Office Moves and Expansions: The Security Checklist Growing Companies Learn the Hard Way

A 70-person company signs a lease on a larger floor across town. The move is scheduled for a long weekend. The internet provider installs a new circuit on Friday, movers carry the desktops, printers and a stack of old laptops on Saturday, and by Monday morning everyone is working. Nobody has checked who holds the new keycards, whether the old Wi-Fi password still works from the parking lot, or where the old copier went.

Moves and expansions are routine for a growing company. They are also one of the few times when the network, the devices and the physical building all change at once. Security controls that worked in the old space tend to get dropped quietly in the new one.

Why a Move Resets Your Security

In a normal month, changes to the network or the building happen one at a time. Someone adds a printer. Someone replaces a switch. Each change gets noticed because it is small.

A move bundles dozens of changes into a few days. Firewall settings get rebuilt or copied. Wired and wireless networks are redone. Equipment is boxed, trucked, unboxed and plugged into whatever port is closest. Temporary arrangements get made under deadline pressure: a flat network "just until we settle in," a default admin password "just for the install," a vendor with a master key "just for the weekend."

Those temporary arrangements are the problem. Temporary setups made during a move have a way of becoming permanent, because the people who made them are back to their regular jobs by Tuesday.

The cost of getting this wrong is not abstract. IBM's 2025 Cost of a Data Breach report put the global average cost of a breach at $4.44 million. Your own exposure will be smaller than a global average for large and small companies combined, but a ransomware incident or a fraudulent wire in the first month of a new office lands at the worst possible time, when your team is busy and your records of what is connected to what are the least accurate.

What Goes Wrong Most Often

The same handful of gaps show up in company after company.

Old network equipment stays in service, or stays plugged in. The old office often keeps its internet circuit for a month or two during the overlap. Firewalls, switches and access points at the old site keep running with whatever settings they had, often with nobody watching them.

Default settings survive the install. New routers, access points and cameras ship with default administrator credentials. An installer working against a deadline may leave them in place, or set one shared password for everything.

Wi-Fi is rebuilt without separating guests. The old network may have had a guest network. The new one often starts as a single network for everyone, including visitors, contractors and the smart TV in the conference room.

Physical access is looser than anyone intended. Movers, cleaners, installers and the building's property manager all need access during a move. Keycards, door codes and keys are handed out fast and collected slowly. Former employees' cards may be copied into the new access system because it is easier than starting clean.

Retired equipment leaves without being wiped. Old laptops, servers, phones and copiers get donated, recycled or hauled away. Data on them goes with them. The FTC has warned businesses that the hard drive in a digital copier stores data about the documents it copies, prints, scans, faxes or emails, and that deleting files or reformatting the drive does not remove that data. Its copier data security guide recommends confirming that a drive can be removed and destroyed or overwritten before a machine is returned or disposed of.

Nobody updates the asset list. After the move, the spreadsheet of devices and accounts describes the old office. Nobody can say with confidence what is plugged in where, so a rogue device or a missing laptop goes unnoticed.

The Move-Day Security Checklist

Work through this list in three stages. Most of the real work happens before the first box is packed.

Before the move (4 to 6 weeks out)

1. Inventory every device. List laptops, desktops, phones, printers, copiers, cameras, access points, switches, firewalls and any server or storage. Record who uses each one and what data it holds.
2. Decide what is not moving. Anything past its useful life, or no longer supported by its maker, should be replaced rather than carried over. Moving old equipment keeps old risk.
3. Write down the network design. Decide before install day what networks you need: staff, guests, and any devices (cameras, badge readers, printers) that should sit apart. Hand that design to your installer in writing.
4. Set the credential rule. Every new device gets a unique administrator password, stored in your password manager, before it goes live. Nobody accepts defaults.
5. List who needs physical access. Movers, installers, cleaners and property staff each get a defined window, and a named person who tracks keycards and keys.
6. Confirm backups. Run and test a restore of critical systems before anything is unplugged. A backup that has never been restored is a guess.

During the move

1. Keep one person accountable on site. Someone, ideally not the person doing the heavy lifting, checks off devices as they leave and as they arrive.
2. Move data-bearing equipment under your control. Servers, storage and unencrypted laptops do not ride in an unlabeled truck. Use encrypted devices, sealed and logged containers, or a vendor who provides a chain of custody.
3. Turn on multi-factor sign-in for new admin accounts. Installers often create temporary accounts. Make them named, time-limited and protected by multi-factor sign-in, or remove them when the job ends.
4. Do not reuse a flat network. Stand up staff and guest networks separately from the first day, even if the rest of the design gets refined later.

