What to Check During an Office Move to Avoid Network Security Gaps

An office move is more than desks, phones and a new internet connection. It is a change to the physical foundations of your network—and, if those foundations are rushed, it can create security gaps that are difficult to see until something goes wrong.

Unlabelled patch panels, undocumented switch ports and a spare cable plugged into the wrong socket can undermine even a well-planned security design. Physical infrastructure is part of cybersecurity, not a separate facilities concern. A cabling fault can cause an outage; a poorly controlled connection can also give an unauthorised device a path into the network.

This guide covers the practical checks to make before, during and after an office move. Use it as a comms room checklist, and treat cabling inspection and switch configuration as security tasks—not just items on the contractor’s snagging list.

Why the physical layer belongs in your security plan

Firewalls and endpoint detection platforms are essential, but they cannot compensate for every weakness in the physical network. A firewall can only enforce the traffic rules it has been given. An endpoint detection platform can only provide useful visibility for devices it can identify and monitor. Neither makes an unmanaged switch safe, repairs a badly patched connection or tells you what is connected to an undocumented wall port.

Physical-layer faults also create security blind spots. A faulty link, intermittent connection or unexpected switch can interrupt monitoring, bypass intended traffic paths or leave teams unsure which device is connected where. During an incident, that uncertainty costs time. When a business is already under pressure, a “mystery cable” is not a minor housekeeping issue; it is an investigative obstacle.

ACSC guidance is built on the assumption that an organisation understands and controls its network. That means having sound foundations: known devices, documented connections, secure configurations and an intentional design. Moving offices is a chance to establish those foundations—or to carry old problems into a new building.

Before the move: establish what you have and what you need

Build an accurate inventory

Start with the current network, not the floor plan. Record the equipment and services that must move, including routers, firewalls, switches, wireless access points, voice systems, servers, printers, access control, cameras and operational technology (OT) devices. Note the business owner, support contact and security requirements for each system.

Confirm which devices are managed by your organisation and which belong to a landlord, internet provider or building contractor. An “existing” switch in a ceiling void or riser is not automatically safe to use. Identify who owns it, who can administer it and whether it is approved for your environment. Unmanaged switches in production make it harder to enforce segmentation, troubleshoot faults and establish accountability.

Map traffic and dependencies

Document the networks and connections your business depends on. Include corporate users, guests, voice, printers, building systems, security devices and any OT networks. Record which systems need to communicate, which should remain isolated and where internet access is required.

Do not rely on assumptions such as “the printer is on the office network” or “the building controls are separate”. Verify the actual connections and rules. A network diagram should show how traffic is intended to flow, not merely where equipment sits.

Agree the design before ordering or installing

Work with your network and security teams to confirm the design, port capacity, cable types, wireless coverage and redundancy requirements. Specify managed switches that support the features your design depends on, such as VLANs, access controls, monitoring and secure administration. Products from vendors such as Cisco may suit some environments; for industrial or harsh conditions, MOXA equipment may be appropriate. The correct choice depends on requirements, lifecycle support and how the device will be managed—not just the brand name.

For any OT or building-management connection, agree the boundaries with the relevant system owner. Do not assume that a device is safe to connect to the corporate LAN because it uses an Ethernet cable. If a system has specialist support constraints, capture them in the design and change plan.

Comms room checklist: inspect the destination before installation

A tidy comms room is easier to secure and troubleshoot. Before equipment is installed, confirm the room is suitable, access-controlled and ready for the systems it will house.

• Access: Confirm who can enter the room, how access is recorded and how contractors will be supervised. Remove access for people who no longer need it.
• Power: Check outlets, circuit capacity, UPS coverage and shutdown procedures. Confirm which equipment must stay online during a power event.
• Cooling and environment: Verify ventilation, temperature monitoring, dust control and any site-specific environmental needs.
• Racks and space: Ensure racks can be secured, equipment can be mounted safely and there is room to work without blocking airflow.
• Connectivity: Confirm provider hand-off points, fibre routes, demarcation boundaries and any building-managed infrastructure.
• Labelling: Label racks, patch panels, cable ends and equipment consistently. Keep labels readable and match them to the network documentation.
• Physical protection: Check that exposed ports and spare connections are controlled, and that cabling cannot be casually unplugged or accessed by visitors.

Take photographs before and after the installation. Keep them with the rack layout, port schedule and change records. A labelled patch panel is not just tidier: it helps responders isolate a connection quickly when something fails at 2am.

Cabling inspection: check the path, not just the endpoint

A cabling inspection should cover the full route from the comms room to the outlet or device. Ask a competent installer to verify cable type, termination, testing results and compliance with applicable building requirements. Identify fibre and copper runs clearly, and ensure the records match the final installation—not the original plan.

Pay particular attention to shared spaces, ceiling voids and risers. Check that cables are secured, protected from damage and separated appropriately from electrical services. Confirm that building contractors have not left temporary links, undocumented patch leads or small switches behind. These are common sources of accidental connectivity and confusing fault investigations.

At the outlet end, record what each port is intended to serve. Where practical, disable unused switch ports and have a process for authorising new connections. Physical access to a socket should not automatically mean unrestricted access to sensitive systems.

