The Customer Network Change Authorization SOP

Purpose

This SOP governs every change a tech makes to a customer's router or home network: a Wi-Fi setting, a DHCP reservation, a guest network, a port setting, a firmware update on the router itself. It guarantees four things. The customer agreed to the change before it was made, the original settings can be put back by anyone, everything else in the house still works when the tech leaves, and the shop can show afterwards exactly what it touched. Without it, a tech fixes the thermostat by changing a Wi-Fi setting, the customer's work laptop stops connecting that evening, and nobody can say what the old setting was. The shop owns a problem it cannot even describe.

Scope

Covers: any change made in the router's admin pages, in the internet provider's app that manages the router, or on mesh or extender units; and any action that interrupts the home's internet, including a planned router restart.

Does not cover:

• Joining your own device to the customer's Wi-Fi using the password they give you. That is commissioning. See related: The Connected Device Commissioning SOP.
• Remote triage over the phone. See related: The Connected Device Service Call Triage SOP.
• Work on a business network with its own IT provider. Hand that to the provider; do not log in.
• Deciding whether network work is in the job at all, and how it is priced. See related: Writing the Scope Line for Network and App Setup.

Roles and responsibilities

The handoff that matters is tech to customer at Step 4 and back again at Step 8. The admin password stays with the customer the whole time; the tech is a guest in the router, not its keeper.

Procedure

Step 1: Confirm the change is needed for this job

Write down, in one sentence, which device on this job needs which network change and why: "Water shutoff needs to join the 2.4 GHz network; router broadcasts one combined name and the valve cannot join it." Acceptance: the sentence names a device you are installing or servicing and a specific setting. Wrong looks like: "the network is slow," "their channel is crowded," or a fix to a device you were not called for. That is not a reason under this SOP; mention it to the customer as a separate quote and stop here. There is no physical hazard in this step, but there is a scope one: an unrequested change is the one most likely to break something the customer depends on and you never knew about.

Step 2: Confirm who can authorize it

Ask whose network it is. Acceptance: the person consenting is the account holder or the homeowner, or has their authority. Wrong looks like: a renter whose router belongs to the landlord, a teenager at home alone, a house sitter, or a router the internet provider manages and locks. Stop and get the right person on the phone, or skip the change and record why. Logging into a router without the owner's authorization can fall under the federal Computer Fraud and Abuse Act, 18 U.S.C. 1030, and under state computer-access laws layered on top of it, which in some states reach further than the federal floor. Authorization from the right person is what makes the login lawful. This is not legal advice; if the authority question is genuinely unclear, do not log in.

Step 3: Explain the change and what it can disturb, then get consent

Say in plain words what you will change, what else it could affect, and for how long. A DHCP reservation affects nothing else. Splitting a combined Wi-Fi name into two bands may make some devices need to rejoin. A router restart or firmware update takes the whole house offline for 2 to 10 minutes. Ask specifically whether anything in the house depends on the internet for safety: an internet phone used for emergency calls, an alarm that reports over the internet, a medical device that uploads readings. If one does, the interruption waits until the customer agrees a time and has a backup, such as a mobile phone with signal. Acceptance: the customer can say back what will change, and consents in writing (signature on the work order, a checked box in the app, or a reply text). Wrong looks like: "just do whatever you need." That is not informed consent; explain the specific change and ask again.

Step 4: Get admin access without taking the password

Ask the customer to log into the router or its app themselves, or to type the admin password while you look away. Never write down, photograph or save the password. Acceptance: the router's admin pages are open on screen. Wrong looks like: the customer does not know the admin password (distinct from the Wi-Fi password, which they usually do know). Check the router's label for a default admin password; if it works, carry on, and in Step 8 recommend they change it. If the label password fails, or the provider manages the router and locks it, stop. Do not factory reset the router to get in: a reset wipes the internet connection settings, every reservation, every device's saved Wi-Fi, and possibly the provider's provisioning, taking the whole house offline in a way that may need the provider to fix. Record the stop, tell the customer what they need (the password, or a call to their provider), and book a return.

