IT support for retail shops in Singapore
If the till cannot reach the payment host, the shop stops taking money. We provide IT support for Singapore retailers as a managed IT service: a service desk open 9am to 9pm daily, infrastructure monitoring of each outlet's network and POS, and maintenance outside trading hours.
Why a shop needs more than break-fix support
In a shop, IT is not an office convenience. If the point-of-sale terminal cannot reach the payment host, or the receipt printer is down at Saturday lunchtime, you stop taking money. Guest Wi-Fi, staff devices and payment terminals often share a small cupboard of equipment, and that is usually where the trouble starts.
Calling someone only after the till has already stopped is not enough for a shop that has to take money every trading day. Evernet provides IT support for Singapore retailers as a managed IT service: a service desk open 9am to 9pm daily, on-site visits when a remote fix is not enough, and practical work on POS networks, payment terminals and Wi-Fi. The general service is described on our IT support page. This page is about the questions a shop or a small chain should ask.
Evernet is ISO 27001 and ISO 9001 certified. We do not certify or validate PCI DSS compliance. We are not a PCI Qualified Security Assessor (QSA) or an Approved Scanning Vendor (ASV). If you take card payments, your acquirer or payment brand decides what validation they want, usually according to your transaction volume. That is usually a Self-Assessment Questionnaire that you complete as the merchant, sometimes with an ASV scan. Merchants with larger transaction volumes typically have to complete a Report on Compliance after an on-site assessment by a Qualified Security Assessor, or by an Internal Security Assessor if the acquirer or payment brand allows it. PCI DSS compliance stays your responsibility. We can help you put a clean network split in place and show you what is connected to what.
What usually goes wrong
The problems we are asked to look at are ordinary, and they are expensive when they land during trading hours:
The POS or payment terminal cannot reach the internet, often because a shared Wi-Fi network is busy, poorly placed, or was changed "just to get the guest Wi-Fi working".
Guest Wi-Fi, staff laptops and payment devices sit on the same network, so a visitor or a compromised staff laptop is closer to the till than anyone intended.
A second outlet was opened with a copy of the first network, including the same passwords and no written diagram.
A leaver still has access to the back-office mailbox or the cloud till, because nobody owns starters and leavers.
None of that requires an exotic stack. It does require someone who will draw the network, separate the functions, and come on site when the till is the problem.
What we take on
For a retailer, the useful IT support is specific:
- Getting a new outlet or a renovated shop floor onto a predictable network, with staff and guest Wi-Fi separated, before the first trading day.
- Fixing POS, receipt printer and barcode scanner problems, and payment-terminal connectivity, including on site during service hours. When the fault is in the terminal itself or the payment software, we work with your POS vendor or acquirer, who own that equipment and its security.
- Microsoft 365 or email for head office and store managers, with starters and leavers handled as a rule, not as a favour.
- Backups of the back-office data you actually need, and a restore that has been tested.
A shop should not wait for the till to fail before anyone looks at the network. Patching, tested backups, starters and leavers, and a written split between staff and guest Wi-Fi are the work between tickets. That work belongs in a managed IT service, together with the service desk and the on-site help.
Retail IT support plans: EverCare Retail Outlet Support
Two tiers, Essential and Complete, each priced per outlet, per month, with an Onsite Hours Add-on. F&B outlets with the same POS and Wi-Fi setup can use this plan too. We give you the figure once we have scoped your outlets.
Essential
The service desk, unlimited remote support for the agreed systems, infrastructure monitoring, maintenance and reporting for every outlet. On-site work is through the Onsite Hours Add-on.
Complete
Everything in Essential, plus unlimited on-site incident support at your outlets, and installation of replacement hardware you supply, during service hours.
