In this guide · 8 sections
- 01What a small office network needs
- 02ISP router vs business-grade gateway
- 03Access points vs mesh Wi-Fi
- 04Separate networks: staff, guest and devices
- 05Security settings that matter on office Wi-Fi
- 06Office network budget: approximate equipment prices
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
For 5 to 30 people, use a business-grade gateway and ceiling-mounted access points wired back with Ethernet, with three networks: staff, guest (isolated) and devices (printers, CCTV, smart TVs). Use WPA3 where devices support it, change every default password and keep firmware updated.
What a small office network needs
A small office network has four jobs: connect staff reliably, give visitors internet without access to anything else, keep printers and cameras working without exposing them, and be manageable by someone who is not a full-time IT person.
| Part | What it does | Typical small-office choice |
|---|---|---|
| Fibre ONT | Brings the internet line in | Supplied by the fibre provider |
| Gateway / router | Firewall, internet sharing, networks and VLANs | Business-grade gateway, or the ISP router for very small teams |
| Switch | Wired ports for PCs, access points, printer | PoE switch so access points get power over the cable |
| Access points | Wi-Fi coverage | Ceiling-mounted units, one per area of roughly a few meeting rooms |
| Cabling | Connects access points and desks | Ethernet runs to each access point and fixed desk |
If you are setting up a new office from scratch, our new company IT setup cost guide puts the network in context with laptops, email and accounts.
ISP router vs business-grade gateway
The router your fibre provider supplies is built for homes. It is fine for two or three people, but offices outgrow it quickly.
Keep the ISP router if
- You have 1 to 5 people and no servers or cameras
- Everyone works in one room
- Nobody will manage a separate device
- A guest network is the only extra you need
Move to a business gateway if
- You need separate staff, guest and device networks
- Several access points must work as one system
- You want central updates, alerts and logs
- You have a NAS, CCTV or VoIP phones
Business gateways from vendors such as Ubiquiti, TP-Link Omada, Fortinet or Cisco Meraki manage the firewall, multiple networks and the access points from one dashboard. Pick one ecosystem so the gateway, switch and access points are configured in the same place.
Access points vs mesh Wi-Fi
Mesh kits pass data between units over Wi-Fi, which costs speed with each wireless hop and suffers in offices full of glass partitions and steel. Wired access points send everything back over Ethernet and use Wi-Fi only for the last few metres to your laptop.
Wired ceiling access points
Recommended- Stable speeds in every room
- Powered over Ethernet from the switch
- Needs cabling, often during renovation
- Central management and roaming
Best for: Offices you will stay in for 2+ years.
Wireless mesh kit
- No new cables
- Quick to set up
- Speed drops with each wireless hop
- Consumer models offer limited network separation
Best for: Short leases and very small offices.
Separate networks: staff, guest and devices
The single most useful security step is splitting one flat network into three. On business gear each network is a VLAN with its own Wi-Fi name and firewall rules.
- Staff network: company laptops and desktops. Strong passphrase changed when staff leave, or individual logins on larger setups.
- Guest network: visitors and personal phones. Internet only, with client isolation so devices cannot see each other.
- Device network: printers, CCTV recorders, smart TVs, door access and other IoT. Staff can print, but devices cannot start connections to laptops.
Shops and clinics should give POS terminals their own network too, as covered in our retail shop IT security guide. If you only need a quick fix for an over-shared password, our guest Wi-Fi guide walks through it on common routers.
Security settings that matter on office Wi-Fi
CSA's Cyber Essentials mark is the Singapore baseline for SMEs. For networks it expects default passwords to be changed, insecure configurations fixed (including old WEP Wi-Fi upgraded to WPA2 or WPA3) and firmware kept up to date. Our Cyber Essentials checklist lists every requirement.
Office network security checklist
Office network budget: approximate equipment prices
Prices below are examples from Ubiquiti's Singapore online store, including GST, approximate, as of October 2026. Other vendors are in a similar range; installation and cabling are extra and vary with the site.
- Cloud gateway (small office, 300+ clients)UniFi Cloud Gateway UltraS$219
- Wi-Fi 7 access point, compactU7 LiteS$164 each
- Wi-Fi 7 access point, higher capacityU7 ProS$329 each
- PoE switchPowers access points over EthernetVaries by port count
- Ethernet cabling and installationDepends on ceiling access and number of runsQuoted per site
Example: gateway + 2 compact access pointsAbout S$547 before switch and cabling
Equipment only. Prices change and items go out of stock; check the store on the day you buy.
Do it yourself or get help?
If someone in the office is comfortable with router settings, a single-vendor system with a cloud dashboard is manageable in-house. The common mistakes are skipping network separation, leaving default passwords and forgetting firmware updates.
For a one-off fix, such as setting up a guest network or replacing a failing router, a Quick Fix (1 hour) (S$119) is usually enough. Our Security Health Check (S$290) reviews your router, Wi-Fi, printers and cameras against the Cyber Essentials baseline and gives you a prioritised list of fixes.
Frequently asked questions
For a very small office or a short lease, a mesh kit can be fine. For most offices, wired ceiling access points are more reliable, because mesh units pass traffic to each other over Wi-Fi and lose speed with every hop. If you can run Ethernet to each access point, do it, ideally during renovation.
Use WPA3 on networks where all devices support it, and WPA2 with AES where older laptops, printers or scanners do not. Many access points offer a mixed WPA2/WPA3 mode. Never use WEP or an open network. CSA's Cyber Essentials treats old WEP Wi-Fi as an insecure configuration that must be fixed.
It depends on walls, layout and how many devices connect, not just floor area. Glass partitions, concrete walls and lift lobbies all reduce coverage. A one-floor office of 10 to 20 people often needs two or three ceiling access points. A quick site survey with a Wi-Fi analyser app shows where signal drops.
For one to five people with no servers or cameras, usually yes, as long as you change its admin password, update its firmware and use a separate guest network. Once you need separate networks for devices, several access points or central management, a business-grade gateway is the better choice.
Printers, cameras and smart devices often run old software and are rarely updated. On the same network as staff laptops, a compromised device gives an attacker a foothold next to your files. A separate device network lets staff print while blocking devices from reaching laptops or the internet more than they need.