SMB Office IT Infrastructure Guide: Network, Phones, Email, Security
In short: Office IT infrastructure is four layers on top of a foundation of internet line and firewall: wired network and Wi-Fi, phones (IP PBX), email and collaboration, and endpoint security. Build it in dependency order: inventory and site survey, network, identity and email, device protection, phones, then backup, acceptance testing and documentation.
Which layers make up office IT infrastructure?
Office IT infrastructure is a foundation plus four layers. The foundation is the internet line, cabling, power and the firewall; the layers are wired network and Wi-Fi, phones, email and collaboration, and endpoint security. Each layer depends on the one below: Wi-Fi relies on the switch, the IP PBX on the network and firewall, and email security on identity management.
For an auditable small business IT infrastructure plan, the NIST Cybersecurity Framework (CSF) 2.0 is a practical structure. Published on 26 February 2024, it groups cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST stresses that the order of the functions does not imply a sequence and that they should be addressed concurrently, so the setup order in this guide is derived from technical dependencies instead.
| Layer | Purpose | Typical components | Main CSF 2.0 function |
|---|---|---|---|
| Foundation | Connectivity and perimeter | Internet line, firewall, rack, cabling, UPS | Protect |
| Network and Wi-Fi | Connects devices to each other and the internet | Switches, access points, VLANs, cloud management | Protect, Detect |
| Phones | External and internal calls, call routing | IP PBX, SIP trunk, desk and mobile clients | Protect |
| Email and collaboration | Identity, mail, files and meetings | Microsoft 365 tenant, domain DNS records, MFA | Govern, Protect |
| Endpoint security | Protects computers and servers | Centrally managed protection, patching, disk encryption | Protect, Detect, Respond |
| Continuity | Brings the business back after an incident | Backup, restore testing, log retention | Recover, Detect |
In what order should you set up IT in a new office?
The right order starts each task only once what it depends on is ready. When the order slips, work is repeated: an access point mounted before cabling is finished gets moved, and a PBX installed before the firewall cannot receive outside calls. These ten steps suit a new office or a full renovation.
- Inventory and requirements: List users, devices, applications, lines and licences. NIST's small business guide (SP 1300) lists an inventory of hardware, software, systems and services first under the Identify function.
- Site survey: Decide the rack location, cable routes, power capacity and access point positions.
- Internet line and firewall: Line delivery depends on the carrier, so start here and request a static IP up front. The firewall should be live from day one.
- Cabling and switches: The port count and PoE budget are fixed at this stage.
- Wi-Fi and segmentation: Staff, guest, voice and device (printer, camera) networks go into separate VLANs.
- Identity and email: Prepare the Microsoft 365 tenant, domain verification, MFA and email authentication records (SPF, DKIM, DMARC).
- Endpoint security: Apply centrally managed protection, patching and disk encryption policies before devices join the network.
- Phones: IP PBX, SIP trunk and number porting; late in the list because the voice VLAN and firewall rules come first.
- Backup and logging: Define backup jobs, test one restore and start log collection.
- Acceptance testing and documentation: Verify against the checklist and record the network diagram, admin accounts and licence expiry dates.
Caution: do not fix the move-in date until your carrier has confirmed the line delivery and number porting schedule in writing.
How do you plan the office network and Wi-Fi?
Office network setup starts with three decisions: the number of wired ports, the switch PoE budget and network segmentation. Access points, IP phones and cameras usually draw power from the switch over PoE, so the switch cannot be chosen apart from the Wi-Fi and phone decisions.
- PoE budget: The switch's total PoE power should be no less than the sum of the maximum consumption figures in the connected devices' datasheets plus a growth margin.
- Segmentation: Put guest Wi-Fi, voice, printers and cameras, and user computers in separate VLANs.
- Access point placement: Derive the number from an on-site survey and the number of users connecting at the same time, not from floor area.
- Management: Cloud management suits a single office; with branches, central control and policy depth decide.
Ruijie positions its Reyee line as a cloud-managed family of access points, switches and gateways for small and medium-sized businesses. According to the vendor, Ruijie Cloud's basic features are free for supported cloud-managed devices, while Ruijie reserves the right to charge for advanced features in the future. We compare Reyee with the enterprise RG series by scale and management model in our Ruijie Reyee vs RG enterprise selection guide; the product range is on our Ruijie networking solutions page.