Essential
Service desk and remote support
- Service desk by phone, email and client portal, 9am to 9pm daily, including public holidaysIncluded
- Unlimited remote support for the agreed systems, during service hoursIncluded
- Remote configuration changes to the firewall, switch and wireless access pointsIncluded
- Coordination with your internet providers, POS software vendors and payment terminal vendorsIncluded
On-site support
- Unlimited on-site incident support at your outlets, during service hoursAdd-on
- Installation of replacement hardware you supply, during service hoursAdd-on
- Project work: outlet openings, relocations, refreshes and rolloutsAdd-on
Infrastructure monitoring
- Firewall: availability, internet link, site-to-site VPN to head office, interfaces, utilisationIncluded
- Network switch: availability and portsIncluded
- Wireless access points: availabilityIncluded
- POS terminals: availability, disk, memory and CPUIncluded
- Availability alerts triaged and fixed remotely during each outlet's trading hoursIncluded
- Scheduled downtime outside trading hours, so a closed shop does not raise alertsIncluded
Maintenance, outside trading hours
- POS operating system patchingMonthly
- Firewall and switch configuration reviewTwice a year
- Firewall firmware upgradeTwice a year
- Critical firewall security updatesAs released
Reporting and inventory
- Service report: availability, incidents, patch compliance, on-site hours usedMonthly
- Hardware and software inventory of each outletIncluded
- Warranty claim coordinationIncluded
Complete
Service desk and remote support
- Service desk by phone, email and client portal, 9am to 9pm daily, including public holidaysIncluded
- Unlimited remote support for the agreed systems, during service hoursIncluded
- Remote configuration changes to the firewall, switch and wireless access pointsIncluded
- Coordination with your internet providers, POS software vendors and payment terminal vendorsIncluded
On-site support
- Unlimited on-site incident support at your outlets, during service hoursIncluded
- Installation of replacement hardware you supply, during service hoursIncluded
- Project work: outlet openings, relocations, refreshes and rolloutsAdd-on
Infrastructure monitoring
- Firewall: availability, internet link, site-to-site VPN to head office, interfaces, utilisationIncluded
- Network switch: availability and portsIncluded
- Wireless access points: availabilityIncluded
- POS terminals: availability, disk, memory and CPUIncluded
- Availability alerts triaged and fixed remotely during each outlet's trading hoursIncluded
- Scheduled downtime outside trading hours, so a closed shop does not raise alertsIncluded
Maintenance, outside trading hours
- POS operating system patchingMonthly
- Firewall and switch configuration reviewTwice a year
- Firewall firmware upgradeTwice a year
- Critical firewall security updatesAs released
Reporting and inventory
- Service report: availability, incidents, patch compliance, on-site hours usedMonthly
- Hardware and software inventory of each outletIncluded
- Warranty claim coordinationIncluded
| Included service | Essential | Complete |
|---|---|---|
| Service desk and remote support | ||
| Service desk by phone, email and client portal, 9am to 9pm daily, including public holidays | Included | Included |
| Unlimited remote support for the agreed systems, during service hours | Included | Included |
| Remote configuration changes to the firewall, switch and wireless access points | Included | Included |
| Coordination with your internet providers, POS software vendors and payment terminal vendors | Included | Included |
| On-site support | ||
| Unlimited on-site incident support at your outlets, during service hours | Add-on | Included |
| Installation of replacement hardware you supply, during service hours | Add-on | Included |
| Project work: outlet openings, relocations, refreshes and rollouts | Add-on | Add-on |
| Infrastructure monitoring | ||
| Firewall: availability, internet link, site-to-site VPN to head office, interfaces, utilisation | Included | Included |
| Network switch: availability and ports | Included | Included |
| Wireless access points: availability | Included | Included |
| POS terminals: availability, disk, memory and CPU | Included | Included |
| Availability alerts triaged and fixed remotely during each outlet's trading hours | Included | Included |
| Scheduled downtime outside trading hours, so a closed shop does not raise alerts | Included | Included |
| Maintenance, outside trading hours | ||
| POS operating system patching | Monthly | Monthly |
| Firewall and switch configuration review | Twice a year | Twice a year |
| Firewall firmware upgrade | Twice a year | Twice a year |
| Critical firewall security updates | As released | As released |
| Reporting and inventory | ||
| Service report: availability, incidents, patch compliance, on-site hours used | Monthly | Monthly |
| Hardware and software inventory of each outlet | Included | Included |
| Warranty claim coordination | Included | Included |
- Add-on: the Onsite Hours Add-on, a set number of on-site hours each month, drawn down as needed. On both tiers, outlet openings, relocations, refreshes and rollouts are project work under the add-on.
- An outlet that cannot take payment is treated as Priority 1.
- All your outlets are on the same tier.
Service hours
- Service desk: 9am to 9pm daily, including public holidays, by phone, email and client portal
- On site: during service hours, in line with your outlets' trading hours
- Outside service hours: A 24/7 emergency line is available. Work outside service hours is charged separately, so you decide when to use it.
How alerts are handled
- Availability alerts are triaged and fixed remotely during each outlet's trading hours.
- If someone needs to attend, an engineer is sent: included on Complete during service hours, and through the add-on on Essential.
- Scheduled downtime is set outside trading hours, so a closed shop does not raise alerts. Patching and firmware upgrades are scheduled outside trading hours too.
Committed response times
Measured during service hours (9am to 9pm daily) and backed by service credits if we miss one.
