Setting Up IT for a New Office: A Practical Playbook

Plan backward from the circuit — it is always the long pole

Every new-office project runs on two clocks. One is the lease and buildout schedule everybody watches. The other is the telecom provisioning clock, which nobody watches until it is too late to change anything. The circuit is almost always the long pole in the tent, and the single most common reason a new site opens without working internet is that someone ordered the fiber four weeks before move-in instead of four months.

Plan the timeline backward from the day people need to work, not forward from the day you sign the lease. Rough lead times to budget for:

• Dedicated fiber (DIA) with new construction: 60 to 120 days is normal, and longer if the carrier has to trench, permit, or build lateral into the building. If the address has no existing fiber entrance, treat this as the constraint that sets your entire schedule.
• Existing lit building: 30 to 60 days once the carrier confirms the demarc and the building's meet-me room has capacity.
• Broadband or fixed wireless as a bridge: days to a couple of weeks, which is why it belongs in the plan as a temporary primary or a permanent backup, never as an afterthought.

Order circuits the moment the lease is signed and the demarc location is known. Get the Letter of Authorization and Facility Connection (LOA/CFA) sorted early, confirm whether the building charges for cross-connects, and ask the carrier for a firm Firm Order Commitment date in writing. For multi-site organizations, this is also the point to fold the new location into the existing WAN design rather than bolting it on later. A coherent global network is built one site at a time, and the new office should inherit the same standards as the rest of the estate.

Figure: sequence the work by lead time, not convenience — the items that take months to deliver have to be ordered first.

Structured cabling and the comms room

While the circuit is in the carrier's queue, get the physical layer built. This is the one part of the stack you cannot patch remotely or rebuild in a maintenance window, so specify it to a standard the first time.

• Run Cat6A to every desk and access point. The incremental cost over Cat6 is small next to the labor of the pull, and it protects the drop for 10 Gigabit and the next two generations of WiFi.
• Run single-mode fiber in the backbone between the main comms room and any satellite closets. The distance and speed ceiling is then set by the optics you plug in, not the glass in the wall.
• Honor the 90-meter horizontal limit. Place an intermediate closet wherever a drop would exceed it. Skipping a closet to save floor space produces out-of-spec runs that fail certification and underperform.
• Design the comms room for the rack, not the room. Provision dedicated power on its own circuit, a UPS sized for the switch and PoE load, active cooling, and a grounding busbar. Under-cooled closets are a leading cause of premature switch failure.
• Label both ends of every run and keep as-built records. A certified but unlabeled cable plant is nearly as painful to work in as an untested one.

Insist that every run is certified to its category standard and that the test results are archived. Those results are the baseline you compare against the first time a link degrades a year from now.

Network gear and segmented WiFi and VLANs

With cabling in and the circuit pending, stage and configure the active gear. A clean small-office stack is a resilient firewall, one or two managed core switches, PoE access switches for the edge, and enough access points for real coverage rather than the vendor's optimistic square-footage math.

The design decision that matters most is segmentation. A flat network where the guest laptop, the badge reader, the CFO's workstation, and the security camera all share one broadcast domain is a breach waiting to spread. Separate traffic into VLANs from day one:

• Corporate — managed endpoints and internal services.
• Guest — internet-only, isolated from everything internal, with client isolation on the wireless side.
• IoT and building systems — cameras, badge controllers, sensors, and printers, which are notoriously unpatched and should never touch the corporate VLAN.
• Voice — if you run phones or UCaaS, keep them on their own VLAN with QoS.
• Management — switch, AP, and firewall management interfaces, reachable only from an admin path.

Enforce the boundaries between VLANs at the firewall with explicit allow rules, not a permissive any-to-any policy that quietly defeats the whole exercise. Broadcast a separate SSID for guest and, where you can, for IoT, and map each SSID to its VLAN. This is segmentation done at the point of setup, when it costs nothing, rather than retrofitted after an incident. It is also the physical foundation for a zero trust posture: identity- and device-based access only works when the network underneath it is already carved into enforceable zones.

Redundant internet that actually fails over

One circuit is a single point of failure for the entire office. Two circuits from the same carrier over the same last-mile path are barely better — a backhoe does not care that you bought two contracts. Real redundancy means diversity:

• Two carriers whose fiber enters the building through different paths where possible, or a primary fiber circuit paired with fixed-wireless or cellular backup that uses a genuinely separate medium.
• Automatic failover, not a manual cutover nobody remembers how to perform at 9 a.m. on a Monday. SD-WAN is the clean way to do this: it steers traffic across both circuits, fails over in seconds when one degrades, and can load-share so the backup link is not sitting idle and untested until the day you need it.
• Verify the failover before go-live. Pull the primary circuit on purpose during setup and confirm sessions survive. An untested backup is an assumption, not a control.

Physical security and access control

The network is only as secure as the room it lives in. Physical controls go in during the buildout because retrofitting them means opening walls again.

• Lock the comms room and put it on the access-control system, not a key that circulates. Log who enters.
• Access control at the doors. Badge or mobile credentials with a controller that integrates with your identity system, so onboarding and offboarding a person also grants or revokes their building access.
• Cameras with sensible retention, covering entrances, the comms room, and any area holding sensitive assets — placed on the IoT VLAN, never the corporate one.
• Environmental monitoring in the comms room: temperature, humidity, and water-leak sensors that alert before heat or a burst pipe takes down the rack.
• A UPS on the core stack with runtime long enough to ride out a short outage or trigger a graceful shutdown.

The go-live checklist

Before you tell people the office is open, confirm the following:

1. Primary and backup circuits are live and failover has been tested by physically pulling the primary.
2. All cabling is certified and labeled, with test results archived.
3. VLANs and firewall rules are in place, and inter-VLAN boundaries have been verified with an actual connectivity test, not just a config review.
4. WiFi coverage is validated with a walkthrough survey in real conditions, not modeled on a floor plan.
5. Endpoints are enrolled in management and monitoring, patched, and running endpoint protection.
6. Access control and cameras are commissioned and tied to your identity and offboarding process.
7. Monitoring and alerting are on for circuits, switches, APs, and the comms room environment, so day-two problems page someone instead of surprising a user.
8. A short runbook exists documenting the demarc location, circuit IDs, IP plan, VLAN map, and vendor contacts.

Open the office once, and open it right

A new office is a rare chance to build the network the way it should have been built everywhere — segmented, redundant, documented, and monitored from the first day rather than patched toward that state over years. The projects that go smoothly are the ones that respect the circuit lead time, treat cabling and the comms room as permanent infrastructure, and bake segmentation and redundancy into the design instead of adding them after the first outage. That is exactly the kind of work that benefits from a partner who has stood up sites before and will still be operating this one next year. If you have a location opening this year, talk to our team early — while the circuit clock still has slack in it.