The OSI model is the vocabulary of network engineering. When one engineer tells another "that's a layer 2 problem," both know where to look. This article covers what the seven layers are, which protocols live at each, how the model maps onto the four-layer TCP/IP model the internet actually runs on, and how to use the layers to find a fault.

Common causes of network issues

1. DNS

“Before you do anything, check DNS. It's always DNS.”

— Every network engineer, ever

In our experience more tickets end at DNS than at any other single cause, and it looks like a total outage: everything below is working and the client still can't turn a name into an address.

If the address answers and the name doesn't, stop looking at cables and routes. The fault is the resolver, the forwarder it uses, the DHCP option that handed it out, or a filter eating the reply.

nslookup unifiedit.tech     # resolves? who answered?
ping 1.1.1.1                # path up, by address?
ping cloudflare.com         # same path, by name?
ipconfig /flushdns          # drop a stale answer

dig unifiedit.tech +short   # resolves? to what?
ping -c 3 1.1.1.1           # path up, by address?
ping -c 3 cloudflare.com    # same path, by name?
sudo killall -HUP mDNSResponder   # drop a stale answer

dig unifiedit.tech +short   # resolves? to what?
ping -c 3 1.1.1.1           # path up, by address?
ping -c 3 cloudflare.com    # same path, by name?
resolvectl status           # which resolver is in use
resolvectl flush-caches     # drop a stale answer

After DNS, the usual suspects, each with the layer it lives at:

2. DHCP. No lease, or a lease from the wrong server: the client has a 169.254 address or the wrong gateway. Layer 7, but it travels by broadcast, so it's confined to one VLAN unless a relay carries it.
3. The wrong VLAN or a dead port. No link light, a port negotiated down to 100 Mb/s, or a port tagged for the wrong network. Layers 1 and 2.
4. Gateway, mask or route. The client reaches its own subnet and nothing else. Layer 3.
5. A firewall rule. Everything resolves, everything pings, one application fails. Layer 4.

The OSI model

The Open Systems Interconnection (OSI) model is a reference model that divides network communication into seven layers, each with a defined job. The International Organization for Standardization published it as ISO 7498 in 1984; today it is ISO/IEC 7498-1, and the ITU-T publishes the same text as X.200. Each layer serves the layer above it, rides on the layer below, and talks only to its peer on the other machine.

It is a model, not a protocol: nothing on your network runs OSI. Its value is vocabulary, and product names borrow it: a layer 3 switch, a layer 4 load balancer, a layer 7 firewall.

The seven layers, top to bottom, with the unit of data each one handles.

The wrapping is called encapsulation. The application hands its data to the transport layer, which puts a TCP or UDP header in front of it: a segment (TCP) or a datagram (UDP). The network layer puts an IP header in front of that: a packet. The data link layer adds an Ethernet header in front and a frame check sequence behind: a frame. The physical layer turns the frame into bits. The receiver peels each header off in reverse, and each layer reads only its own.

The seven layers, bottom up, because that is the order you troubleshoot in: a cable that is not plugged in explains every symptom above it.

Layer 1 — Physical

Moves bits across a medium: copper, glass or air. The physical layer defines connectors, pinouts, voltages, light wavelengths, radio channels and bit timing. Cables, patch panels, transceivers, media converters and repeaters are layer 1 devices. The unit is the bit.

Protocols: Cat6 (100 m) · OM4 (multimode) · OS2 (single-mode) · SFP+ (10G optic) · 802.3 (Ethernet PHY) · 802.11 (radio) · PoE (802.3bt)

The part of the network you can trip over: a handhole on a campus fiber run, and single-mode patch cords landing in a distribution panel.

How it fails: no link light, a port flapping, a link negotiating at 100 Mb/s instead of 1 Gb/s, a kinked fiber, a cheap patch cord, a PoE budget that is already spent. First check: the port's status and negotiated speed on the switch, its CRC and error counters, the optic's receive power, and then swap the cable.

Layer 2 — Data link

Delivers frames between devices on the same network segment, addressed by MAC address. Switches, bridges and access points are layer 2 devices. ARP sits on the boundary between layers 2 and 3: it is how a host finds the MAC address behind an IP address. The unit is the frame.

Protocols: Ethernet (802.3) · Wi-Fi (802.11) · VLAN (802.1Q) · STP (802.1D) · RSTP (802.1w) · LACP (802.1AX) · ARP (RFC 826) · MAC (48-bit)

Every lit port is a layer 2 segment. The VLAN on each port decides which network its frames belong to. Photo: David Farkas, Unsplash.