- P1 critical1hour
- P2 high2hours
- P3 medium4hours
- P4 low8hours
| Priority | Level | Example | Committed response time |
|---|---|---|---|
| P1 | critical | An outlet cannot take payment because the POS or payment terminals are down; a suspected security incident reported by your staff | 1 hour |
| P2 | high | An outlet's internet is down but it can still trade offline; one POS terminal has failed while another still works | 2 hours |
| P3 | medium | A receipt or label printer is down; Wi-Fi is down at one outlet | 4 hours |
| P4 | low | A staff account needs changing; a non-urgent configuration request | 8 hours |
| P5 | planned | Maintenance in an agreed maintenance window | Scheduled |
Log an incident that stops an outlet trading by phone. Our engineers make the final call on priority.
Not included
- Hardware, and licences or subscriptions for firewalls, switches, access points and POS software
- Cabling and electrical works
- Faults in third-party applications beyond first-line support and escalation to the vendor
- Outlets outside Singapore
What you provide
- A server or virtual machine to host the monitoring collector, at a site that can reach every outlet
- Administrator access to the firewalls, switches and POS terminals at your outlets
- Your outlet list and each outlet's trading hours
Customer data, PDPA and Cyber Essentials
Last reviewed: 11 November 2026. This section summarises official guidance. It is not legal advice. Sources are listed at the end of this page.
Most shops hold more personal data than they think: membership and loyalty records, delivery addresses from online orders, customer details in the POS, and CCTV footage of the shop floor. All of these can be personal data under the PDPA.
What the PDPA asks of a shop
- It applies to you. The PDPC's position is that the PDPA applies to organisations in Singapore that collect, use or disclose personal data, including small businesses. (Source: PDPC, Kickstart Your Data Protection Journey.)
- You must protect the data you hold. That means reasonable security arrangements against unauthorised access, use or disclosure. A cloud POS or e-commerce platform does not take the duty over: your organisation stays accountable, and the provider is treated as a data intermediary. (Source: PDPC, Data Protection Obligations; Kickstart Your Data Protection Journey.)
- You need a Data Protection Officer. It can be an employee or an external service provider. (Source: PDPC, Kickstart Your Data Protection Journey.)
- Some breaches must be reported. If a breach is notifiable, tell the PDPC as soon as practicable, and no later than three calendar days after the day you assess that it is notifiable. A breach is notifiable if it is likely to cause significant harm to individuals, or if it affects 500 or more people. (Source: PDPC, Report Your Organisation's Data Breach.)
- FirstAssess the breachIs it likely to cause significant harm, or does it affect 500 or more people?
- Within 3 calendar days after the day of that assessmentNotify the PDPCIf the breach is notifiable.
- At the same time, or afterNotify affected individualsWhere significant harm is likely.
Where we help, and what stays with you
In EverCare Retail Outlet Support, we:
- patch POS terminals every month and keep the firewall updated
- keep guest Wi-Fi apart from the tills and the back office
- keep an inventory of every outlet's devices, so you know what could hold customer data
- send a monthly report on availability, incidents and patch compliance
For head office, our managed IT service adds:
- MFA and unique staff accounts
- leavers removed promptly
- backups with a tested restore
If something goes wrong, we help you work out what happened, so your DPO can decide whether it is notifiable.
Your DPO, your privacy notices and consents, and any decision to notify the PDPC or customers stay with you.
Cyber Essentials: a sensible baseline
Cyber Essentials is the Cyber Security Agency of Singapore's certification mark for baseline cyber hygiene, aimed especially at SMEs. The current version, Cyber Essentials (2025), also covers cloud, AI and operational technology. Certification is done by CSA-appointed certification bodies, through an independent review of your self-assessment, and lasts two years. (Source: CSA, Certification for the Cyber Essentials Mark.)
It is voluntary unless a customer, contract or tender asks for it. It is still a useful checklist of what a shop's IT should already be doing. We can help you put the controls in place and gather the evidence. We do not certify you, and whether to apply is your decision.
Payments, guest Wi-Fi and PCI DSS
If your shop stores, processes or transmits cardholder data, the Payment Card Industry Data Security Standard (PCI DSS) is the usual baseline. The current standard is PCI DSS v4.0.1, and the requirements which were previously future-dated became effective on 31 March 2025. The PCI Security Standards Council describes PCI DSS as a set of baseline technical and operational requirements designed to protect payment account data, and says it is intended for all entities that store, process or transmit cardholder data. For validation and reporting requirements, the Council says merchants should contact their acquirer (merchant bank) or the payment brand they do business with. (Source: PCI Security Standards Council, Merchant Resources and Standards overview, pages opened 11 Nov 2026.)
- Step 1Ask your acquirer or payment provider, in writing
- Step 2Usually a Self-Assessment QuestionnaireSometimes with an ASV scan.