When buying new access points, the Wi-Fi 7 question comes up. Wi-Fi 7 is based on IEEE 802.11be (Extremely High Throughput); according to the Wi-Fi Alliance it was introduced in 2024 and highlights 320 MHz channels in the 6 GHz band. Client, cabling and uplink readiness are covered in our enterprise Wi-Fi 7 migration guide; for Fortinet wireless, see our FortiAP selection article.
How do you choose an IP PBX for the office phone system?
The first IP PBX decision is where it will run; features come next. 3CX's installation documentation describes three options: hosted by 3CX, self-hosted in your own private cloud (Google, Amazon, Amazon Lightsail, Azure or DigitalOcean), or installed on premises on Windows or Linux, virtualised with VMware, Hyper-V or KVM.
| Model | Who manages the server? | What the office needs | Good fit |
|---|---|---|---|
| Hosted by 3CX | 3CX; automatic updates, technical support not included | Internet connection, phones or clients | Offices that do not want to run a server |
| Private cloud | You; server management at the cloud provider | Cloud account and admin skills | Companies already running infrastructure in the cloud |
| On premises | You; virtualisation and operating system | Static IP, split DNS, firewall configured for VoIP ports | Offices keeping the PBX on their own network or connecting local hardware |
3CX licenses per system by simultaneous calls, with an annual fee instead of per-user monthly pricing. Its 4SC Free Basic edition supports up to 10 users and, per the edition page, runs only self-hosted (on premises or in your own cloud). Deployment choice, SIP trunks and number porting are covered in our 3CX phone system deployment options guide, and products on our 3CX phone system solutions page.
If your team uses Microsoft Teams, connecting the PBX is a separate licensing decision. 3CX's own sources disagree on which edition includes Teams Direct Routing (its Teams guide and PRO edition page differ), so confirm it at quote stage. Users also need a suitable phone licence on the Microsoft side. We collected the requirements in our 3CX and Microsoft Teams integration article.
What should you decide in Microsoft 365 for email and collaboration?
A Microsoft 365 rollout involves four decisions: plan, identity security, domain settings and migrating the old mail system. According to Microsoft Learn, the Business family (Basic, Standard, Premium) is designed for organisations with up to 300 users, and the limit applies to the total of licences across Business plans. Our Microsoft 365 Business Basic vs Standard vs Premium comparison explains the differences with a decision matrix; the catalogue is on our Microsoft 365 (formerly Office 365) solutions page.
- Identity: Microsoft offers Entra ID security defaults to all tenants at no extra cost; they require every user to register for MFA and block legacy authentication protocols. The UK's NCSC recommends passkeys for email accounts where possible, otherwise a strong, unique password with 2-step verification.
- Domain: Publish SPF, DKIM and DMARC together; Microsoft Learn notes that anything less than all of them results in substandard protection.
- Backup: We explain shared responsibility for Microsoft 365 data in our Microsoft 365 backup article.
For the full set of settings, use our Microsoft 365 security settings checklist. If you still run Exchange on premises, do not postpone this layer: per Microsoft's lifecycle pages, support for Exchange Server 2016 and 2019 ended on 14 October 2025. We weigh Exchange Online against Exchange Server SE in our Exchange Server end of support and migration paths article.
How do you build the endpoint security layer?
Endpoint security means protecting, updating and monitoring every computer and server from a central console. NIST SP 1300 names four priorities here: anti-malware on all business devices, operating system and software updates, full-disk encryption on laptops, and changing default manufacturer passwords.
A move is also a chance to retire old devices. Microsoft ended support for the Home, Pro, Enterprise and Education editions of Windows 10 on 14 October 2025, and the NCSC advises replacing devices that no longer receive updates. Decide to upgrade or replace an unsupported device before it joins the new network.
Bitdefender lists Modern Endpoint Protection, Network Attack Defense and Risk Management as the modules in GravityZone Business Security; Patch Management, Full Disk Encryption and Email Security are available as add-ons, and the management console can run in the cloud or on premises. Business Security, Premium and Enterprise are compared in our GravityZone package comparison; hardening against abuse of legitimate system tools is in our guide to reducing the endpoint attack surface. Products are on our Bitdefender solutions page; for detection and response, see our EDR vs XDR vs MDR comparison.
