Connect. Secure. Manage.
Building Systems Network Isolation
Separate building-management devices from business traffic using Cisco or Meraki networks, with documented supplier access and required application flows.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Building systems network isolation controls how facilities devices reach staff networks, other building services and suppliers. We work with the relevant teams to identify the traffic that must still pass. Cisco and Meraki rules are then planned and tested around those flows. A separate VLAN alone does not prove that access has been restricted.
Dashboard clarity
Structure organisations, networks and permissions around real operational ownership.
Consistent sites
Use repeatable standards without ignoring the differences between locations.
Practical operations
Keep cloud management connected to physical links, users and business services.
Identify systems, owners and operational constraints
We start with an inventory of the connected systems and their purpose. Heating controls, access equipment, cameras and other devices may be supported by separate contractors with different maintenance arrangements. We confirm who can explain each system’s communication needs and who must approve testing. An IT team should not have to infer critical dependencies from unexplained firewall rules alone.
Operational constraints influence the assessment. Some systems cannot be interrupted during normal building use, and some require specialist supervision for tests. We agree a safe discovery method and avoid intrusive scanning or trial-and-error blocking without authorisation. Network isolation work should not compromise a building function because engineers treated an unfamiliar controller as though it were an ordinary office laptop.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Discover the communication that must remain available
The flow model includes local controllers, management stations, cloud services, time synchronisation and remote support. We combine supplier documentation with authorised observations where appropriate. Observed traffic helps explain current operation. But it is not automatically a complete list of legitimate needs; infrequent maintenance or emergency workflows may not appear during a short capture window.
We ask the service owner to confirm the purpose of each proposed allowance. Broad access requests are challenged constructively by identifying the actual destinations and tasks involved. Where the supplier cannot provide sufficient detail, the uncertainty is recorded and a controlled investigation is proposed. This is safer than permanently granting unrestricted access because the project needs a quick answer.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Choose boundaries that match the risk and support model
The design may use separate VLANs, routing contexts, firewall policies or supported identity-based controls. We select mechanisms the installed platforms can enforce and the operations team can maintain. The plan sets out where traffic crosses between domains and how approved shared services are reached. Separation should continue through the full path rather than ending at the access switch.
Physical and admin separation may also matter. A shared cabinet, management account or supplier gateway can create dependencies that logical network diagrams overlook. We document these limitations and agree proportionate measures with the customer. The aim is not to claim perfect isolation, but to make the permitted paths and remaining risks visible enough for a responsible decision.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Control supplier access explicitly
External maintenance should use an agreed route with identifiable users and permissions appropriate to the work. We establish who approves access, how it is removed and what information is available for incident review. Permanent broad network access is not accepted as the default merely because a contractor previously used it without complaint.
Where a legacy system restricts authentication or access options, we assess compensating controls around it. These might involve a controlled management path, narrower destinations or supervised maintenance, depending on the actual need. The design records the limitation and its owner. It does not pretend that a firewall rule has modernised the security capabilities of an old controller or eliminated the need for a lifecycle plan.
Introduce isolation through a controlled change
We prepare the policy and rollout sequence, identifying the service checks required after each step. The change window includes the relevant system specialists and a practical recovery plan. Moving every building device into a new segment at once can make faults difficult to isolate. So a phased approach may provide better evidence and reduce risk to the live service.
Acceptance includes both permitted functions and paths that should be denied. We test normal use and agreed maintenance workflows, recording the results with the service owner. A device responding to a network probe is not enough to prove that the building system remains functional. Conversely, a working app does not prove that unauthorised access has been removed; both sides of the need need evidence.
Maintain the boundary after the project
The final documentation includes device groups, approved flows, management access and exceptions. New equipment and supplier changes should trigger a review so later additions do not bypass the agreed model. Monitoring should help identify unexpected communication without collecting more sensitive information than the support purpose requires. Responsibility for reviewing alerts is agreed rather than left implicit.
MCI provides this service within connected building networks and broader Cisco/Meraki security work. We can assess the current exposure, design the separation or support rollout with your facilities contractors. The engagement produces network controls and evidence for the defined scope. It does not replace specialist safety approval, system certification or the customer’s wider security and governance duties.
Technical references
- MT sensor design best practices — Cisco / Cisco Meraki
- Adaptive Policy configuration guide — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.