Most of the money and nearly all of the grief in an office network are decided before anyone pulls a cable. The building determines which internet providers can reach you and how quickly. The ceiling and the walls determine what cabling costs. The furniture plan determines where the drops go. So the practical order is: check the building, order the internet, design the cabling and the rack, then design Wi-Fi, security and segmentation around them.
This checklist follows that sequence for a new office, warehouse or clinic, and ends with a move-day timeline you can print. It gives cost drivers rather than prices, because installations are quoted from a drawing and a site visit, not a rate card. For the people side of IT, see our guides on managed IT costs and hourly IT support rates.
Decisions to make before you sign the lease
Walk the space with the technical questions in hand, and get the answers in writing before the offer is binding. Four matter most:
- Internet. Which carriers already serve the building? Is there fibre terminated inside, or would it have to be brought in from the street? Where is the demarcation point, and can you reach it?
- Riser and cable routes. Can you get cable from the demarcation point to your suite, and from your rack to every desk? Open ceilings are easy; hard-lid drywall, exposed concrete and demising walls are not. Ask what the landlord allows for penetrations, core drilling and fire stopping.
- Electrical and cooling. Is there a dedicated circuit near where the rack would go, and will that room stay cool when the building HVAC shuts down evenings and weekends?
- The rules. Which contractors are allowed on site, what hours can they work, and who owns the cabling when the lease ends?
Internet and backup connectivity
The CRTC set Canada’s universal service objective in 2016: fixed broadband of at least 50 Mbps download and 10 Mbps upload, with an unlimited data option, for homes and businesses. Treat that as a floor for basic service, not a target for an office. What usually matters more than the headline download number:
- Upload speed. Video calls, cloud backups and file sync all push data out. A connection with a small upload will feel slow no matter how big the download is.
- Dedicated or shared. Ask whether the speed is guaranteed or best-effort over shared capacity, and what the service-level commitment and repair times are.
- A second path. A backup connection is only a backup if it doesn’t share a cable, a conduit and a provider with the first one. A second carrier, or an LTE/5G failover device, keeps you trading when the primary circuit is cut.
- Static IP addresses, if you host anything on site or need to allow-list your office.
Order the circuit as soon as you have a signed lease and a suite number. Everything else can be compressed; carrier construction cannot.
Structured cabling basics
Structured cabling is the one part of the network you install once and live with for the length of the lease. The TIA-568 cabling standards set the geometry: a permanent link — the fixed cable from the patch panel to the wall outlet — must not exceed 90 metres, and the full channel including patch cords at both ends must not exceed 100 metres. That constraint, more than anything else, decides where the rack goes.
A few decisions drive the rest:
- Category. Category 6A is specified to carry 10GBASE-T over the full 100-metre channel; Category 6 manages 10 Gb only over shorter distances. Since the labour is identical, the higher category is usually worth it for access-point drops and long runs.
- Fibre. Use it for links between floors or buildings and for switch uplinks, where copper distance limits or electrical noise make twisted pair a poor fit.
- Power over Ethernet. Cameras, access points, phones and door readers can draw power from the same cable. IEEE 802.3af supplies up to 15.4 W per switch port, 802.3at (PoE+) up to 30 W, and 802.3bt up to 60 W (Type 3) or 90 W (Type 4). Add up what your devices draw before choosing switches, and check the switch’s total power budget as well as its per-port rating.
- Flame rating. In Canada, communications cable is covered by CSA C22.2 No. 214, and how it’s installed in a building falls under the Canadian Electrical Code. Cable run through air-handling (plenum) ceiling spaces needs a different flame rating from cable in a riser, and the two are not interchangeable. Your installer should confirm which applies in your building.
- Labelling. The ANSI/TIA-606 administration standard exists so every cable, outlet and patch panel port carries a durable, legible identifier at both ends. Insist on it. An unlabelled rack costs you on every service call for years.
Ask for two drops at every desk rather than one: the second is cheap while the crew is on site and expensive afterwards. Add drops for printers, access points, cameras, TVs and reception, and ask for certification test results on every run rather than a visual inspection.