It is tempting to call cabling “just plumbing”. That misses the point: a cable is a pathway into a network. Its location, termination and ownership affect both availability and security. If a link is intermittent, an endpoint may disappear from monitoring; if an unapproved device is connected, it may create a route that was never part of the design.

Switch configuration: make the design real

Segmentation depends on capable switching and correct design. A diagram showing separate networks is not enough; the switch configuration must enforce those boundaries consistently across the site.

Before deployment, review the switch configuration against an approved baseline. Check that management interfaces are restricted to authorised administration networks, unused services are disabled, administrative credentials are unique and secure, and firmware is supported and current. Avoid default credentials and shared accounts that make actions difficult to trace.

Confirm that access ports are assigned to the correct VLANs and that trunk ports carry only the VLANs they need. Review how guest Wi-Fi, corporate endpoints, voice, printers, cameras and building systems are separated. Where the design calls for restrictions between segments, verify that the controls are implemented—on the switches, firewalls or other appropriate enforcement points—and tested.

Also check logging, time synchronisation, configuration backups and monitoring. A switch that forwards traffic but provides no useful records can leave responders with little evidence when investigating an incident. Store configuration backups securely and make sure they can be restored, not merely exported.

During the move, use a controlled change plan. Record which ports are changed, by whom and when. Validate the final configuration against the approved design, then update diagrams and port schedules. If a contractor proposes a quick workaround, assess its security impact before allowing it into production.

Plan for devices people often overlook

Moves tend to expose systems that were installed years ago and then forgotten. Check for printers, meeting-room equipment, door access controllers, CCTV, environmental sensors, lift interfaces, kitchen systems and building-management devices. Confirm the owner and support arrangement for each one, and determine whether it needs network access at all.

For each device, ask:

• What information or service does it need to reach?
• Does it need internet access, or only communication with a local controller?
• Who is responsible for firmware, credentials and security updates?
• Can it be placed in an appropriate, restricted network segment?
• How will the team know if it goes offline or behaves unexpectedly?

These questions are especially important for OT and building systems, where availability and vendor constraints may influence the design. Keep them documented rather than making ad hoc exceptions during installation.

Move-day checks: control the change

Prepare a sequence for disconnecting, transporting, reconnecting and testing equipment. Define who is authorised to make network changes and how the team will communicate if the plan needs to change. Keep an up-to-date contact list for the network provider, building management, installers and system owners.

Before going live, verify that the following match the approved https://www.cyberdaily.au/strategy/14271-why-physical-network-infrastructure-is-the-overlooked-foundation-of-your-cybersecurity-strategy design:

1. Firewall connections and rules, including any temporary rules added for the move.
2. Switch uplinks, VLAN assignments, port descriptions and management access.
3. Wireless networks, authentication and guest access boundaries.
4. Critical services such as identity, DNS, DHCP, telephony and business applications.
5. Monitoring coverage, including endpoint detection platforms and network alerts.
6. Access to comms rooms, cabinets and other network equipment locations.

Test both normal operation and the boundaries that are meant to protect systems. For example, confirm that a guest device cannot reach internal business services and that a device on a restricted segment cannot communicate with systems outside its approved scope. Record test results and any exceptions.

After the move: prove, document and tidy up

Once users are settled, compare the live environment with the approved design. Reconcile switch ports against the port schedule, confirm there are no unknown devices and remove temporary cables and rules. Update asset inventories, diagrams, configuration backups and support documentation. Store records where the people responsible for operations and incident response can find them.

Review alerts and endpoint visibility for gaps. If devices have changed address, subnet or location, ensure monitoring and detection policies still apply. Follow up any intermittent links rather than treating them as harmless: repeated physical-layer problems can obscure whether a device is failing, disconnected or simply not being observed.

Close out contractor access and recover temporary credentials. Confirm that default accounts have been changed or disabled and that ongoing support arrangements are clear. An office move is not complete when the internet works; it is complete when the environment is known, controlled and supportable.

A practical office move checklist

Area What to confirm Evidence to keep Inventory and design Devices, owners, dependencies, network segments and approved traffic flows are documented. Asset register, diagrams and approved design. Comms room Access, power, cooling, rack space, provider hand-off and physical protection are suitable. Room checklist, access record and photographs. Cabling inspection Routes and terminations are tested, labelled and free of unauthorised or temporary connections. Test results, cable schedule and patch-panel records. Switch configuration Ports, VLANs, trunks, management access, credentials, logging and backups match the design. Configuration baseline, change record and backup. Security validation Firewall policies, endpoint visibility, segmentation and monitoring work as intended. Test results, alert checks and approved exceptions.

Make the move an improvement, not a reset

An office move can reveal inherited risks that have been hidden by familiarity: an unknown switch, an unlabelled panel, an unused port that is still live or a building system attached to the wrong segment. Treat each discovery as a chance to improve the design and records, rather than carrying it forward because “it has always worked”.

Good security depends on knowing what is connected, where it connects and what it is allowed to reach. That starts with sound physical infrastructure and a network design that the installed equipment can actually enforce. Label the cables, verify the switch configuration and test the boundaries. And before signing off, ask the question that matters when the office is empty and something fails: what happens at 2am?