# Where do I start segmenting a flat office network?

Start with the systems whose loss would hurt most and the devices you trust least. A practical order for a small company: put guests and personal devices on their own network with internet access only; move printers, cameras, screens and other IoT devices into a device network that cannot start connections to PCs; put servers, especially backups, file servers and the domain controller, in a server network that PCs can reach only on the ports they need; and give administration its own path. Each step is useful alone, and most managed switches and firewalls can do it with VLANs and rules. Before you write rules, look at who actually talks to whom, so that you do not break a forgotten dependency, such as a scanner that saves to a file share. The NetSenX network map shows the hosts on monitored segments and who talks to whom, on every plan, which gives you that starting picture and then shows whether the new boundaries hold.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/where-to-start-segmenting-a-flat-office-network

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [How do I segment IT and OT with VLANs and access lists?](https://netsenx.com/en/faq/how-to-segment-it-and-ot-with-vlans-and-acls)
- [What is microsegmentation, and do small companies need it?](https://netsenx.com/en/faq/what-is-microsegmentation)
- [Is a VLAN a security boundary?](https://netsenx.com/en/faq/is-a-vlan-a-security-boundary)
- [How do I check that guest Wi-Fi cannot reach our internal network?](https://netsenx.com/en/faq/how-to-check-guest-wifi-cannot-reach-the-internal-network)
- [Is a separate guest Wi-Fi enough for security?](https://netsenx.com/en/faq/is-a-separate-guest-wifi-enough)