedicated bandwidth for broadcast, a temporary security operations centre for the duration, and engineers on site for every minute the lights were on.

This is the technical breakdown — written for the people who will have to deliver something like this themselves. The vendor pitch is short. The detail is long, because that is what is useful.

— The brief —

The organising committee’s requirement set was a single document with three priorities and no negotiable items. First: a fully redundant fan WiFi service across every venue capable of handling peak concurrency at kickoff and half-time. Second: a dedicated broadcast LAN, physically segmented from every other network, supporting the host broadcaster’s production stack and the international rights-holder feeds. Third: a security operations capability covering the tournament network end-to-end, with active monitoring and incident response from the day before opening through the day after the final.

Layered on top of that were the secondary requirements that always come with tournament-grade IT — accreditation network for media and officials, ticketing systems backhaul, IPTV feeds to hospitality boxes and lounges, CCTV integration with venue and police command centres, and a remote NOC running tournament-wide visibility for the duration.

The deployment window was tight. We had six weeks from contract award to first venue handover, and three working days at each venue to take it from empty stadium to live, tested, signed-off network. The tournament itself ran ten days. Teardown began the morning after the final.

— The constraints that shaped the design —

Three constraints did more to shape the architecture than anything else. The first was venue diversity. The six venues spanned established arenas with mature in-house infrastructure, mid-life stadiums with partial cabling we could extend, and one near-greenfield site where almost everything had to be brought in on trucks. The design had to deliver the same end-user experience across all three classes of venue with the same operating model — anything else would have made the NOC unworkable.

The second was the spectrum environment. The UAE TDRA regulates wireless spectrum tightly, particularly around broadcast venues during major events. We co-ordinated with TDRA, the host broadcaster’s RF team and venue incumbents at every site to claim and protect the spectrum we needed, both for high-density WiFi and for the point-to-point microwave links carrying the broadcast feed where fibre was not available.

The third was the broadcast network’s zero-tolerance posture. Standard event WiFi can absorb a fluctuation in latency or a brief congestion event. A live broadcast LAN running SMPTE-class production traffic cannot. The broadcast network was therefore designed as an entirely separate physical plant — separate switches, separate fibre runs, separate uplinks, separate firewall stack, separate monitoring. The fan WiFi and the broadcast LAN never touched each other anywhere in the stack.

— The kit —

Per venue, the typical build was: 60 to 80 HPE Aruba WiFi 6 access points across the bowl, concourses and hospitality areas; a redundant Aruba CX 6300 / 8325 switching core; two Palo Alto firewalls running active-passive; a 10 to 50 Gbps fibre uplink to the tournament edge depending on venue role; a dedicated broadcast LAN built around Cisco Catalyst 9500-series switches with sub-millisecond latency engineering; pre-staged Aruba and Ubiquiti point-to-point microwave radios for emergency backhaul; and a portable rack carrying compute, storage, IPTV head-end and CCTV recording for that venue.

Tournament-wide, the central infrastructure ran from a temporary on-site NOC alongside the host broadcaster, with Palo Alto Cortex XSIAM acting as the tournament SIEM, the NOC presenting on a video wall feeding network, security and CCTV streams, and out-of-band management on a parallel network so that if the primary lost reachability we could still see and recover everything.

— The numbers —

Six venues. Ten event days. Approximately 400 fan-facing access points across the tournament. A combined uplink of around 50 Gbps across the venue fleet at peak. Hundreds of CCTV cameras integrated into the venue and police command-centre VMS. An on-site team of eighteen engineers at peak, working in shifts so every venue had a senior wireless engineer, a network ops lead and at least one support tech every shift. A remote NOC of eight, running 24/7 from Abu Dhabi backstopping the venue teams.

Across the whole tournament, zero P1 incidents on the fan WiFi or broadcast LAN. Three P2 incidents — all caught, contained and resolved within the SLA window. One P3 finding from the SOC that turned out to be a misconfigured third-party service and was patched at source within ninety minutes. That was the entire incident ledger.

— The operational rhythm —

Each venue ran a daily cadence that did not deviate. 06:00 morning checks: walk the network, validate AP and switch health, sample-test SSIDs, confirm the broadcast LAN handshakes were green. 08:00 venue ops standup with the venue manager, broadcast lead and security commander. 10:00 to 16:00 active monitoring through the build-up to the match. Kickoff through final whistle: full bridge open, every NOC eye on the dashboard. Post-match: targeted analysis of any anomaly the dashboard flagged, even if it did not breach SLA. 22:00 to 23:00 day-close walkthrough and handover to the night shift.

