When a team member works from a kitchen table or a spare bedroom, their home network becomes part of your business infrastructure. The router in their living room, the personal devices on the same Wi‑Fi, the family computer sharing broadband — these are not peripheral concerns. They are attack surfaces.

The NCSC updated its guidance on home working in January 2026, and the GOV.UK ministerial letter on cyber security to small businesses, published in November 2025, makes clear that the government regards home-based working as a central component of a business's overall cyber defence. The 2025/2026 Cyber Security Breaches Survey found that 43% of UK businesses reported a breach or attack in the last 12 months, with phishing as the dominant vector at 38%. Small businesses with remote staff face a compounded risk: the attack surface stretches from the office into every home network the team uses.

This article covers what home office cybersecurity means for an owner-managed business with 10 to 25 seats, the controls that matter most, and the practical steps you can take to tighten your home-based security posture.

Why home offices create a different risk profile

The office carries a kind of passive security infrastructure. Corporate Wi‑Fi, centralised logging, standardised device builds, monitored firewalls — these exist without each employee thinking about them. A home office does not have those built-in defences.

A typical home network serves three distinct users. The working-from-home employee uses it for business email, Microsoft 365, and any cloud applications. A partner or family member may stream video, shop online, or browse social media. Children may use connected devices for education or entertainment. A single broadband router carries all of that traffic.

This is not a problem on its own — millions of home networks work perfectly fine. The problem arises when business data flows through a network that has no segregation between personal and work traffic, no centralised access logging, and no device inventory that the business owner can verify.

For a small business, the gap is rarely malice. It is simply that the owner has never been asked to think about their team's home networks as part of the corporate perimeter.

The five home-office controls that matter most

These five controls address the most common ways home working weakens an SME's security. They are not exhaustive. They are the highest-return actions based on the NCSC's home-working guidance, the five Cyber Essentials technical controls, and the patterns we see when reviewing SME setups.

1. Secure the home router

The home router is the boundary between your team's business data and the wider internet. For a small business that does not own the home broadband connection, you cannot configure every customer's router. But you can set a minimum standard and require evidence of compliance.

A secure home router should meet these criteria:

• WPA2 or, preferably, WPA3 encryption enabled on the Wi‑Fi network

• The default administrator password changed from the factory setting

• Firmware up to date, or an automatic update schedule in place

• Remote management features disabled

• Guest Wi‑Fi available for personal devices, if the router supports it

Some routers manufactured before 2022 do not support WPA3. Advise staff to check their router specifications and consider replacing hardware older than five years if it only supports the outdated WPA standard.

What to verify: Include router security as part of your annual remote-work policy review. Provide staff with a one-page checklist they can use to confirm their router meets the standard.

2. Enforce multi-factor authentication everywhere

Home-office employees often log in from devices and browsers that the organisation does not manage. Without multi-factor authentication (MFA), a stolen password gives an attacker unrestricted access from wherever they are.

MFA should be enforced across all accounts that store or access business data. This means email (Microsoft 365), cloud storage, any SaaS applications used for client work, and admin accounts. The NCSC recommends phishing-resistant methods — FIDO2 security keys or authenticator apps — over SMS-based codes, which are vulnerable to SIM swapping.

For a business on Microsoft 365, enabling MFA through Conditional Access is straightforward. Microsoft 365 Business Premium and above include this capability within the existing subscription. For owner-managed businesses, the configuration is manageable, and the risk reduction is immediate.

What to verify: Check your Microsoft 365 admin centre to confirm MFA is enforced for every user account. Document the settings in your IT security log.

3. Require device encryption and endpoint protection

When a laptop leaves the office, it carries the same business data as it would on a desk at headquarters. Full disk encryption ensures that data is unreadable if the device is lost or stolen — a common scenario with remote staff who carry laptops on trains, in cars, or in café bags.

For Microsoft Windows devices, this means BitLocker. For Apple devices, FileVault. Both can be managed centrally through Microsoft Intune, which is included with Microsoft 365 Business Premium.

Equally important is endpoint protection. Every device connecting to your business systems must have security software installed and reporting. This includes antivirus or, ideally, endpoint detection and response (EDR) software. The software must be configured to update automatically and to report status to a central console.

What to verify: Run a scan of all registered devices to confirm encryption is active and endpoint protection software is reporting. Flag any device that has not checked in within the last 48 hours.

4. Segment and restrict network access

Not every device on a home network needs access to your business systems. The principle of least privilege applies to home environments just as it does to offices.

Where staff use a work-issued device, ensure that remote access to internal resources goes through a corporate VPN or a zero trust network access (ZTNA) solution. If an employee can reach your server applications directly from home Wi‑Fi without a gateway, this requirement is not met and your Cyber Essentials position is compromised.