A frame is the packet with an Ethernet header in front and a check sequence behind. A switch reads the two MAC addresses and nothing else.

How it fails: a port in the wrong VLAN, a native VLAN mismatch on a trunk, a spanning-tree loop that takes a building down, a MAC address flapping between two ports, an SSID mapped to the wrong VLAN, a client with no DHCP lease because no DHCP server or relay is on its VLAN. First check: the port's VLAN membership and tagging, the switch's MAC table, the spanning-tree state, and the ARP table on the client.

Layer 3 — Network

Gets a packet from one network to another. Every host has an IP address and a mask, and together they say which addresses are local and which need a router. Anything not local goes to the default gateway, and from there every router on the path reads one thing, the destination address, and forwards the packet one hop closer. Routers and layer 3 switches live here; so does ICMP, which is why ping and traceroute are layer 3 tools. The unit is the packet.

Protocols: IPv4 (RFC 791) · IPv6 (RFC 8200) · ICMP (ping · traceroute) · IPsec (ESP · IKEv2) · OSPF (IP proto 89) · BGP (TCP 179)

Two networks with the internet between them. Every router on the path reads one thing, the destination address. The gateway also rewrites the source on the way out, which is why the server only ever sees 203.0.113.10.

A packet is the segment with an IP header in front. A router reads the destination address, lowers the TTL by one and forwards; it never looks inside the payload.

How it fails: a wrong mask or gateway, a route that exists in one direction only, two sites sharing a subnet across a VPN, a tunnel MTU nobody lowered. First check: ping the gateway, then something past it; traceroute to see where the replies stop; read the routing table at both ends, because the far side has to route back.

Layer 4 — Transport

Gets data to the right program on the right host. IP delivers to a machine; transport delivers to a port, which is how one server runs the web on 443 and mail on 587 at the same address. TCP is the careful one: it opens a connection with a handshake, numbers every byte, resends what goes missing and backs off when the path is congested. UDP is the fast one: it sends and does not look back, which is what voice, video and DNS want. QUIC rebuilds TCP's guarantees on top of UDP and carries HTTP/3. Stateful firewalls, NAT and load balancers all decide here, by port. The unit is the segment (TCP) or the datagram (UDP).

Protocols: TCP (RFC 9293) · UDP (RFC 768) · QUIC (RFC 9000) · Ports (0–65535)

One MacBook, three conversations. DNS asks once over UDP and gets one answer. The search needs every byte, so TCP connects first and acknowledges everything. The call needs now more than complete, so UDP streams and never looks back. The port on each end says which program is talking.

How it fails: a firewall rule on the port, a NAT table that is full, asymmetric routing through a stateful firewall, and packet loss, which TCP hides as slow rather than down. First check: does the port answer at all; then the firewall logs, then the retransmission counters.

nc -zv mail.example.com 587   # does anything answer on the port?
ss -tan state established     # what is connected right now?

Layer 5 — Session

Opens, maintains and closes the dialogue between two applications. On a TCP/IP network this work happens inside the application protocol or a library, which is why the TCP/IP model has no session layer at all. Layers 5 and 6 are thin in practice and matter mostly as vocabulary.

Protocols: RPC · NetBIOS (139) · SIP (5060 · 5061) · SOCKS (1080) · PPTP (legacy)

Layer 6 — Presentation

Translates data between the form the application uses and the form that crosses the network: character encoding, serialization, compression and encryption. TLS is most often placed here, though it fits several places (see the questions below). Certificate errors, cipher mismatches and encoding bugs are presentation layer faults.

Protocols: TLS 1.3 (RFC 8446) · UTF-8 · ASN.1 · JSON · JPEG · gzip

Layer 7 — Application

The protocols that applications speak. Not the application itself: the browser is not layer 7; HTTP is. Proxies, web application firewalls, DNS filters and firewalls that identify applications work here. The unit is data.

Protocols: DNS (53) · HTTP (80) · HTTPS (443) · DHCP (67 · 68) · SMTP (25 · 587) · IMAP (993) · SSH (22) · NTP (123) · SNMP (161) · RDP (3389) · SMB (445)

One page load touches four layers in order: DNS and HTTP at 7, TLS at 6, TCP at 4, IP under all of it. The first step is the one that fails most.