Step 5: Record the original settings before touching anything

Photograph or screenshot every page you will change, showing the existing values, and note the router's firmware version from its status page. If the router can export a configuration backup file, export it and leave it with the customer, not with the shop. Acceptance: a "before" image exists for every field you will change, with its value legible. Wrong looks like: a page you plan to change that you have not captured. Do not proceed until it is captured. Keep the images free of passwords: if a page shows the Wi-Fi or admin password in clear text, crop it out or cover the field before taking the photo, because the shop should never hold either.

Step 6: Make one change at a time and save each

Change one setting, save it, wait for the router to apply it (some restart the radio for up to a minute), and confirm the device it was meant for now does what Step 1 said. Acceptance: the target device behaves as intended, for example the valve shows online in its app. Wrong looks like: the change did not help, or the router warns it will restart when you expected it not to. If the change did not help, put it back from the Step 5 record before trying anything else, so that two untested changes are never stacked. If the router announces an unexpected restart, cancel and go back to Step 3: you have not warned the customer about a full outage.

Step 7: Test the target device and the rest of the house

Confirm the target device is online and working, then check at least two other devices the customer already relies on, chosen from different parts of the house: the customer's phone on Wi-Fi, a TV, a work laptop, a camera. Load a web page on one of them. Acceptance: the target device and both existing devices online, and a page loads within a few seconds. Wrong looks like: any existing device that was online before is now offline. Revert the last change from the Step 5 record and retest; if reverting does not bring it back, tell the customer now, while you are on site, rather than leaving it for them to discover.

Step 8: Hand back and close out

Show the customer what changed on the screen, log out of the admin pages, and give them the change record. If they used a default admin password from the label, recommend they set their own and offer to walk them through it, with them typing. Acceptance: the customer has seen the change, the admin session is closed, and the record is signed or acknowledged. Wrong looks like: the admin pages left logged in on the customer's computer, or on your tablet. Close them before you leave the room.

The record this produces

One change record per visit, filed to the customer's equipment record:

The next tech reads it before touching the same router, and it answers "what did you change" if the customer calls a week later. The service manager reads a month of them, looking for missing before images, which is the field that matters most and gets skipped first.

Worked pass

A tech installs an automatic water shutoff in a basement. The valve will not connect to the home Wi-Fi.

Step 1. Reason recorded: "Shutoff valve supports 2.4 GHz only; router broadcasts one combined network name; valve fails to join. Needs a separate 2.4 GHz network name, or a temporary split to join." Passes: named device, named setting.

Step 2. The homeowner is home and is the internet account holder. Passes.

Step 3. The tech explains that adding a separate 2.4 GHz network name should not affect existing devices, but that some routers restart their radios when the setting is changed, which would drop Wi-Fi for about a minute. The tech asks about safety-dependent devices; the homeowner says the alarm system reports over the internet and has a cellular backup, and the home phone is a mobile. Consent given by checking the box on the work order at 10:42. Passes.

Step 4. The homeowner knows the Wi-Fi password but not the router's admin password; the provider installed the router two years ago. The label shows a default admin password; the tech has the homeowner type it, and the router rejects it. The provider's app on the homeowner's phone shows the router but not the band settings. Step 4 fails and takes its stop rule. The tech does not reset the router. Recorded: "Stop at Step 4. Label admin password rejected; provider app does not expose band settings. Customer to call provider to request a 2.4 GHz network name or the admin password."

Steps 5 to 8 are not run, and the record says so rather than leaving them blank.

Exception path. Before leaving, the tech confirms the valve works in its local mode (the leak sensors still close it without the internet) and tests it with a wet sensor: the valve closes in about 20 seconds and reopens from its button. The customer is told plainly that remote alerts and app control will not work until the valve is on the network. The office books a 30-minute return once the customer has heard from the provider.

Re-reading the procedure against the pass. The stop came at the step built to catch it, and the record shows why, so the return visit starts at Step 4 instead of from scratch. A tech who reset the router at Step 4 would have taken down the alarm's internet path, the TV and every device in the house to connect one valve, without consent for any of it, and Step 5 would have had nothing to capture because the reset would already have erased it.

References

• Computer Fraud and Abuse Act, 18 U.S.C. 1030, and your state's computer-access law
• See related: The Connected Device Commissioning SOP
• See related: IP Addresses and Why a Device Disappears
• See related: The Customer Network Is Not Your Job Until It Is
• See related: Writing the Scope Line for Network and App Setup