After the move (first 30 days)

1. Retire the old site properly. Disable the old circuit's equipment, reset or remove old firewall and access point configurations, and cancel services you no longer need.
2. Wipe or destroy retired equipment. NIST's media sanitization guidance (SP 800-88) describes three levels: clear, purge and destroy. Equipment leaving your control should be purged or destroyed, not simply reformatted. Ask your disposal vendor for a certificate for each device.
3. Collect and reissue access. Get every temporary keycard, code and key back. Reset door codes. Remove any former employee entries instead of copying them over.
4. Change every shared password that the installer, the movers' coordinator or any temporary contractor knew.
5. Reconcile the asset list. Compare what you inventoried before the move with what is on the network now. Investigate any difference.
6. Check Wi-Fi from outside. Walk the lot and the lobby with a phone. If the staff network is visible and joinable from outside your suite, tighten it.
7. Test and document. Run a restore test in the new environment, confirm monitoring and alerts reach the right people, and record the final network layout.

Expansions Without a Move

A new floor, a second location or a satellite office carries the same risk in smaller form. The pattern is the same: a rushed install, a flat network, default settings, and a "temporary" arrangement that lasts. The checklist above applies to a second site, with two additions.

First, decide how the new location connects back to the main office and to cloud systems, and who is responsible for the firewall at that site. A small branch with no one managing its firewall is an easy way in.

Second, bring the new site into your normal monitoring and patching from day one. A location that is not in the monitoring tools does not generate alerts, which looks the same as being safe until it is not.

How Elevaire Managed Security Fits a Move

Moves are a project, but the security around them is ongoing work. Elevaire Managed Security runs a company's security end to end: it manages the security tools and vendors, watches for threats, and steps in when an attack hits. During a move or expansion, that means the security side of the project already has an owner.

Elevaire works alongside your existing IT provider or internal team. The IT provider handles circuits, cabling and workstations. Elevaire checks that the security controls follow the equipment: that new devices have unique credentials, that guest and staff networks are separated, that multi-factor sign-in and device management cover every endpoint, and that monitoring picks up the new site.

Example engagement: a 70-person professional services firm is moving to a larger floor over a long weekend. Elevaire would review the installer's network design before the move, confirm that every device in the inventory is enrolled in device management, check the new firewall and access point settings after install, and verify that retired equipment is wiped or destroyed with a certificate on file. The firm's IT provider would handle the cabling and workstation setup as planned.

The security baseline checklist for growing companies is a useful reference for the standing controls a move should not disturb, and what Elevaire Managed Security includes lists the controls that stay in place between moves.

Frequently Asked Questions

How much does it cost to add security to an office move?

Most of the work is planning and verification, not new technology, so it is mostly staff and provider time. If Elevaire Managed Security is already in place, move support falls inside the service, which uses predictable monthly pricing with no hourly billing. For context, IBM's 2025 report put the global average cost of a data breach at $4.44 million, which is the figure a missed step in a move is measured against.

Do we need to replace our firewall and network gear when we move?

Not always, but check each device. Equipment that its maker no longer supports with security updates should be replaced instead of carried over. Anything you keep should be reset, updated and given a unique administrator password in the new space.

How does this work alongside our existing IT provider or IT team?

Your IT provider keeps the circuits, cabling, workstations and day-to-day support. Elevaire handles the security layer: reviewing the design, checking settings after install, and confirming monitoring covers the new site. Elevaire does not replace your IT provider.

What should we do with old laptops, servers and copiers?

Wipe or destroy them before they leave your control, and get a certificate for each device. Reformatting is not enough. For copiers and printers, confirm with the leasing company how the internal drive is handled when the machine is returned.

Who should own the security side of a move?

One named person should own it, with a written checklist and sign-off. In a company without a security team, that is often nobody by default, which is how gaps appear. A managed security provider can take that role for the duration of the project and afterward.

How do we get started if the move is already scheduled?

Start with the device inventory and a written network design, since both are needed by the installer anyway. Then assign someone to own keycards and credentials during the move. Bring in security support early enough to review the design before install day, not after.