Some home routers support VLANs or guest networks. Where this is available, advise staff to isolate personal devices from the work device on the same network. This is not a substitute for device-level controls, but it reduces the surface area if a personal device is compromised.

What to verify: Confirm that remote access to internal resources goes through the approved gateway. Audit connection logs for any direct-exposure connections.

5. Manage the joiner, mover, leaver lifecycle at home

Remote work changes the joiner-mover-leaver dynamic. When an employee joins, their home device may not be managed by any IT policy. When they change roles, access rights may persist that are no longer needed. When they leave, credentials tied to a home broadband connection can remain active in ways that are harder to track than an office-based device.

When a team member shifts from office to home, their access profile should not change — but the verification step before access is granted should be stricter. Review permissions quarterly and remove access that is no longer required. This applies to former employees, contractors, and anyone whose role has changed.

Administrative accounts carry elevated privileges. If compromised from a home device, they give an attacker control over the entire environment. Require MFA on admin accounts and never use admin credentials for routine daily tasks.

What to verify: Keep a register of who has access to what, reviewed at least quarterly. Confirm that departed employees' access tokens have been revoked and that contractor accounts follow the same standards as employee accounts.

What goes wrong if home-office security gaps are left unchecked?

Unchecked gaps do not remain hidden. The 2025/2026 GOV.UK Cyber Security Breaches Survey found that 38% of businesses experienced a phishing attack in the last 12 months. That is not a distant risk — it is a current reality for businesses of every size.

Missing MFA on a single email account can cascade into full compromise through password-reset chains. An unencrypted laptop stolen from a vehicle may contain client data subject to GDPR notification requirements. A home router configured with the default password gives anyone on the same network the opportunity to intercept traffic.

The Cyber Essentials certification process examines these controls during technical audit. Cyber Essentials Basic asks you to confirm your controls exist. Cyber Essentials Plus verifies them under technical audit. Either way, home-office configurations are part of what is assessed because they are the route through which remote users access business resources.

What you can do this week

You do not need a £50,000 project to improve your home-office security posture. You need focused action on the highest-impact items.

Today. Log into your Microsoft 365 admin centre and check that MFA is enforced for every user account. Run a quick scan to confirm all devices have encryption active.

This week. Provide staff with a one-page home network security checklist. Send a reminder about the joiner-mover-leaver process and confirm that departed employee access has been revoked.

This month. Review your remote access gateway configuration. Confirm that internal resources are not directly exposed to the internet. Audit admin accounts and ensure they carry MFA.

This quarter. Complete the full home-office security review. Update policies. Brief all remote staff on any changes. Test your incident response plan against a remote-work scenario.

Next steps

A checklist is a starting point, not a finish line. The value comes from understanding what your specific organisation actually has in place — and what is missing.

Book a Security Triage Call to assess your current home-office controls against recognised standards and identify the gaps that matter most for your business.

FAQs

Does Cyber Essentials require me to secure my employees' home routers?

Cyber Essentials does not mandate a specific technology for remote access, and it does not require you to configure staff home routers. It does require you to demonstrate controls over how remote users access business resources. That means setting a standard for home network security, verifying compliance through your own processes, and ensuring that remote access is not bypassed through direct internet-facing connections. A well-communicated policy with a simple compliance checklist is usually sufficient for Cyber Essentials Basic.

Can I secure a home office without providing staff with company laptops?

You can, but your options are more limited. If staff use personal devices, you should have a written bring-your-own-device policy specifying minimum requirements — encryption, up-to-date operating system, approved security software — and the organisation's right to refuse connection from non-compliant devices. Without company-managed devices, you cannot enforce settings centrally. MFA and strong password policies become even more important because the device itself is less controllable. In these circumstances, we typically recommend that any device accessing business data meets a baseline standard — and if it cannot meet that standard, access is restricted.

How does home-office cybersecurity relate to Cyber Essentials?

Cyber Essentials treats remote working as one of its five foundational technical controls. The scheme does not prescribe a single technology. It requires that you demonstrate controls over how remote users access business resources outside the office perimeter. Home-office configurations are examined because they are the route through which staff connect to your systems. MFA, device encryption, endpoint protection, secure network access, and patched software are the controls that matter both inside and outside the office.

Is home-office cybersecurity only relevant for fully remote businesses?

No. Home-office cybersecurity applies to any business that allows staff to work remotely, even if only a few days a week. The controls are the same whether your team works from home two days per week or fully remotely. The key principle is that every connection to your systems — whether from the office, a home laptop, or a hotel — must be verified and protected.