The network grew with you: seven signs it is time for a plan

Networks in smaller companies are rarely drawn on a board. They start with a router and five workstations and then grow with the business: a switch for the extension, an access point for the warehouse, a port forward for the new software, remote access for the accountant. Every single step was right. The sum eventually becomes something nobody knows completely.

Seven signs the limit has been reached

• Nobody can say what is on a port. A cable gets unplugged and you wait to see who complains. That is not a joke but a widespread method — and a reliable indicator.
• There are rules nobody wants to remove. A port forward or firewall rule whose purpose is unknown survives out of fear. The number of such rules only ever grows.
• Former providers' remote access still exists. The vendor of the old inventory system, the phone system technician, the intern from 2021 — access is created and almost never removed.
• The wireless password is a cultural artefact. It is on a note, every visitor of recent years knows it, and nobody dares change it because it is unclear which devices would stop working.
• Changes need one particular person. When only one person knows how things fit together, the documentation is not poor — it does not exist.
• Fault-finding starts with reboots. When the first step in every incident is restarting devices in turn, what is missing is visibility, not competence.
• Everything is on one network. Point of sale, production, guests, servers and the camera at the gate share one address range. That works until one device is compromised.

Two or three of these are normal. Five or more mean every further change costs more than the last — and that during an incident the time goes into finding the cause rather than fixing it.

The order that works without downtime

The most common mistake when tidying up is starting with the most visible item, usually new hardware. That costs the most and changes the least. The order that works in small networks is the reverse and can be done alongside operations.

1. 01

   Record what exists

   Devices, connections, access paths, contracts. Two days with a notepad, a camera and a look at the configuration achieve more than any purchase. The result is a list, not a concept.

2. 02

   Tidy the access paths

   Every remote access gets a name and an expiry date; anything that cannot be attributed is switched off. This is the step with the best effort-to-risk-reduction ratio — and it costs nothing.

3. 03

   Separate what does not belong together

   Guests out, production and cameras into their own areas, servers decoupled from the workstation network. In small networks that is three to five areas, not twenty.

4. 04

   Label and document

   Ports, patch panel, devices, a one-page network diagram. Unspectacular, but it decides whether the next incident takes twenty minutes or half a day.

5. 05

   Only then replace equipment

   Once it is clear what the network has to deliver, procurement becomes a short decision instead of a bet. Often less needs replacing than feared.

What to deliberately leave alone

Tidying does not mean redoing everything. Three things usually stay as they are: cabling that carries; devices that do their job and still receive updates; and grown routines that work. A tidy-up project that changes how the company works does not get finished — it gets abandoned.

Nor is there any point in rebuilding a corporation's architecture in a network with thirty workstations. What counts is enterprise care in the method — sized to fit. How we do that for smaller companies is described on the service page.

The right occasion

Tidying without an occasion rarely gets budgeted. It is therefore worth using the next date that is coming anyway: an office move, an additional site, the migration to fibre, a new cyber policy or a customer's security questionnaire.

All four occasions demand a survey regardless. Doing it once properly instead of four times halfway is the entire difference.