Multi-Site IT: Running Technology Across Locations

The most reliable finding in any multi-site assessment is that no two sites are configured the same way. Each is a snapshot of whoever built it and how much time they had. Nobody decided on the differences; they accumulated.

• Firewall rule sets sharing a vendor but not a policy, with legacy port-forwards still open at the older site.
• MFA enforced at headquarters but exempted at a branch to reduce friction during a rollout two years ago.
• Guest wireless bridged into production at whichever site was cabled in the biggest hurry.
• Backups covering some sites and not others, usually the newest one.

An attacker does not need your best site, only your weakest, and on a flat network the weakest site is a doorway into all of them. Consistent enforcement is the core of practical cybersecurity for a multi-site business: one written baseline applied everywhere, with exceptions that expire.

Identity is where multi-site environments fail an audit. Each site accumulates local accounts, a shared front-desk login, separate credentials for the POS or line-of-business application, and no single place listing who has access to what. The failure mode is offboarding: someone resigns, their headquarters account is disabled that day, and months later a review finds their still-active login at the third location.

• One directory of record for every employee at every site, with no local-only accounts outside it.
• Single sign-on into the applications each site actually uses, including ones a branch adopted alone.
• One offboarding action that removes access everywhere, verifiable in a report rather than in memory.

This is a project rather than a setting, and IT consulting is usually the cheapest way to sequence it without disrupting sites that currently work.

Site-to-site IPsec VPN tunnels between firewalls over ordinary internet circuits. It is cheap and adequate for two or three sites with modest traffic. Its weaknesses are real: one circuit per site is one point of failure, nothing knows which application is suffering when a link degrades, and every policy change is made by hand on every device.

SD-WAN puts a controller in front of that. It fails over between multiple transports, steers traffic per application, pushes policy centrally, and brings a new site online from a template.

• VPN is usually enough at two or three sites where applications are cloud-hosted and an hour of degraded connectivity is an inconvenience, not lost revenue.
• SD-WAN earns its cost at roughly four or more sites, when inter-site voice and video quality matters, or when a site cannot trade while its circuit is down.
• Circuit diversity beats clever routing. A second independent path into a critical site does more for uptime than optimising a single link.

The highest-return decision in multi-site IT is that every location gets the same known configuration: not identical hardware forever, but a defined standard build a new site is deployed from rather than improvised into.

• One firewall family, sized in two or three tiers by site headcount, with a single base rule set.
• One switch line and one access point line, so spares are interchangeable and nobody relearns a console.
• A documented addressing scheme, typically a dedicated subnet range per site, so locations never collide.
• One backup method and one verification routine, applied to every site including the small ones.

The payoff compounds: the fourth site takes a fraction of the effort of the second, and troubleshooting starts from a known state. Standardisation is the backbone of managed IT services across multiple locations.

You cannot walk the floor at five buildings, so instrumentation replaces observation. This is the one area with genuinely continuous coverage: 24/7 automated monitoring and alerting runs constantly, while human response follows business-hours support with after-hours emergency escalation for what cannot wait.

• An agent on every endpoint, reporting patch state, disk health, encryption and security tooling status.
• Network device monitoring for firewalls, switches and access points, including configuration change alerts.
• Circuit monitoring tracking latency, loss and jitter, not just up and down, so you can hold a carrier to its contract.
• Verified backup success per site, reported as a result rather than assumed from the absence of an error.

Most multi-site businesses have at least one site with nobody technical in the building. Retail units, clinics, branch offices and small plants all fit. The instinct is to hire locally, and the market cost of doing that at every site is what kills the idea.

These are national market figures from the U.S. Bureau of Labor Statistics, not LayerLogix pricing: the median annual wage for computer network support specialists was $73,340 in May 2024, and $96,800 for network and computer systems administrators. BLS also projects the latter role to decline about 4 percent from 2024 to 2034, reflecting how such work is increasingly delivered remotely rather than staffed per building.

• Design remote-first. Anything fixable only by standing in the building is a design defect, not a staffing problem.
• Out-of-band access such as a cellular management path, so a site with a dead primary circuit is still reachable.
• Pre-configured spares on the shelf, so a failed switch is a swap someone non-technical can do over the phone.
• A named site champion who will read a label, photograph a screen and reseat a cable under guidance.

Where a business has internal IT at headquarters but nothing in the field, a co-managed IT model fits best: your team keeps the applications while a partner carries monitoring, after-hours load and branch coverage. Budgeting across a changing number of sites is also why many multi-location companies prefer flat-rate IT services.

A location opens well when IT was involved at lease negotiation and badly when IT was told at buildout. This sequence works, expressed against the opening date.

