Challenge
Guest Wi-Fi shared broadcast domain with staff VLAN; firewall rules had grown unchecked for years.
Approach
- Surveyed each site and designed separate SSIDs and VLANs.
- Replaced consumer access points where required.
- Documented firewall policy with deny-by-default posture.
- Deployed always-on VPN with MFA for remote surveyors.
Outcomes
- Guest and staff traffic isolated at all sites.
- Firewall rule count reduced with documented ownership.
- Remote access logged and aligned to HR leaver process.