How it fails: DNS. Also an expired certificate, an HTTP 5xx, a proxy nobody documented, a DHCP scope with no leases left. First check: dig, then curl -v, then the server's own logs.

The TCP/IP model

The TCP/IP model, also called the Internet protocol suite, is the four-layer model the internet actually runs on. RFC 1122, Requirements for Internet Hosts, set it down in 1989 with four layers: link, internet, transport and application. TCP/IP had been running on the ARPANET since January 1, 1983; the model describes protocols that existed, not services that ought to.

You will also meet a five-layer version in textbooks, which splits link into physical and data link. Cisco's curriculum teaches the four. Both are fine; say which one you mean.

Link — OSI layers 1 and 2

Everything it takes to move a frame across one physical network: the medium, the MAC addresses, the switches between them. RFC 1122 says little about this layer on purpose. IP was built to run over whatever link is there, and it has: Ethernet, Wi-Fi, fiber, cellular, a tunnel across someone else’s network. ARP lives here, turning a next-hop IP address into a MAC address on the local segment.

Protocols: Ethernet (IEEE 802.3) · Wi-Fi (IEEE 802.11) · ARP (RFC 826) · PPP (RFC 1661)

Internet — OSI layer 3

IP and its helpers: ICMP for errors and diagnostics, and the routing protocols that fill the tables IP forwards by. Its one promise is to carry a packet from any host to any other host across any number of networks, best effort: no guarantee it arrives, arrives once, or arrives in order. Every layer above is built on that being enough.

Protocols: IPv4 (RFC 791) · IPv6 (RFC 8200) · ICMP (RFC 792) · ICMPv6 (RFC 4443)

Transport — OSI layer 4

End to end between programs, by port. TCP adds the connection, the ordering and the retransmission that IP leaves out; UDP adds only the ports and a checksum; QUIC rebuilds TCP’s guarantees on top of UDP. This is the last layer most of the network reads: stateful firewalls, NAT and load balancers decide by port and look no further.

Protocols: TCP (RFC 9293) · UDP (RFC 768) · QUIC (RFC 9000) · SCTP (RFC 9260)

Application — OSI layers 5 to 7

Whatever the program speaks, including the jobs OSI gives to the session and presentation layers. HTTP, DNS, TLS, SSH and SMTP all sit here together. The model has no separate layer for encryption or encoding because the protocols that need them carry their own.

Protocols: HTTP (RFC 9110) · DNS (RFC 1035) · TLS 1.3 (RFC 8446) · SSH (RFC 4253) · SMTP (RFC 5321)

OSI vs. TCP/IP

The two models disagree in two places. Session and presentation fold into the application because in real protocols that work happens inside HTTP, inside SMTP, or inside a library such as TLS. Physical and data link merge because the suite says nothing about the wire: the same IP packet crosses copper, fiber and radio unchanged.

How the seven OSI layers map onto the four TCP/IP layers.

Use both: OSI is the vocabulary, TCP/IP is what runs. When a firewall rule or a job posting says layer 4, it means the OSI number.

| Layer | Unit | Identifier | First check | | --- | --- | --- | --- | | 7 Application | Data | Hostname, URL | DNS, certificate, server logs | | 6 Presentation | Data | — | Cipher, certificate, encoding errors | | 5 Session | Data | — | Timeouts, authentication, RPC binding | | 4 Transport | Segment, datagram | Port | Port open, firewall logs, retransmits | | 3 Network | Packet | IP address | Ping the gateway, traceroute, routes, MTU | | 2 Data link | Frame | MAC address | VLAN on the port, MAC table, STP, ARP | | 1 Physical | Bits | — | Link light, speed, CRC counters, optic levels |

Which layer is…

The questions that come up most, answered with the OSI number first and the TCP/IP layer second.

