They should re-anchor controls around identity, device trust, and session context, then remove route-specific exceptions where possible. The goal is to make access decisions predictable regardless of where the user works, while still allowing tighter checks when risk conditions change.
Why hybrid work breaks the old perimeter model
Hybrid work changes the control point. When users connect from homes, branch offices, hotels, and personal networks, the network location no longer tells you enough about trust. Security teams need to assume that access requests can arrive from many environments, so controls have to evaluate the user, the device, and the current session rather than the address range alone.
A practical response is to make the policy path explicit. That means separate treatment for identity proofing, device posture, session age, sensitive application access, and reauthentication. It also means avoiding hidden exceptions for office LANs, VPN presence, or static IP allowlists when those exceptions would let the wrong request bypass the same checks applied everywhere else.
Hybrid access is easiest to manage when the policy logic is consistent and the exceptions are narrow, documented, and measurable. Teams should be able to explain why one request is allowed while another is challenged, denied, or stepped up, without relying on where the user happened to sit down that day.
How to replace perimeter assumptions with identity and context
The first change is to anchor access on strong identity and device trust. The second is to use session context, such as risk score, device health, and transaction sensitivity, to decide whether the access should continue unchanged or require additional checks. That gives teams a way to keep normal work simple while still tightening controls when a session becomes higher risk.
This approach works best when the trust decision is made at the point of access and then re-evaluated over time. A session that began on a managed device may still need stronger checks if the device falls out of compliance, the location changes abruptly, or the application being reached becomes more sensitive. The goal is not to inspect everything constantly, but to make the decision responsive to conditions that actually change exposure.
Teams should also look for route-specific exceptions that have outlived their purpose. If a policy exists only because traffic used to come through a known network path, hybrid work is a signal to simplify that assumption. NIST Cybersecurity Framework 2.0 is useful here because it reinforces governance, identity, protection, detection, response, and recovery as connected decisions rather than network-only controls.
NIST Cybersecurity Framework 2.0 is useful here because it reinforces governance, identity, protection, detection, response, and recovery as connected decisions rather than network-only controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC — Organizational Context | Hybrid work requires policy decisions that reflect changing access context. |
| PR.AA — Identity Management, Authentication, and Access Control | The answer centers on identity-based access instead of perimeter trust. | |
| PR.DS — Data Security | Tighter checks for sensitive applications help protect data when context changes. | |
| Recommendation — Define access assumptions around current operating context, not office location. Enforce access through identity, authentication, and authorization checks. Apply stronger protection to sessions reaching sensitive data or systems. | ||
| NIST Zero Trust (SP 800-207) | 4.1 — All Data Sources and Computing Services Are Considered Resources | Hybrid work pushes control decisions to each resource rather than the network edge. |
| 4.2 — All Communication Is Secured Regardless of Network Location | Breaks the assumption that office or VPN location alone implies trust. | |
| 4.3 — Access to Individual Enterprise Resources Is Granted on a Per-Session Basis | Session context and risk changes determine whether access continues. | |
| Recommendation — Treat each access request as a resource-specific trust decision. Secure every session consistently regardless of network path. Re-evaluate access at the session level as conditions change. | ||
| CIS Controls v8 | 6 — Access Control Management | The answer recommends removing route-specific exceptions and basing access on verified trust factors. |
| Recommendation — Remove location-based exceptions and enforce least-privilege access decisions. | ||
Practitioner Guidance
What to verify: Confirm that sensitive applications do not silently trust office IPs, VPN presence, or other route-based signals as a substitute for identity and device posture. The policy should still make sense when the same user connects from a different network.
What good looks like: Access decisions are predictable, documented, and repeatable, with step-up checks triggered by measurable risk conditions rather than by location alone. Users should see more friction only when the session genuinely becomes higher risk.
Common mistake: Keeping legacy exceptions because they are convenient for support or because they reduce helpdesk tickets. That usually preserves a false sense of safety while leaving the weakest trust assumption untouched.
Practitioner takeaway: If a control depends on where the user is, it is usually too weak for hybrid work; the safer design is to trust the verified identity and device state, then change the decision only when the session context changes.
Related resources from NHI Mgmt Group
- How should security teams decide whether JIT access is safe for non-human identities?
- What is the difference between a rules-based secret scanner and a hybrid scanner?
- How should security teams secure hybrid and remote work without adding too much user friction?
- How should security teams modernise identity governance for hybrid work and AI adoption?
