Working From Home Securely: A Small Business Checklist

When your team works from the office, there’s one network to secure, one set of hardware to keep patched, and one place where the important files live. The moment people start working from home a few days a week, that neat picture falls apart. Now company data travels through home routers you’ve never seen, on networks shared with smart TVs, game consoles, and a teenager’s laptop.

The good news is that securing hybrid work isn’t complicated. It’s a short list of things done properly, and most of it is a one-time setup rather than an ongoing chore. Here’s the checklist we actually use with small offices.

1. Separate Work From Home on the Network

The single biggest weak point in home working isn’t the person—it’s everything else on their home network. Smart plugs, doorbell cameras, streaming boxes, and IoT gadgets are notoriously badly maintained, and many never receive a security update after they leave the box. If a work laptop sits on the same network as a compromised device, that device is now a neighbour with the door propped open.

Nearly every router made in the last several years can create a second network—usually labelled “guest.” Put the work laptop on one network and everything else on the other. It takes ten minutes and removes an entire category of risk.

2. Use a Real VPN — For the Right Reason

There’s a lot of confusion here, mostly created by consumer VPN advertising. A commercial “privacy VPN” hides your browsing from your internet provider. That is not what your business needs.

What your business needs is a VPN back to your network, so that remote staff reach internal systems—file shares, servers, line-of-business applications—through an encrypted tunnel instead of exposing those systems to the open internet. If someone can reach your server by typing an address into a browser from anywhere in the world, that server is being probed continuously, whether you’ve noticed or not.

If everything you use is cloud-based (Microsoft 365, Google Workspace, a hosted application), you may not need a VPN at all—in which case strong authentication matters far more. Know which situation you’re in rather than buying a VPN because it sounds like the responsible choice.

3. Turn On MFA Everywhere, Especially Email

Remote work means logins happen from everywhere, which makes “unusual location” a useless alarm signal. Multi-factor authentication is what replaces it. Email first, then anything with financial or customer data in it.

We’ve written about the painless way to roll this out, but the short version: use an authenticator app rather than SMS where you have the option, and enrol everyone in the same week so it becomes normal rather than a special burden on whoever went first.

4. Make Sure Updates Actually Install

Office computers tend to get patched because someone notices the nagging restart prompt. Home machines get “remind me tomorrow” for six months straight. Meanwhile, the vulnerabilities being actively exploited in the wild are overwhelmingly ones that already have a fix available.

Set operating system and browser updates to install automatically, including on personal devices used for work. If you manage devices centrally, enforce it and check the reporting; if you don’t, make it an explicit expectation and verify it every so often rather than assuming.

5. Decide Where Work Files Live — and Say It Out Loud

This is the item that gets skipped, and the one that causes the most damage. When people work remotely without clear guidance, files quietly scatter: a copy on the desktop, a version emailed to a personal address to finish at night, something in a free file-sharing account nobody else can access.

Pick one place—your file server, or your cloud workspace—and make it the rule that work files live there. Everything in that location gets backed up, gets access controls, and can be recovered when a laptop is stolen or a drive dies. A file on someone’s desktop has none of that.

6. Plan for the Lost Laptop

Assume a device will be lost, stolen, or left in a taxi. Two settings turn that from a crisis into an inconvenience:

• Full-disk encryption. BitLocker on Windows, FileVault on Mac. Both are built in and free. Without it, a thief doesn’t need the password—they can pull the drive and read everything.
• A screen lock with a short timeout. Encryption protects a powered-off laptop. A lock screen protects the one left open on a café table.

Add to that a known process for revoking access: who disables the accounts, and how quickly. Knowing the answer on a Tuesday afternoon is much easier than discovering it at 11pm on a Saturday.

7. Secure the Home Router Itself

Most home routers are still running the administrator password printed on the sticker, with remote management switched on and firmware from whenever the unit was manufactured. Change the admin password, update the firmware, and turn off remote administration unless it’s genuinely needed. Use WPA3 if the router supports it, WPA2 if not—and retire anything that only offers WEP.

The One Thing to Remember

Hybrid work doesn’t have to be less secure than the office—but it is only as secure as the setup you actually put in place. Almost everything on this list is free and one-time: a second network, MFA, automatic updates, disk encryption, a clear rule about where files live. Skipping them isn’t a trade-off for convenience, because none of them meaningfully get in anyone’s way once configured.

If you’re not sure which of these is already handled and which is a gap, get in touch—we can walk through your setup, tell you plainly where the real risks are, and fix the ones worth fixing.