• DNS. Layer 7, application. UDP and TCP port 53; DNS over TLS on 853; DNS over HTTPS on 443.
• DHCP. Layer 7, application, on UDP 67 and 68. It discovers a server by broadcast, so it is confined to one VLAN unless a relay forwards it.
• ARP. Between layers 2 and 3; engineers say layer 2.5. It maps an IPv4 address to a MAC address and carries no IP header, so TCP/IP places it in the link layer. IPv6 replaces it with Neighbor Discovery, which runs over ICMPv6 at layer 3.
• TLS. Most often layer 6, presentation; some texts say 5. In TCP/IP it is application. It sits between TCP and HTTP, which is the useful fact.
• ICMP. Layer 3, network. Ping and traceroute.
• VLANs (802.1Q). Layer 2, data link.
• MAC address, layer 2. IP address, layer 3. Port number, layer 4. Hostname and URL, layer 7.
• A switch works at layer 2. A layer 3 switch also routes between VLANs, in hardware. A router works at layer 3. A firewall works at layers 3 and 4 when it is stateful and at layer 7 when it identifies applications. A load balancer works at layer 4 (by port) or layer 7 (by URL or header). An access point works at layers 1 and 2.
• NAT. Layer 3 when it rewrites addresses and layer 4 when it also rewrites ports, which is what every office gateway does.
• QUIC. Layer 4, transport, carried in UDP. HTTP/3 runs on it.
• OSPF and BGP. Routing protocols serve layer 3. OSPF rides directly on IP as protocol 89; BGP rides on TCP port 179. Ask what they do, not what they ride on.

Troubleshooting with the model

Three ways to walk a problem, and one rule that comes first.

1. DNS first. Resolve a name, ping an address, ping a name.
2. Bottom up when nothing works. Link light, negotiated speed, VLAN on the port, MAC table, IP address and mask, default gateway, ping the gateway, ping past it, port open, application. Each step proves the layer under it.
3. Top down when one thing is broken. If other applications work from the same host, layers 1 to 4 are proven. Start at 7: the name, the certificate, the server.
4. Divide and conquer when you have no idea. Ping the default gateway. Success proves layers 1 to 3 on your side of it; failure sends you down, not up.

In a UniFi network each layer has a place where it shows itself: port status and negotiated speed for layer 1, the client list and VLAN assignment for layer 2, the gateway's routes for layer 3, the firewall rules and their hit counters for layer 4, and the DNS and application logs for layer 7.

Questions engineers ask

Is the OSI model still used?

As vocabulary, everywhere. No network runs the OSI protocols; every network runs TCP/IP. The seven layer numbers are how engineers, vendors and standards say where a device or a fault sits.

Why does TCP/IP have four layers and OSI seven?

OSI was designed before its protocols existed; TCP/IP was written down after its protocols were running. Session and presentation turned out to live inside applications, and the medium turned out not to matter to IP, so TCP/IP never separated them.

Which OSI layer is DNS?

Layer 7, the application layer. It is also the first thing to check when a network is down.

What is the difference between a frame, a packet and a segment?

The same data at three layers. Segment: the transport unit (TCP; UDP says datagram). Packet: the segment with an IP header. Frame: the packet with an Ethernet header and trailer.

What is a layer 3 switch?

A switch that also routes between VLANs in hardware, so inter-VLAN traffic never leaves for a router. Layers 2 and 3 in one box.

Is TLS layer 6 or layer 7?

Textbooks disagree: most say 6, some say 5, the TCP/IP model says application. All agree where it sits: between TCP and the application protocol.

How we help

When a network is down, our TAC answers with an engineer who walks these layers for a living, and our security audit reads a UniFi configuration layer by layer, from port security to DNS filtering. If you want your own team to think this way, we teach it.

Sources

Every layer, protocol and header in this article is defined in one of the documents below. Where the article and a textbook disagree, the document wins.

• ISO/IEC 7498-1, Open Systems Interconnection, Basic Reference Model, 1994 · also ITU-T X.200
• RFC 1122, Requirements for Internet Hosts: Communication Layers, 1989
• RFC 1123, Requirements for Internet Hosts: Application and Support, 1989
• RFC 791, Internet Protocol, 1981
• RFC 8200, Internet Protocol, Version 6, 2017
• RFC 9293, Transmission Control Protocol, 2022
• RFC 768, User Datagram Protocol, 1980
• RFC 9000, QUIC: A UDP-Based Multiplexed and Secure Transport, 2021
• RFC 1035, Domain Names: Implementation and Specification, 1987
• RFC 7858, DNS over TLS, 2016
• RFC 8484, DNS Queries over HTTPS, 2018
• RFC 2131, Dynamic Host Configuration Protocol, 1997
• RFC 826, Address Resolution Protocol, 1982
• RFC 4861, Neighbor Discovery for IPv6, 2007
• RFC 8446, TLS Protocol Version 1.3, 2018
• 802.1Q, Bridges and Bridged Networks (VLANs), IEEE
• 802.3, Ethernet, IEEE
• 802.11, Wireless LAN, IEEE

Most grant money for a city or county network project does not arrive from a federal website. It comes through the state, in windows that open once a year and close within weeks, under rules that change between cycles. This is what was open, closed or pending on October 9, 2026, checked against the agencies' own pages. The dates and figures are theirs; the reading of them is ours.