Where the rack goes, power and cooling
Equipment mounts in a 19-inch rack — the 482.6 mm series standardized in IEC 60297 — measured in rack units of 1.75 inches, or 44.45 mm, each. Put it somewhere central enough that no run exceeds 90 metres, lockable, and away from noise-sensitive desks.
Then protect it:
- A dedicated electrical circuit, not one shared with a kettle or a photocopier
- An uninterruptible power supply sized to ride out short outages and shut equipment down cleanly in a long one, with surge protection on the incoming service
- Cooling that keeps running when the building HVAC is off — a closet that’s comfortable on a Tuesday afternoon can be very different on a Sunday night
- No water lines or sprinkler drains overhead, and no storage stacked against the rack
Wi-Fi design done properly
Wi-Fi is designed, not guessed. A predictive survey from the floor plan and the construction materials places the access points; a validation survey after installation confirms coverage and finds the dead spot the model didn’t know about.
Why consumer gear fails in an office
Home access points work in isolation. In an office you need several radios cooperating: coordinated channels and power so they don’t drown each other out, smooth roaming as people walk with a call in progress, central management and firmware updates, and multiple SSIDs mapped to separate VLANs. The Cyber Centre is blunt about the authentication side — a pre-shared key is “not recommended for business use of any kind, due to its lack of identity management and audit capabilities.” It recommends WPA3 for all new deployments, separating wireless traffic onto its own VLAN, and limiting signal strength so that people sitting, driving or walking nearby can’t attack your network from outside the building.
Bands, standards and coverage
Modern access points use three bands. ISED opened the 6 GHz band to licence-exempt Wi-Fi in May 2021: low-power indoor devices may use the whole 5925–7125 MHz range, while standard-power devices operating under an automated frequency coordination system are limited to 5925–6875 MHz. That band is what Wi-Fi 6E and Wi-Fi 7 clients use; the Wi-Fi Alliance launched Wi-Fi CERTIFIED 7 on 8 January 2024, with 320 MHz channels where 6 GHz is available and multi-link operation as a mandatory feature. Higher bands carry more data but travel less far and pass through walls less well, so more spectrum usually means more access points, not fewer.
Warehouses, concrete and cold storage
Industrial space is the hard case. Concrete tilt-up walls, steel racking, metal mezzanines and foil insulation all absorb or reflect signal, and the layout changes as stock moves. Survey with the racking in place and stocked, plan for directional antennas aimed down the aisles rather than ceiling omni-directional units, and expect more access points per square metre than an open office. Scanners and vehicle-mounted terminals roam constantly, so the roaming design matters more than raw throughput.
Firewall and secure remote access
The Cyber Centre points out that firewalls “aren’t shipped with settings established so that they can be used right out of the box; they must be configured for each network’s purposes.” Its guidance for a new deployment: change all default administrative passwords, limit who can change the rules, deactivate unused ports and services, patch as soon as updates are released, and monitor and audit the logs. It also cautions that a firewall alone is not enough — it belongs inside a layered defence.
For staff working off site, the Cyber Centre’s baseline controls call for VPN connectivity with two-factor authentication for all remote access into corporate networks, and for isolating internet-facing servers from the rest of the network. Its VPN guidance adds three points: use phishing-resistant multi-factor authentication, keep the appliance patched, and avoid split tunnelling. Size the firewall for throughput with inspection turned on, not for the marketing number.
For the wider security programme this sits inside, see our small business cybersecurity checklist and cybersecurity service.
