Remote Work Security Checklist: Employer and Employee Checks for Home Working

Home working moves company devices, credentials and conversations onto networks, rooms and screens the organisation does not control, and most remote work incidents start with one of those three. This template gives two checklists you can use as they are: one for the employer (IT and security) and one for the employee, plus a dedicated section on video calls and screen sharing, where a single shared window can leak more than a phishing email. Each item says how to verify it. It is for IT, security and HR teams onboarding remote and hybrid staff, and for managers running an annual check. The programme behind it is in the Home Office and Remote Worker Security Guide; plain-language staff advice is in the Remote Working Security for Staff Guide.

How to use this template

• Replace text in square brackets, such as [Organisation], [MDM tool] and [IT service desk], with your own values.
• Use section 5 when issuing devices and approving remote access, and review it every [6 months]. Give section 6 to every remote or hybrid worker at onboarding and ask them to confirm it once a year.
• Add a Result column (Met, Not met, Exception) and an evidence note. An employer item is met when the console report or a test on a sample device shows it, not when a policy has been assigned.
• Items marked High risk roles apply to administrators, finance approvers, executives and anyone handling [restricted] data.
• Personally owned devices follow the BYOD Policy Template; where it allows them, the employee checklist still applies.

1. Purpose

This checklist sets the minimum security measures for working away from [Organisation] premises, so that devices, accounts, networks and conversations used for work stay protected. It supports the remote access requirements of NIST SP 800-53 AC-17 Remote Access, IA-2 and IA-3 for user and device authentication, NIST SP 800-46 Rev. 2 on telework security, and NIST CSF 2.0 PR.AA-03.

2. Scope

• All employees, contractors and temporary staff who work from home, from other private locations or while travelling, full time or part time.
• Company devices and any personal device approved to access [Organisation] data.
• Remote access paths: VPN, zero trust network access, virtual desktops and direct access to SaaS applications.

3. Roles and responsibilities

• [CISO]: owns this checklist and approves exceptions.
• [IT operations]: configures devices and remote access to meet section 5 and reports compliance.
• Line managers: confirm their staff have completed section 6 and raise exceptions.
• Remote workers: complete section 6, keep it current and report incidents at once to [IT service desk].

4. Risk summary

5. Employer checklist

The Colonial Pipeline Ransomware Attack began with a VPN account that was no longer used and had no MFA: ER-1 and ER-8 together close that route. In the Cisco Breach 2022, a corporate password synced to a personal browser account and repeated push prompts gave an attacker VPN access, which is what ER-2 and ER-11 address.

6. Employee checklist

The LastPass Breach 2022 shows why EE-1 matters: a keylogger on an engineer's home computer captured a master password that opened a corporate vault. Privileged access should never sit on a device outside company management.

7. Video calls and screen sharing

The NCSC's home working guidance now concentrates on online meetings. Use these checks for both the platform settings (employer) and behaviour (employee).

Deeper coverage of screen capture, remote control and data leakage is in the Screen Sharing Security guide, and tool selection in Remote Support and Screen Sharing Tools.

8. Exceptions and review

• Exceptions to section 5 require a documented risk acceptance by [CISO] with an expiry date of no more than [12 months].
• Track: percentage of remote devices compliant with ER-3 to ER-6, sign-ins without MFA, dormant VPN accounts, staff who have confirmed section 6 in the last [12 months], and lost device reports closed with a remote wipe.
• This checklist is reviewed every [12 months] or after a remote work related incident.

Standards and references

• NIST: SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device Security
• NIST: SP 800-53 Rev. 5 (AC-17, IA-2, IA-3, SC-7(7))
• NCSC: Home working, preparing your organisation and staff
• NCSC: Device Security Guidance, Bring your own device
• CISA: Project Upskill, Secure your home Wi-Fi
• MITRE ATT&CK: External Remote Services (T1133)

Implementation guidance

1. Close the identity gaps first: MFA everywhere (ER-1), dormant VPN accounts (ER-8) and browser sync (ER-11) are low cost and stop the most common remote compromise routes. See the Phishing-Resistant MFA Guide.
2. Then device compliance: enrol, encrypt and patch, and switch device compliance checks to report only for [2 weeks] before enforcing, so you can see who would be blocked.
3. Pilot: enforce on IT staff, then one department, then everyone. Keep the previous access policy ready to re-enable in one change if a ring is locked out.
4. Meeting defaults: change platform defaults (lobby, host-only sharing, recording storage) centrally; it is more reliable than training every organiser.
5. Make section 6 short to complete: a ten minute onboarding task with a confirmation, repeated yearly, works better than a long policy.

Small organisations without MDM can still meet most of section 5 with built-in tools: the business tier of their productivity suite for MFA and device management, built-in disk encryption, and automatic updates. Large organisations should feed device compliance and sign-in risk into conditional access and review exceptions monthly.

This template is provided for guidance and must be adapted to your organisation. Related NHI Mgmt Group resources: Home Office and Remote Worker Security Guide · Remote Working Security for Staff Guide · ZTNA Guide · Wi-Fi Security Guide