• Before signing the lease. Run a carrier serviceability check on the exact address, not the street. Confirm whether conduit exists and has capacity, and who owns the demarcation point.
• 90 or more days out. Order the primary circuit and the backup path together. This item determines your opening date.
• 60 days out. Finalise cabling against the floor plan, and order hardware against the site standard with long-lead items first.
• 30 days out. Stage and configure centrally before shipping: firewall loaded with the site rule set and subnet, switches with the right VLANs, access points adopted, workstations imaged and encrypted. Equipment should arrive ready to plug in, not ready to build.
• 21 days out. Provision identity and access: accounts, groups, licenses, line-of-business systems, and printing and storage scoped to the location.
• 14 days out. Install and test on site. Verify the circuit performs to contract, and test failover by actually unplugging the primary.
• 7 to 10 days out. Test POS, payments and phones with real transactions. Confirm number porting, the auto-attendant, 911 address registration, and merchant settlement.
• Opening week. Train the site champion, publish the escalation path, and confirm the location exists in the asset inventory so its tickets route correctly.

To adapt that to a specific address and opening date, get in touch with the timeline.

When a location opens late for a technology reason, the reason is almost always the circuit. Not the hardware, not the configuration, not the software.

Industry practice for a dedicated business fiber circuit commonly runs 60 to 120 days from order to delivery, and longer where special construction is required. That is the range carriers and installers routinely describe rather than a guarantee, and it varies by address. What drives the long end is rarely the carrier being slow in any ordinary sense:

• Permitting. Municipal permits for trenching or boring run on the city's calendar, not yours.
• Construction and conduit. If fiber is not at the building someone must place it, and the path from the street may not exist or may be full.
• Right of entry. A landlord must authorise work, and in multi-tenant properties this alone can consume weeks.

The mitigations are straightforward and rarely followed. Order at letter of intent rather than at buildout, make serviceability a diligence item before signing, and chase the order on a schedule, because orders nobody chases slip quietly. Above all, never let opening day depend on the primary circuit: provision cellular or fixed-wireless that can carry essential traffic including payments. A site that opens on cellular and cuts to fiber six weeks later is a footnote. A site that cannot take payment on opening day is not.

• Inventory the truth. One list of every site, circuit, firewall, switch, server, endpoint and application, with who supports each. The gaps are the actual project.
• Compare sites against each other. Put each location's security configuration side by side. The differences are your risk register, already prioritised.
• Fix identity first. Central directory, single sign-on, one offboarding process. It unblocks nearly everything else.
• Write the site standard before the next opening, so the next location is the first deployed from a template.

A structured free IT assessment gets the first two steps done quickly. If your current arrangement was never built for a multi-site business, our guide to switching IT providers covers moving without a disruptive cutover across several locations at once, and companies that would rather hand the function over often start with outsourced IT support in Houston.

One structural point, without pointing at anyone in particular: an arrangement billed by the hour or by the incident has no financial reason to make your sites more consistent, because consistency reduces billable events. That is an incentive problem, not a character problem. Response speed likewise has to be contractual rather than habitual, which is why response time commitments belong in writing when several locations depend on them.

At how many locations do we need multi site IT management?

The threshold is two. Policy drift, identity sprawl and the loss of proximity as an informal control all begin at the second site; scale only changes the cost of ignoring them. The cheapest moment to set a site standard is before the second location opens.

Is SD-WAN worth it for a business with only two sites?

Usually not on its own merits. With two locations and mostly cloud-hosted applications, a site-to-site VPN over reliable circuits is generally sufficient and cheaper. SD-WAN becomes compelling at roughly four or more sites, when inter-site voice or video quality matters, or when a site loses revenue the moment its circuit drops.

How early should we order internet circuits for a new location?

As soon as the address is committed, ideally at letter of intent and certainly at lease signature, which usually means 90 days or more before opening. Dedicated fiber commonly takes 60 to 120 days, longer where trenching, conduit work or permits are involved. Always provision a wireless backup.

Can we support a location that has no IT person on site?

Yes, and most multi-site businesses do. It requires designing so nearly everything resolves remotely, keeping pre-configured spare hardware at the site, maintaining an out-of-band management path that survives a circuit outage, and training one non-technical employee to perform guided physical tasks.

Should each location have its own IT provider?

It is common, usually because each site arranged support as it opened, and it is almost always worse than a single arrangement. Separate providers produce exactly the drift described above: different standards, different tooling, no shared inventory, and nobody accountable for anything crossing a site boundary.

LayerLogix supports multi-site businesses across Texas with 20+ Years Experience and 100% Texas-Based Support, including managed IT services in Houston, The Woodlands, Katy, Dallas and Fort Worth. If your locations span both the Houston and Dallas-Fort Worth markets, one standard across all of them is simpler than separate arrangements per region. Call 713-571-2390 for Greater Houston or 888-792-8080 statewide to talk through an upcoming opening or an existing multi-site environment.