Opening a second office in an SME always looks the same: it's quiet for six months, then suddenly "we're going live in three weeks". Lease signed, people hired, furniture ordered. And IT? "We'll run it from headquarters somehow, right?" No.
At headquarters everything works because it grew over years — the cable, the server in the next room, the printer "everyone knows how to connect", the accounts "someone sets up when needed". The new office has none of that infrastructure within reach, and nobody there knows your "Mark". If you wire the branch up the same way you let headquarters sprawl over 10 years, in year two you'll have two messes instead of one.
This article is a list of things worth deciding and doing in a specific order — before the first customer asks "why isn't this working?".
Decision 0 — satellite or standalone
This is the only decision that has to happen before anything else. The branch can be a satellite of headquarters (HQ holds everything, the branch just logs in) or a standalone entity (local server, local data storage, local accounting). Both work. The third option — half and half — never does.
For SMEs the satellite is almost always cheaper and healthier. One ERP, one customer base, one accounting function. The branch has workstations, staff log into systems over the internet, data physically lives at HQ or in the cloud. A standalone makes sense only when the branch has a completely different business profile, a separate legal entity, or strongly autonomous management. If you're doing the same thing as HQ, just in another city — satellite.
This decision drives everything downstream: type of connection, backup policy, license list, remote access model. If you don't make it consciously, it will make itself — and almost certainly badly.
Internet connection and network — start here
The connection in a new office is not "that cheap business plan the local telco throws in". It's the cable that decides whether 10 people can work at all. Two things matter.
- Two providers, not one. Minimum: fibre from operator A and LTE/5G from operator B as failover. The router has to switch over on its own, without IT intervention. A single link in a branch with no on-site IT is a question of when, not if, the company stops for a few hours.
- Static IP or site-to-site VPN. If the branch needs to reach the ERP at HQ, do it safely — not by "let's expose ERP to the internet with password admin". A site-to-site VPN between the branch router and the HQ/cloud router solves this once, for the entire office.
Wi-Fi for the office and warehouse is a separate conversation — a separate SSID for guests, staff and warehouse devices (handheld scanners, label printers), WPA3 everywhere, access points sized to the floor plan rather than "one FritzBox for 400 m²". Wi-Fi that drops every hour is the fastest way to get the team tethering through their phones and bypassing all your policies.
Accounts, access, SSO
Biggest trap: setting up accounts "on the fly", the way you do at HQ. "Jack starts Monday, Sophie will make him an account." Sophie remembers seven systems, forgets three, Jack spends his first month asking colleagues for passwords that "are shared anyway".
If you're going from 10 people to opening a second office, this is the last moment to set up accounts the way you should have from day one:
- One directory account per employee (Microsoft 365 / Google Workspace / local AD) and SSO to every other system that supports it. One thing to create, one to disable at exit.
- Named accounts, not "reception1", "warehouseman2". An audit will not forgive this, and after a year you won't know who did what either.
- MFA on from day one. Not "for now, until people get used to it" — nobody turns it on later.
- A list of systems-per-role (sales, warehouse, accounting, manager) agreed once. A new hire gets a role, not 20 individual permissions.
With one of our clients — a 28-person building-materials wholesaler opening a second office 180 km from HQ — this is exactly how we approached it. All accounts in one Microsoft 365 tenant, SSO to the ERP (Comarch Optima), WMS and CRM, roles defined for 6 position types. Onboarding a new salesperson at the branch: 25 minutes from the HR email to the first login — instead of 2 days during which the new hire "looked around the warehouse" because they had access to nothing else.
Hardware, printers, scanners — a starter kit
Don't buy "whatever was on sale". Build a branch starter kit and stick to it, even if the salesperson from Warsaw insists "my laptop is awesome". Three reasons: spare parts, system image, service.
A reliable SME minimum:
- Laptops of a single model, from a company system image (standardisation is covered in a separate post), BitLocker enabled automatically, Intune/MDM playing supervisor.
- One networked printer managed centrally, not "five different printers on five desks". One big, two mid-size in the warehouse, done.
- Barcode scanners and label printers from the same family as HQ — otherwise you'll have two configurations to maintain and two parts inventories.
- UPS under the router and the main switch. A branch without power is a closed branch; a 15-minute buffer is enough to save work and make a phone call.
Spec it out, buy it in one batch, invoice it as "branch starter kit" — not 40 line items nobody will reconcile after a year.
Backup, security, monitoring
A new branch is the weak link for the first six months for one reason: nobody there yet knows how things work. Staff don't know your policies, the branch manager doesn't know your IT, local salespeople will swallow a phishing message because "it's probably a new procedure from HQ".
Three things from day one:
- Backups go to HQ/cloud, not local. If the branch has a local server or NAS, backup goes to the cloud daily and to HQ weekly. A backup kept in the same room as the original data isn't a backup — it's an illusion.
- Endpoint protection on every device, centrally managed. Not "we'll install a free antivirus for you". One EDR solution with a console that the same person watches as at HQ.
- Connection and device monitoring. A simple system that pages someone when the branch router disappears. Branches 100+ km from HQ can go down for half a day before anyone notices because "the customer probably hasn't called".
Add a short phishing training for the new team in week one (see cybersecurity training for SMEs). Without it, the first "from HQ" invoice that lands at the branch with a scammer's bank account will be paid.
RACI for IT — who owns what
Last thing everyone forgets: the new branch has a manager and that manager "would like to help" with IT. For the first three months they help, because they have to. After three months, either you draw a boundary or the branch has its own quiet admin stashing passwords in a notebook.
Write down on one page who decides on: buying a new laptop, granting access to a system, adding a new IT vendor, a critical after-hours outage. The branch manager should know what they can do themselves and what they must escalate. Your IT provider (or internal IT) should know there is one point of contact at the branch, not seven.
This is not corporate bureaucracy. It is three cells in a table that protect you from a situation where three people simultaneously order three different printers because "HQ wasn't responding".
What to actually start with
If go-live is 6–10 weeks away, the order is: first the satellite-vs-standalone decision (a day of conversation), then the connection (order today — telcos can take two months to deliver), then accounts and system image (one week), then hardware (two weeks for delivery), then the small stuff in the final week. Backup and monitoring enabled before the first employee at the branch logs into anything.
If go-live is approaching and you know you won't sort this out alone — half an hour with someone who's stood up ten of these branches tends to save two weeks of groping in the dark.
A branch doesn't fail because IT is bad. It fails because IT is "somehow" — and nobody fixes that later.
Let's talk about IT for your new office →