NexusSec.A new site is one of the few chances to build a network properly, on a clean slate, with a budget already approved. It is also routinely the moment a business doubles the size of a design nobody was happy with in the first place, because the opening date is fixed and the network is the last thing anyone thinks about.
Order the connectivity first
Everything else on this list can be done in days. A business broadband or leased line into a new industrial or commercial address frequently cannot. Provisioning depends on what infrastructure already reaches the building, and in newer estates or warehousing areas it can require physical work that takes weeks.
So the connectivity order goes in as soon as the address is confirmed, before the fit-out is designed and well before hardware is chosen. Ask specifically what is already terminated in the building, because "available in the area" and "available in this unit" are different answers.
Where the site will carry anything regulated or customer-facing, it is worth checking current advisories for the equipment you are about to install; CERT-In publishes them for the perimeter devices most commonly deployed in India.
Order a second connection from a different provider where the site matters. For a warehouse that cannot dispatch without system access, or a plant office that files customs documentation, a single link is a single point of failure with a known cost per hour of outage.
The decision that determines everything else
How will the branch reach head office systems? There are three practical answers, and picking one first tells you what hardware to buy.
- Site-to-site VPN over business internet. Cheapest, entirely adequate for a small branch with modest traffic, and the right answer more often than vendors admit. Its weakness is that when the link degrades, there is nothing to fail over to.
- SD-WAN across two links. Combines connections, fails over automatically, and prioritises the traffic that matters when a link is congested. Worth the additional cost from roughly three sites, or at two sites where downtime has a direct operational cost. See SD-WAN implementation.
- Leased line back to head office. Predictable and expensive. Justifiable where large volumes move between sites continuously.
Answer that question before ordering a firewall, because the appliance needs to support the answer. Buying the box first and deciding the topology afterwards is how businesses end up with hardware that cannot do what they need eighteen months later.
Do not extend the flat network
The quickest way to connect a new site is to bridge it into the existing network so everything can see everything. It works immediately, and it is the decision most expensive to reverse.
What it means in practice is that a compromised laptop in the new warehouse can reach the accounts system at head office, because as far as the network is concerned they are in the same room. It also means a broadcast storm or a misconfigured device at one site affects the other.
Separating properly at the point of building is straightforward. Retrofitting separation across two live sites, where nobody is sure which application depends on which route, is a project. This is the single highest-value decision on the list, and it costs almost nothing to get right on day one. Our approach is described under network segmentation.
What to specify before anyone orders hardware
Rough numbers are enough at this stage, but they need to exist. How many people will work at the site, and how many devices including handhelds, printers and cameras. Whether any equipment must reach head office systems directly, and which. Whether the site needs guest or visitor access, which should be separated from everything else by default. Whether anyone will connect from outside, which brings remote access into scope. And who supports it when something fails at seven in the morning, which is a question worth answering before the answer is needed.
If you want a checklist to work from rather than assembling one, the first six of the CIS Critical Security Controls cover asset inventory, secure configuration and network separation, which is most of what a new site needs decided up front.
Cameras and building systems deserve specific attention. They are frequently installed by a different contractor, on the same network, with default credentials, and nobody treats them as computers. They are computers.
What to do this week
Confirm the address and get the connectivity order submitted, including asking what is already terminated in the building. Then write down, in a paragraph, how the site will reach head office systems and what happens when that link fails. If you cannot answer the second part, that is the design conversation to have before hardware is ordered.
For businesses opening warehousing or yard sites, our logistics and manufacturing pages cover the site patterns we see most often around Navi Mumbai and the JNPT corridor.