Where do the firewall, backup and logs fit in?
The firewall, backup and logs are common ground under all four layers. For businesses in Türkiye, the data protection authority's (KVKK) Personal Data Security Guide calls the firewall and gateway the "first line of defence" against attacks from the internet and notes that full security from a single product is not always achievable.
- Firewall: We cover sizing and licensing in our SMB firewall buyer's guide; for ongoing rule and update management after installation, see our firewall maintenance and management service.
- Backup: The same guide says only the system administrator should access backed-up data and backups should be kept off the network. NIST SP 1300 also prioritises regular, tested backups.
- Logs: We discuss guest Wi-Fi and log retention under Türkiye's Law No. 5651 in our Law 5651 and central log management article, and technical measures for personal data in our KVKK technical measures checklist.
If you would like a layer-by-layer setup plan for a new office or a renovation project, we can clarify your requirements together. Contact us
New office IT checklist: what should you verify before go-live?
Go-live is complete only when each layer meets a measurable acceptance criterion. These checks let you say "verified" instead of "it works", with the related NIST CSF 2.0 function.
| Check | Acceptance criterion | CSF 2.0 function |
|---|---|---|
| Inventory | Devices, users, licences and expiry dates in one list, each with an owner | Identify |
| Default passwords | Changed on the firewall, switches, access points, PBX and printers | Protect |
| Segmentation | Guest-to-company access attempted and confirmed blocked | Protect |
| Wi-Fi coverage | Measured in meeting rooms and at the furthest desk; results recorded | Protect |
| MFA | All users and admin accounts registered; legacy authentication disabled | Protect |
| Email authentication | SPF, DKIM and DMARC published and verified with an external tool | Protect |
| Endpoint protection | Device count in the console matches the inventory; no outdated agents | Detect |
| Patching | Operating system and application updates automatic; no unsupported versions | Protect |
| Phones | Outgoing and incoming calls, forwarding and voicemail tested; outage fallback defined | Recover |
| Backup | A sample file and one mailbox restored from backup | Recover |
| Logs | Location and retention of firewall and console logs documented | Detect |
| Documentation | Network diagram, IP plan, admin accounts and incident contacts documented | Govern, Respond |
You can check your domain's SPF, DKIM and DMARC status with our email security checker.
Renovating an existing office: which layer should you touch first?
In a renovation, unsupported or unprotected components come first; comfort improvements later. This matrix maps common symptoms to a layer and a first step.
| Symptom | Layer | First step | Priority |
|---|---|---|---|
| On-premises Exchange 2016/2019 still running | Migration or upgrade decision; reduce exposure meanwhile | High: no security updates | |
| Windows 10 devices in use | Endpoint | Identify upgradeable devices, plan replacement for the rest | High |
| No MFA, or MFA off for some users | Email and identity | Security defaults or Conditional Access | High |
| Backups run but have never been restored | Continuity | Restore test | High |
| Antivirus installed device by device, no central view | Endpoint | Move to a centrally managed solution | Medium |
| Wi-Fi drops in meeting rooms | Network and Wi-Fi | On-site survey, channel and access point placement | Medium |
| Old PBX: extensions hard to add, remote staff unreachable | Phones | Choose an IP PBX model and plan number porting | Medium |
The priority column follows one rule: first whatever gets no patches or leaves identity unprotected, then continuity, then performance and convenience. To allocate budget in that order, see our 2026 SMB cybersecurity budget priorities.
FAQ
How long does an office IT infrastructure setup take?
The longest dependency chain sets the duration: usually line delivery, cabling and number porting. These depend on the carrier and the building, so a fixed duration would be misleading. Plan backwards from written delivery dates; cloud work such as Microsoft 365 and endpoint security can run in parallel.
Does an office with fewer than ten people need all four layers?
Yes, but each layer is smaller. A cloud-managed switch and a few access points, a hosted PBX or mobile clients, a Microsoft 365 Business plan and centrally managed endpoint protection are a sound start. Whatever the size, do not skip MFA, backup testing or a separate guest network.
Isn't the antivirus built into the operating system enough?
Built-in protection is a good baseline, but it gives a business no central visibility. The NCSC notes that modern devices have antivirus and a firewall built in, and that you should still check both are on. A business needs every device monitored from one console, policies enforced and alerts reaching a named person.