Federal cybersecurity money: SLCGP

The State and Local Cybersecurity Grant Program put $1 billion into state and local cyber projects over four years, FY2022 through FY2025. Only the state applies, and it must pass at least 80% to local governments, including 25% of the award to rural areas. The money buys assessments, multi-factor authentication, logging, backups, endpoint detection, replacing end-of-life gear that faces the internet, and a move to a .gov domain. The FY2025 round carried a 40% match.

Its status is the part to read twice. The program's authorization lapsed on September 30, 2026, the third lapse in a year, and the PILLAR Act that would extend it passed the House in November 2025 and has not moved in the Senate. No new federal money has been appropriated. Money already awarded to states keeps flowing, and FY2025 funds can be spent through August 2029. In Florida, FDEM runs the pass-through. Its last window, for FY2023 funds with a 20% match, closed December 15, 2025 and funded two things: hardening control systems and OT, and local law enforcement networks. FDEM says the FY2024 round opens in 2026 and that every applicant reapplies each cycle.

Florida's own program buys the tools for you

Florida's Local Government Cybersecurity Protection Program is state money, in statute since July 1, 2026, run by the Florida Digital Service. It does not send a check. FLDS buys the capability on your behalf and you get the tool, with no local match. Any Florida local government may apply; fiscally constrained counties get priority, and past grantees are told to apply again. It will not pay for tools you already own, and every grantee shares telemetry with the state Cybersecurity Operations Center. Year 4, $15 million for SFY 2026-27, opened July 10 and closed August 31, 2026, with awards due by December 1 and software access in June 2027. The last two windows ran July to August and the statute requires awards by December 1 each year, so plan on summer 2027.

Rural buildings, and the equipment inside them

USDA Community Facilities funds essential community facilities in towns of 20,000 or fewer: fire, rescue and public safety, health, and the major equipment needed to run them. A network qualifies as part of the building it serves, not on its own. Municipalities, counties, districts and tribes apply through the USDA Rural Development office for their state. The grant share runs from 15% to 75% on a sliding scale by population and median household income; the rest can be a USDA direct loan.

Libraries have their own program

If the city runs the public library, E-Rate covers the library, not the city. A library qualifies if it is eligible for LSTA assistance and its budget is separate from any school. Category two pays for the switches, access points and cabling inside the building at a discount of 20% to 90% set by the local school district's lunch-program figures. The FY2026 to FY2030 budget is $5.43 per square foot with a $30,175 floor. You must post a Form 470 and wait 28 days before choosing a vendor.

Cameras and physical security

Camera and access-control projects for public safety sit under FEMA's Homeland Security Grant Program, $1.064 billion in FY2026. The state applies and must pass 80% of its SHSP and UASI funds to local governments within 45 days. Physical security enhancement equipment, CCTV and access controls included, is an allowable cost, and cybersecurity is a national priority area with no minimum spend. FY2026 awards were announced on September 23, 2026, so the next chance is the FY2027 round, through your state's administrative agency.

What BEAD is not

BEAD is $42.45 billion to reach addresses with no broadband. The state applies and picks the providers; Florida's final proposal was approved in January 2026. Unless your city is itself the provider, it is not your program.

What to have ready

Every window above closes within weeks of opening, and each application asks for the same things. A scoped project with a one-page design and a bill of materials, so the budget line survives review. An inventory of what you have, because the state program will not fund what you already own and the federal one wants an assessment first. A current SAM.gov registration, renewed every 365 days; a subrecipient needs at least the Unique Entity ID. And the match, if there is one, in next year's budget before the award letter arrives.

How we help

We scope the project and write what the application needs: the design, the bill of materials, the assessment that shows the gap. Talk to us before the window opens, not after.

Sources

Checked October 9, 2026.

