Updated October 2026.
We first published these tips in 2020, when the pandemic sent everyone home overnight. Six years later, working from home is simply part of how most businesses run: some days in the office, some at home, some from a client site, a café or an airport. The risks have settled in too. Home routers that were never updated, laptops shared with family, files sent to personal e-mail “just to finish tonight”, and attackers who know that remote staff can’t easily walk over and check with a colleague.
Here is a practical checklist in two parts: what the company should put in place, and what every employee should do.
For the company
1. Review your remote access
Know exactly how people reach company systems from outside: VPN, remote desktop, cloud apps. Close anything exposed to the internet that doesn’t need to be (remote desktop open to the internet is a favourite way in for ransomware), keep VPNs and firewalls fully patched, and review who has remote access at least twice a year. Make sure your team knows the remote access policy, and that it covers client data and privacy.
2. Turn on multi-factor authentication everywhere
Every system people reach from home, including e-mail, VPN, file storage and finance tools, should ask for a second factor. Most cloud services include it at no extra cost. An authenticator app or a passkey is much stronger than a text message.
3. Give people managed, protected laptops
Company laptops should have disk encryption, automatic updates, endpoint protection and a screen lock, and you should be able to locate, lock or wipe them if they are lost. Device management tools such as Microsoft Intune make this practical for small teams. If people must use personal computers, set minimum rules: a supported, updated operating system, security software, and company data kept only in company apps.
4. Keep company data in company tools
Give people a good way to share and store files (OneDrive, SharePoint, Google Drive or similar) so they don’t fall back on personal e-mail, USB sticks or WhatsApp. It is safer, and under India’s DPDP Act and privacy laws elsewhere, you are responsible for where personal data goes.
5. Back up what matters
Make sure work done at home is backed up: files in company cloud storage, and laptops covered by your backup. Test a restore now and then.
6. Write it down and make reporting easy
A one-page remote working policy, and one simple way to report a lost device, a suspicious e-mail or a mistake, at any hour. People report faster when they know they won’t be blamed.
For every employee
- Secure your home Wi-Fi. Change the router’s default admin password, use WPA2 or WPA3 with a strong Wi-Fi password, and install router updates. If your router offers a guest network, put smart TVs, cameras and visitors on it.
- Use the company password manager. Don’t reuse passwords, and don’t save work passwords in a shared or personal browser profile.
- Keep work and home separate. Family members shouldn’t use your work laptop, and work files shouldn’t go to personal e-mail or cloud accounts.
- Lock your screen every time you step away, at home as well as in public.
- Be careful on public Wi-Fi. Use the company VPN or your phone’s hotspot, and use a privacy screen if you work on sensitive material in public.
- Avoid multi-tasking on sensitive tasks. Payments, contracts and customer data deserve your full attention, not one eye on a call.
- Watch for phishing and fake “IT support”. Attackers call or message remote staff pretending to be the help desk. Check through a known number before you install anything or share a code. Our post on e-mail phishing shows what to look for.
- Mind what’s on camera and on paper. Check your background before video calls, and shred printed documents with customer or company data.
- Report a lost or stolen device immediately, so it can be locked or wiped.
The checklist at a glance
| Company | Employee |
|---|---|
| Remote access reviewed and patched | Home Wi-Fi and router secured |
| Multi-factor authentication on every system | Company password manager, no reused passwords |
| Managed, encrypted, updated laptops | Work laptop for work only; screen locked |
| Company file storage people actually use | No work files in personal e-mail or apps |
| Backups that are tested | VPN or hotspot on public Wi-Fi |
| A one-page policy and easy reporting | Report phishing and lost devices straight away |
How CATEYE can help
We help companies in India and the US set up remote work safely: reviewing remote access and firewall policies, turning on multi-factor authentication, securing laptops and writing a short policy people will actually read. Our IT security strategy service covers all of this, and our IT security audit shows you where the gaps are. Talk to us any time.