The tournament-wide bridge call ran every six hours. It was deliberately short — twenty minutes — and used the same agenda every time: incidents in the last window, planned changes in the next window, escalations needing attention now. Anything else went into the asynchronous tracker. The bridge stayed disciplined because the SLA window was unforgiving.

— The hardest moments —

There were two. The first was a backhaul issue at one of the satellite venues twelve hours before the opening match. The primary fibre uplink to the venue showed loss patterns that did not match any of the test traffic profiles, and we could not pinpoint the cause in the available window. Decision tree: keep the primary on the bench and ride the secondary, or ride the primary and pray. We did neither. The pre-staged Ubiquiti point-to-point microwave link went up in forty minutes, was traffic-balanced into the venue uplink in another twenty, and carried half the load through the match. The primary turned out to be a damaged splice in a service-provider termination — the carrier fixed it overnight and we returned to the engineered design before the next match.

The second was on the broadcast LAN during a high-profile knockout game. A configuration drift on one of the broadcast switches — a stale spanning-tree priority left over from staging — surfaced as a 200-millisecond convergence event during a switchport flap on adjacent equipment. The broadcast feed itself was unaffected because the redundant path absorbed it cleanly. But it appeared on the dashboard as a brief deviation, the host broadcaster’s engineers saw it, and the conversation that followed cost us a quiet hour. The lesson — every config snapshot at handover, every snapshot validated again pre-tournament, every deviation explained — is now standard practice on every event we deliver.

— What worked —

Pre-staging. Every venue had two of everything important on a shelf, tested in our warehouse, labelled with the venue it was earmarked for and a 30-minute install runbook. The backhaul incident is the obvious example. There were three other moments across the tournament where pre-staged kit saved a window. Pre-staging is the single most important investment for tournament-scale work, and almost every cost-cut vendor cuts it first.

Documented runbooks. Every recurring task — daily checks, change windows, escalation paths, incident response, post-match analysis, teardown — had a runbook. The runbooks were short and specific. They were tested with the team in the week before the tournament. Engineers running their twelfth hour of a shift in week two do not improvise well; they execute a runbook well. The runbooks were the difference between a tired team and a struggling team.

The SOC sitting alongside the NOC. Tournament networks are attack surfaces. Hosting a SOC inside the same operating perimeter as the NOC — physically co-located, with shared dashboards and direct voice connection — meant that the tournament defended itself in the same operating rhythm the network ran in. Threats were caught and contained inside the SLA window for every category of finding. That model is now our default for any tournament-scale work.

— What we would change —

We would stage even more spare kit. Every event teaches you that the gear you thought was excessive is the gear that saves the day. We now build a noticeably larger contingency pack into every tournament proposal and into the warehouse build-out for every multi-venue event.

We would invest more time in the broadcast LAN config snapshot regime. The spanning-tree event was caught and absorbed, but the conversation that followed was avoidable. Every switch on the broadcast plant now ships from the warehouse with a hardened configuration baseline, version-controlled, signed off and re-validated against a checklist on site before the venue goes live.

We would extend the rehearsal cycle. We rehearsed the headline scenarios — backhaul failure, AP cluster failure, broadcast LAN segmentation failure — and they all paid off. We did not rehearse a host-broadcaster equipment failure in our adjacent network, which is the scenario that produced the second hard moment. The lesson: rehearse the things that depend on partner equipment, not just our own.

— Why this matters for future tournament work —

Tournament IT is a market with very few credible operators in the region. The reason is that the work is not technically complex relative to enterprise IT — it is operationally unforgiving. The same teams who can build a 5,000-person corporate event sometimes cannot run a tournament because the operational discipline is different in kind, not in degree.

The FIFA tournament confirmed what we already knew from the earlier UFC, NBA Abu Dhabi and IIFA work, and what we have continued to refine through Saadiyat Nights and the UAE National Day events: pre-staging, runbooks, rehearsal, a co-located SOC, a disciplined bridge cadence and engineers who have been in this room before are the components that produce a quiet tournament. They are also the components that disappear first under cost pressure, which is why most tournament IT struggles in the windows where it should not.

Our model since FIFA has been to keep all six components as non-negotiable for tournament-scale engagements. The next NBA Abu Dhabi edition will look operationally identical to the one before it. The next UFC weekend will look like the last one. That predictability is the deliverable.