• CISA, State and Local Cybersecurity Grant Program
• FEMA, FY 2025 SLCGP notice of funding opportunity
• Congress.gov, H.R. 5078, PILLAR Act, all actions
• FDD, Federal grant program's third lapse endangers state cybersecurity, October 5, 2026
• Florida Division of Emergency Management, State and Local Cybersecurity Grant Program
• Florida Digital Service, Local Government Cybersecurity Protection Program
• Florida House, final bill analysis, CS/CS/HB 1085 (2026)
• 7 CFR 3570, Community Facilities: 3570.53, 3570.61, 3570.62, 3570.63
• 47 CFR 54, E-Rate: 54.501, 54.503, 54.505
• USAC, Category Two budgets and eligible services overview
• FEMA, Homeland Security Grant Program and the FY 2026 HSGP notice of funding opportunity
• NTIA, BEAD program and BroadbandUSA newsletter, January 2026
• SAM.gov, Entity registration

In modern industrial environments, the boundary between Information Technology (IT) and Operational Technology (OT) is more interconnected than ever. Yet, this convergence often brings uncertainty around who owns what, particularly when it comes to cybersecurity, compliance, configuration, and maintenance.

To address this, Unified IT llc created the IT ↔ OT Responsibility Matrix, a visual framework that establishes clear lines of accountability between IT and OT teams.

The Framework: Built on the Purdue Model

The matrix leverages the Purdue Enterprise Reference Architecture, a well-recognized model for defining industrial control system (ICS) layers, from Level 0 (Process) to Level 4 (Enterprise Systems) and the DMZ in between.

Each layer lists key assets (such as pumps, PLCs, SCADA systems, servers, and databases) and assigns responsibility across governance and operational domains, including:

Governance: Physical Security, Cybersecurity, Compliance, and Operations

Domains: Design, Budget, Procurement, Configuration, Implementation, and Maintenance

By distinguishing between IT, OT, and shared IT/OT responsibilities, the matrix provides a single, transparent view of how control, accountability, and collaboration flow across the organization.

Download the full IT ↔ OT Responsibility Matrix Template (.xlsx) using the link at the bottom of this article.

Key Benefits

Eliminates Overlap and Confusion

Teams know exactly which group is accountable for each asset and function. No more finger-pointing when something goes wrong.

Strengthens Cybersecurity Posture

Defines ownership of cybersecurity responsibilities across both IT and OT systems. When a vulnerability is discovered, there is zero ambiguity about who acts.

Simplifies Cross-Department Collaboration

Encourages coordination between engineering and IT teams, especially around shared infrastructure such as virtualization, networks, and cybersecurity.

Improves Governance

Supports compliance and audit readiness by formalizing operational and technical ownership across every layer of the Purdue Model.

Example Insights

Level 0–1 (Plant Floor): OT holds full responsibility for process devices and control logic: pumps, valves, actuators, sensors, PLCs, and RTUs.

Level 2–3 (Supervisory & Operations): IT begins to share responsibility, especially for networking, virtualization, and cybersecurity. OT retains ownership of SCADA software and operational systems.

Level 3.5 (DMZ): Shared accountability between IT and OT ensures secure data flow between plant and enterprise systems. This is the most critical collaboration zone.

Level 4 (Enterprise): IT assumes full responsibility for corporate infrastructure: databases, workstations, operating systems, networking, and cybersecurity.

Conclusion

The IT ↔ OT Responsibility Matrix is a governance tool for the modern industrial enterprise. By clearly delineating roles across both technical and operational domains, it helps organizations operate more securely, efficiently, and collaboratively.

The IT ↔ OT Responsibility Matrix eliminates the gray areas between IT and OT teams, turning ambiguity into accountability.

Framework: IT-OT-RM Version 1.0, created by Unified IT llc.

Unified IT today announced its certification as a UniFi Certified Partner, recognizing the company's expertise in designing and deploying enterprise-grade Ubiquiti networking solutions.

What this means

As a UniFi Certified Partner, Unified IT gains:

• Early access to new UniFi enterprise products
• Direct escalation path to Ubiquiti engineering
• Priority support for large-scale deployments
• Co-marketing opportunities

Our track record

This certification reflects our growing portfolio of enterprise UniFi deployments across healthcare, education, government, and commercial sectors. Over the past year, we've deployed UniFi infrastructure in:

• 15+ healthcare facilities
• 8 K-12 school districts
• Multiple government buildings
• Dozens of commercial offices and warehouses

Looking ahead

This partnership strengthens our ability to deliver cost-effective, enterprise-grade networking solutions to organizations of all sizes. We remain committed to honest, engineering-first recommendations: UniFi where it's the right fit, and alternative platforms where it's not.