Key takeaways

  • Order internet circuits first. Carrier lead times are often the longest item on the whole schedule.
  • Plan cabling, power and the network room before walls close, because fixing them later costs far more.
  • Build the office from a standard: managed devices, central identity, multifactor sign-in, patching and backups from day one.
  • CIS Controls v8 gives a practical order of work, starting with inventory of devices and software, then access control and data protection.
  • A turnkey model puts one accountable team in charge from design through the first day and the support that follows.

Start with the answer: treat IT as a work stream that starts when you pick the space, not when the furniture arrives. Order the internet service first, design cabling and the network room with the architect, build every device and account to a written standard, and turn on security basics before the first employee logs in. A single accountable team running all of it, the turnkey approach, avoids most delays.

Before you sign the lease

  • Ask the landlord which carriers are in the building and where the entry point is. A building with one carrier means one choice and one failure point.
  • Check space for a network room: power, cooling, a lockable door and room for racks.
  • Confirm rules on rooftop equipment, wireless links and cabling through shared spaces.
  • Ask about building access hours for installers and about freight elevators.

Circuits and connectivity

Carrier installation can take weeks or months, depending on whether fiber is already in the building. Order a primary circuit and a second one from a different carrier or a different technology, such as fixed wireless or cellular as a backup. Use the second link for failover, and test failover before opening day. Get the carrier handoff details early so the firewall and router can be configured in advance.

Cabling, power and the network room

Cable once and cable well. Run certified cabling to every desk, meeting room, printer and wireless access point location, with spares. Label both ends. Add power protection with a battery backup in the network room, and plan for cooling. Decide where cameras, door controllers and phones will connect, since each needs a port and often power over Ethernet.

Network and Wi-Fi

Design the network in segments: staff, guests, voice, cameras and building systems, each separated by firewall rules. Guests never touch the staff network. Survey the space before placing access points, then verify coverage and speed after installation. Use business grade firewalls and switches with central management, and enable logging.

Identity and access

CIS Controls v8 puts account management and access control near the top for good reason. Create the new office accounts in your central identity system. Require multifactor authentication for everyone, use named accounts with least privilege, and keep administrator accounts separate from daily accounts. Write a joiner, mover and leaver process so people are added and removed on time.

Devices and software

The first control in CIS v8 is an inventory of enterprise assets, and the second is an inventory of software. Keep a list of every laptop, phone, printer, access point and camera with an owner. Buy standard hardware, enroll it in device management before it ships, apply disk encryption, and enforce patching and a standard application set. Prepare devices at your own facility so they arrive ready to use.

Security controls on day one

  • Endpoint protection with central reporting on every device.
  • Email filtering and protection against phishing, with staff training in the first week.
  • Firewall rules that block by default and allow by need, with remote access only through a managed VPN or a secure access service.
  • Backups for the data that matters, with a restore test before opening, not after an incident.
  • Logging and alerting sent to a place someone actually watches.
  • A short written incident plan with phone numbers, and an owner for each step.

Voice, printing and the rest

Decide how phones will work, whether in Teams, a hosted system or both, and port numbers early. Plan printers, conference room systems, badge readers, cameras and the guest experience. Each one is a networked device that needs a place in the inventory and a patch plan.

Physical security

A fine firewall does not help if the network room is unlocked. Lock the room, control who has keys or badges, place cameras at entry points, and plan visitor sign-in. Keep a clean desk and screen lock policy from the start.

The turnkey schedule

Work backwards from the opening date. Circuit orders go first, then design and approvals, cabling during construction, equipment staging off-site, installation and testing, then a dry run with real users and a short list of fixes. Run a go-live checklist: Wi-Fi in every room, failover, phones, printing, email, remote access and backups restored.

Our team plans, builds and supports new offices as one project, from the first site visit to the first week of support. We can walk your space and give you a checklist tailored to it.

Sources

This article is general information, not legal advice. Standards and vendor documentation change; confirm current requirements with your regulator, counsel and IT provider. Last reviewed .

Keep reading

Need help with this?

We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.

Managed IT Services