In this guide · 8 sections
Short answer
Put guests, staff devices, CCTV and smart devices, and payment terminals on separate networks using VLANs and separate Wi-Fi names, with firewall rules that block traffic between them by default. PCI DSS doesn't require segmentation, but without it your whole network is in scope.
Why a flat network is risky
On a flat network, every device can see and talk to every other device. The guest's phone on Wi-Fi can find your NAS login page; a cheap camera with an old firmware bug sits next to the accounts PC.
| Weak point | What can happen on a flat network |
|---|---|
| Guest Wi-Fi | Visitors' infected devices can scan and attack office PCs, printers and storage |
| CCTV recorders and IP cameras | Often run outdated firmware; once compromised, they're a foothold into the office network |
| Smart TVs and IoT devices | Rarely updated and easy to forget, but connected to everything |
| Staff laptops | One phishing click can spread ransomware to shared drives and other PCs |
| Card terminals and POS | Everything that can reach them may fall into scope for card security checks |
Segmentation doesn't stop every attack, but it limits how far one problem spreads. Our guide to setting up an office network and Wi-Fi covers the hardware side.
VLANs and SSIDs in plain English
A VLAN (virtual LAN) splits one physical network into several separate logical networks. Devices on different VLANs can't talk to each other unless your router or firewall allows it. An SSID is a Wi-Fi network name; business access points can broadcast several, each mapped to its own VLAN.
- Managed switch: needed to put wired devices (CCTV recorder, POS, printers) into the right VLAN by port.
- Business router or firewall: routes between VLANs and applies rules that block or allow traffic.
- Access points with multiple SSIDs: for example Office, Guest and Devices, each tied to a VLAN.
- Client isolation on guest Wi-Fi: stops guest devices from seeing each other as well.
Many consumer routers only offer a basic guest network, which is better than nothing but usually can't separate CCTV or POS. If yours can't create VLANs, that's a reason to upgrade the router and switch.
A sensible network layout for an SME
Most small offices, clinics and shops can use four or five segments:
| Segment | What goes on it | Allowed to reach |
|---|---|---|
| Staff | Company laptops and desktops | Internet, printers, the file server or NAS |
| Guest Wi-Fi | Visitors' and staff personal phones | Internet only |
| Devices / IoT | CCTV recorder, IP cameras, smart TVs, door access | Internet for updates only; staff can view CCTV through a specific rule |
| Payments | Card terminals and the POS system if networked | Only the payment provider's services |
| Servers / management | NAS, router and switch admin interfaces | Only from named admin devices |
Set the router so traffic between segments is blocked by default, then add only the specific rules you need, such as staff laptops reaching the printer. If you run a retail shop, our guide to retail IT security for POS and Wi-Fi covers shop-specific risks.
What PCI DSS expects for card terminals
PCI DSS is the card industry's security standard, which your payment provider expects you to follow. Version 4.0.1 (June 2024), available from the PCI SSC document library, says segmentation of the cardholder data environment (CDE) from the rest of the network is not a PCI DSS requirement, but is strongly recommended because it can reduce assessment scope, cost and risk. Without adequate segmentation, the standard says, the entire network is in scope.
- Wireless: requirement 1.3.3 says network security controls must sit between all wireless networks and the CDE, with wireless traffic into the CDE denied by default and only traffic with an authorised business purpose allowed.
- Testing segmentation: requirement 11.4.5 says that if segmentation is used to isolate the CDE, penetration tests on the segmentation controls are performed at least every 12 months and after changes. Simpler self-assessments may differ, so ask your acquirer what applies to you.
- Fewer systems touching card data: the standard notes that a PCI-listed point-to-point encryption (P2PE) solution can significantly reduce the requirements that apply to a merchant.
The PCI Security Standards Council's own blog makes the same point: segmentation is not required, but minimising the systems with access to card data reduces cost and effort (PCI SSC blog). For most small merchants, the practical step is to keep card terminals off the guest and staff networks entirely, or on the provider's own connection.
How to set it up, step by step
Plan on paper first; most mistakes come from moving devices without knowing what they need to reach.
List every connected device
Laptops, phones, printers, NAS, CCTV recorder and cameras, smart TVs, door access, card terminals, POS. Note who uses each and what it must talk to.
Check your router and switches support VLANs
Look for VLAN, multiple SSID and inter-VLAN firewall rule settings in the admin pages or manual. Replace consumer gear if needed.
Create the VLANs and Wi-Fi names
Give each segment its own VLAN and, for wireless, its own SSID with a strong WPA2 or WPA3 password.
Set default-deny rules between segments
Block all traffic between VLANs, then add specific allow rules, such as staff to printer, or one admin PC to the CCTV recorder.
Move devices one segment at a time
Start with guest Wi-Fi, then IoT and CCTV, then payments. Check each still works before moving the next.
Lock down admin access
Router, switch, NAS and recorder admin pages reachable only from named admin devices, with default passwords changed.
Test that the separation actually works
A setting that looks right can still leak. Test from each segment after setup and after every network change.
Isolation test checklist
Do it yourself or get help?
If your router and access points support VLANs and you're comfortable in their admin pages, a small office can be segmented in a day. The risk is locking yourself out or breaking the card terminal, so plan changes outside business hours and keep a note of the old settings.
Our Security Health Check (S$290) reviews your domain, website and email from outside, checks workspace settings such as MFA, sharing and admin roles, looks for breach exposure, and gives you a plain-English PDF report ranked by risk with a fix list you can do yourself or order from us. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront and brief us in writing.
Frequently asked questions
Network segmentation means splitting one network into separate parts so devices in one part can't freely reach devices in another. In a small office that usually means separate segments for staff devices, guest Wi-Fi, CCTV and smart devices, and payment terminals, with firewall rules deciding what may pass between them. It limits how far an infection or intrusion can spread.
It's a good start, because visitors can't reach office devices if the guest network is properly isolated. But a basic guest network doesn't separate CCTV recorders, smart TVs or card terminals from staff laptops. For that you need VLANs on a business router and managed switch, with rules blocking traffic between segments by default.
No. PCI DSS v4.0.1 says segmentation of the cardholder data environment is not a requirement but is strongly recommended, because without it the entire network is in scope for assessment. It does require network security controls between all wireless networks and the cardholder data environment, and penetration tests of segmentation controls where segmentation is used.
Often, if you're using consumer routers. You need a router or firewall that supports VLANs and rules between them, access points that can broadcast several Wi-Fi names mapped to VLANs, and managed switches for wired devices such as CCTV recorders and POS. Many business-grade routers and access points support this out of the box.
Connect a phone to the guest Wi-Fi and try to open your printer, NAS, router and CCTV recorder pages by their addresses; none should load. Run a free network scanner app on the guest network; it shouldn't find office devices. Repeat after any router change, and record the date and results.