Separating guest, payment and device networks
A flat network means a compromised label printer can reach your accounting server. Segmentation stops that, and it costs almost nothing if you design it during the install rather than retrofitting it later.
| Network | What goes on it | Why it’s separate |
|---|---|---|
| Staff | Company laptops, desktops, printers, phones | The only network that needs to reach business systems |
| Guest | Visitors, contractors, personal phones | The Cyber Centre advises VLAN settings that stop guests interacting with devices and information on the primary network, with separate credentials and time-limited passwords |
| Devices and IoT | Cameras, door controllers, TVs, sensors | The Cyber Centre recommends isolating IoT networks from systems managing sensitive data, changing default passwords and keeping firmware patched |
| Payments | Point-of-sale terminals and anything that touches card data | Segmentation isn’t a PCI DSS requirement, but it reduces the number of systems that need PCI DSS controls; the Cyber Centre advises isolating point-of-sale systems behind a firewall |
| Building systems | HVAC controls, alarm panels, tenant-shared equipment | Usually managed by third parties with their own remote access |
Two rules are worth stating plainly. The Cyber Centre says organizations should never connect a public Wi-Fi network to their corporate network. And on the payments side, the PCI Security Standards Council’s position is that “network segmentation is not a PCI DSS requirement but we’ve always encouraged a strategy that minimizes systems that have access to cardholder data” — on a flat network, everything is in scope until you prove otherwise.
What drives the cost of a network installation
Nobody can quote an office network from a floor area. These are the variables that move a price, and the ones to settle before you ask.
| Driver | Why it changes the price | Decide before you ask |
|---|---|---|
| Number and length of runs | Every drop is materials plus labour, and long runs need more of both | A marked-up floor plan with every outlet, access point and camera |
| Building construction | Open ceilings are quick; hard lids, concrete and demising walls are slow | A site walk with the installer before quoting |
| Working hours and access | After-hours and weekend work, escorts and loading-dock bookings all add time | The landlord’s rules, in writing |
| Cable category and rating | Higher categories and plenum-rated cable cost more per metre | Which spaces are air-handling, and what speed you need at the desk |
| PoE load | Higher-power devices need bigger switches and more UPS capacity | The device list and the wattage each one needs |
| Wi-Fi coverage target | Access point count follows the survey, the materials and the device density | Where people work, how many devices, and whether voice roams |
| Testing and certification | Certifying every run takes time and a calibrated tester, and warranties require it | That you want test reports for all runs, stated in the quote |
| Make-ready work | New circuits, core drilling, fire stopping and cooling are separate trades | What the building already has |
Move-day timeline and handover
Build the schedule backwards from your first working day. The sequence rarely changes, even if the durations do:
- Lease signed. Order the internet circuit and any second connection. Book the site walk with the cabling installer.
- Design. Finalize the furniture plan, mark up the drops, choose the rack location and order the hardware.
- Site access. Cabling goes in, ideally before the ceiling closes. Rack, power and cooling are finished at the same time.
- Circuit live. Firewall configured and tested against the new connection, VLANs built, Wi-Fi installed and validated on site.
- Move weekend. Equipment relocated, desks patched, printers and phones tested, failover proven by unplugging the primary circuit.
- First week. Someone on site to fix what only appears when 30 people log in at once.
Move-day and handover checklist
- Internet circuit live and speed-tested at the demarcation point, not just at a desk
- Backup connection tested by disconnecting the primary circuit during business hours
- Every cable run tested and certified, with the test report handed over as a file
- Patch panel, outlets and rack equipment labelled at both ends
- Port map: which outlet number goes to which panel port and which switch port
- Firewall rules documented, default admin passwords changed, logging on and retained
- Remote access working with multi-factor authentication, tested by someone off site
- VLANs verified by trying to reach the staff network from the guest and device networks — it should fail
- Wi-Fi validated by walking the floor, including stairwells and the far corners
- UPS tested by pulling power, with the shutdown sequence confirmed
- Admin credentials for the firewall, switches, access points and internet account held by your business
- A network diagram, the IP plan and the device inventory delivered in writing
- Support contacts and account numbers for the internet provider on file
One item gets skipped constantly: make sure the accounts are yours. The internet service, the firewall licences and the management portals for the switches and access points should be registered to your business, with your provider added as a user. That keeps you in control if you ever change providers — the same principle in our guide to switching IT providers.
We design and install business networks across Greater Vancouver and the Fraser Valley, including Burnaby, Richmond and Surrey. See our networks and servers service, our managed IT services for looking after it afterwards, or contact us to walk a space before you sign.