Why should guest Wi-Fi be on a separate network?
The security state of guest devices is unknown; on the same network they could reach company computers, printers and the phone system. A separate VLAN and wireless network name (SSID) give guests internet access only. For businesses in Türkiye, logging of guest internet access should also be reviewed under Law No. 5651.
Can we do the setup with our own team?
Yes; the order and checklist in this guide are written for your own team to apply. Outside help is most useful for steps that are hard to undo, such as firewall rules, email migration and number porting. If you want support with the plan or one of these steps, contact us through the form.
What does KVKK mean for office infrastructure in Türkiye?
Article 12 of Türkiye's Law No. 6698 requires data controllers to take the technical and administrative measures needed for an appropriate level of security. The KVKK guide gives examples such as firewalls, patch management, access restriction, malware protection and off-network backups. This is not legal advice; refer to the authority's official sources.
Conclusion
- Plan office IT infrastructure as a foundation plus four layers; the dependencies between layers set the setup order.
- Decide on unsupported software and devices (Exchange 2016/2019, Office 2016/2019, Windows 10) before moving them to a new office.
- MFA, email authentication records and a separate guest network should not be skipped, whatever the size.
- Close go-live with acceptance criteria: a restored backup and a tested call flow beat "it works".
Sora Yazılım Teknolojileri is a technology company based in Ataşehir, Istanbul, providing selection, procurement, installation and support for Ruijie, 3CX, Microsoft 365 and Bitdefender products. Scope and responsibilities are defined in the contract according to your needs.
Free discovery call · WhatsApp: WhatsApp Support · Phone: +90 544 785 21 87 · Email: talep@sorayazilim.com
Sources
- The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 — NIST, 26 February 2024. nvlpubs.nist.gov (accessed 19 October 2026)
- NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide, NIST SP 1300 — NIST, February 2024. nvlpubs.nist.gov (accessed 19 October 2026)
- Small organisations guide to cyber security — NCSC, United Kingdom, 9 April 2026. ncsc.gov.uk (accessed 19 October 2026)
- Personal Data Security Guide (Technical and Administrative Measures), in Turkish — Personal Data Protection Authority (KVKK), January 2018. kvkk.gov.tr (accessed 19 October 2026)
- Plan options, Entra ID security defaults and email authentication pages — Microsoft Learn. plans, security defaults, email authentication (accessed 19 October 2026)
- Exchange Server 2016 and 2019 lifecycle; Ending Support in 2025 — Microsoft Learn. Exchange 2016, Exchange 2019, 2025 list (accessed 19 October 2026)
- Pricing, edition, installation and Teams Direct Routing documentation — 3CX. licensing model, 4SC edition, installation, Teams, PRO edition (accessed 19 October 2026)
- Ruijie Cloud, Reyee and Wi-Fi 7 pages — Ruijie Networks. Ruijie Cloud, Reyee, Wi-Fi 7 (accessed 19 October 2026)
- GravityZone Business Security — Bitdefender. bitdefender.com (accessed 19 October 2026)
- Wi-Fi CERTIFIED 7 — Wi-Fi Alliance; 802.11be-2024 timeline — IEEE 802.11 Working Group. wi-fi.org, ieee802.org (accessed 19 October 2026)
How this article was prepared
Prepared by: Sora Yazılım Team. This article was prepared with AI assistance; technical details were checked against the vendor and official sources linked in the text as of 19 October 2026.
Related articles
- Ruijie Reyee or the RG enterprise series? — Choosing network products by scale and management model.
- When does Wi-Fi 7 make sense for enterprise networks? — Deciding by client, cabling and uplink readiness.
- 3CX phone system deployment options — Cloud, on-premises and SIP trunk decisions.
- 3CX and Microsoft Teams integration — Requirements for calling through the PBX from Teams.
- Microsoft 365 Business Basic vs Standard vs Premium — A decision matrix for matching plans to teams.
- Exchange Server 2016/2019 end of support — Choosing between Exchange Online and Exchange SE.
- Microsoft 365 security settings checklist — Identity, device, email and monitoring settings.
- Bitdefender GravityZone package comparison — Choosing between Business Security, Premium and Enterprise.
- Reducing the endpoint attack surface — Hardening and risk management with GravityZone.