- Step 3Larger transaction volumes: a Report on ComplianceAfter an on-site assessment by a Qualified Security Assessor, or by an Internal Security Assessor if the acquirer or payment brand allows it.
What that means in a Singapore shop, in practice:
- Ask your acquirer or payment provider, in writing, what they expect you to complete (for example a Self-Assessment Questionnaire, an ASV scan, or a Report on Compliance by a QSA or, where they allow it, an Internal Security Assessor). Do not take a website's "you must be certified" line as the last word.
- Keep payment terminals and the systems that handle card data off the guest Wi-Fi. Guests should get a separate network that cannot reach the tills, the back-office PC, or the shared files.
- Know where card data goes. If the terminal talks directly to the acquirer and you do not store card numbers yourself, say that clearly to the acquirer and keep it true. If a back-office PC or an old till still keeps card data, that changes the work.
- Put a simple diagram in a drawer: what is on the staff network, what is on the guest network, where the firewall is, and who to call if a terminal is down.
We will help you build that split and that diagram. We will not tell you that the shop is "PCI compliant" on the back of a site visit.
IT support for retail: frequently asked questions
Can guest Wi-Fi and the payment terminals share one wireless network?
They should not. Give guests a separate network that cannot reach the terminals, the till or the back-office systems. Your acquirer may also expect that split as part of PCI DSS. Ask them what they require in your case.
Does Evernet certify us for PCI DSS?
No. PCI DSS is a standard aimed at organisations that store, process or transmit cardholder data. Your acquirer or payment brand sets the validation they want to see. We can help with the network design and the day-to-day support. We do not certify or validate PCI DSS compliance, and network work we do for you does not on its own make the shop compliant.
Do you support more than one outlet?
Yes. The important part is that each site has a clear diagram, a separate guest network, and the same standard for accounts and leavers, so a second shop does not copy the first shop's shortcuts.
Does PCI DSS apply to a small shop in Singapore?
Yes, if the shop takes card payments. PCI DSS is intended for all merchants that take cards, whatever their size. Your acquirer or payment brand decides what validation they want, usually a Self-Assessment Questionnaire that you complete as the merchant, sometimes with an ASV scan. Ask them in writing.
What if we only use a portable card reader and a phone?
PCI DSS is intended for all merchants that take cards, whatever their size. Check with the provider of the reader and with your acquirer. Even then, staff devices and any guest Wi-Fi should not be an afterthought.
What is the difference between Essential and Complete?
Both include the service desk, unlimited remote support for the agreed systems, infrastructure monitoring, maintenance and reporting. Complete adds unlimited on-site incident support at your outlets, and installation of replacement hardware you supply, during service hours. On Essential, on-site work is through the Onsite Hours Add-on.
Are alerts raised when an outlet is closed?
No. Scheduled downtime is set for each outlet outside its trading hours, so a closed shop does not raise alerts. You confirm trading hours when we start, and tell us when they change.
Can F&B outlets use this plan?
Yes, if they run the same kind of POS, payment terminal and Wi-Fi setup as a retail outlet.
Does the PDPA apply to a small shop?
Yes. The PDPC's guidance is that the PDPA applies to organisations in Singapore that collect, use or disclose personal data, whatever their size. Membership lists, online orders and CCTV footage can all be personal data.
What is Cyber Essentials, and do we need it?
It is the Cyber Security Agency of Singapore's certification mark for baseline cyber hygiene, aimed especially at SMEs. It is voluntary unless a customer, contract or tender asks for it. Certification is done by a CSA-appointed certification body and lasts two years. We can help you put the controls in place. We do not certify you.
Sources
All pages opened 11 November 2026.
- PCI Security Standards Council, Merchant Resources
- PCI Security Standards Council, Standards overview
- PCI Security Standards Council, Just Published: PCI DSS v4.0.1
- PCI Security Standards Council, guidance that the future-dated v4.x requirements became effective on 31 March 2025
- PCI Security Standards Council, Qualified Security Assessors
- PCI Security Standards Council, Approved Scanning Vendors
- PCI Security Standards Council, FAQ: Do small merchants with limited transaction volumes need to comply with PCI DSS?
- PDPC, Kickstart Your Data Protection Journey
- PDPC, Data Protection Obligations
- PDPC, Report Your Organisation's Data Breach
- CSA, Certification for the Cyber Essentials Mark
- CSA press release, 15 April 2025, Cyber Essentials and Cyber Trust marks expanded
Talk to us about your outlets
The call is free. On it, we look at how your outlets are set up today, scope the paid IT assessment that a managed service starts with, and tell you which tier we would recommend and why.