Remote work security is not just a VPN or a reminder to avoid public Wi-Fi. A workable approach defines which company devices and accounts staff may use, which remote tools are approved, how sensitive data is accessed and how incidents are reported.
List the systems staff need away from the office
Ask managers and system owners to list the email, documents, business applications and remote support tools that employees need while away. Separate ordinary work from sensitive systems that need additional approval. Avoid giving everyone the same access simply for convenience.
Prefer company-managed devices
Company devices are easier to configure for updates, screen locks, encryption and loss response. If personal devices are allowed, set boundaries for the systems and data they can access, and explain how company data can be removed without affecting personal content. For device onboarding, updates and retirement, see the company device management guide.
Control external connections and remote tools
Use remote access tools approved by the business, and avoid installing unreviewed remote-control software. Where the platform allows it, limit access by user, device or source. A VPN can protect a particular connection, but it does not replace account security, device updates, access reviews or secure service settings. Choose controls based on what each system does.
When working on public Wi-Fi, prevent others from viewing the screen or using an unlocked device. If sensitive information must be accessed, use a company-approved connection method or a trusted network.
Explain how to report a lost device or unusual sign-in
Staff should know whom to contact if a device is lost, an unfamiliar sign-in alert appears or information is accidentally shared externally. Keep a contact route available even if company email is inaccessible. The designated owner can then decide whether to end sessions, reset access or start the incident process.
Turn the rules into a one-page guide
Document approved devices and remote tools, extra requirements for sensitive systems, public-network precautions and reporting steps. Ask employees to review the guide during onboarding and when the policy changes; revisit it as working practices evolve.
The UK NCSC home working guidance covers devices, access and reporting. Use it as a reference when creating internal rules, then adapt the policy to your systems and risks.
Free download: remote work security checklist
Use this editable Excel checklist with IT, HR or department owners to review devices, networks, accounts, data and incident reporting. It references the Hong Kong Cyber Security Information Portal’s remote working guidance and includes fields for an owner and review date.