The 2025/2026 Cyber Security Breaches Survey found that 43% of UK businesses reported a cyber breach or attack in the last 12 months — and phishing remained the single most common attack vector at 38% across all organisation sizes. Remote work has expanded the attack surface faster than many SMEs can address it. When employees access business systems from home networks, hotel Wi-Fi, or public spaces, the perimeter moves beyond anything a single router can protect.

This checklist gives owner-managed businesses with 10 to 25 seats a practical, action-by-action approach to securing remote work. It draws on guidance from the National Cyber Security Centre's small organisations guide, the NCSC's January 2026 update to its zero trust architecture guidance, and the five technical controls required by Cyber Essentials. Each item states what to do, what evidence to keep, and what goes wrong if it is left undone.

Use it during your annual policy review or when onboarding new remote workers.

Identity and access controls

Identity and access form the foundation of remote work security. Every person who connects from outside your office must prove who they are before accessing any business data. The NCSC calls this zero trust — verify every request, regardless of location.

1. Enable multi-factor authentication on every account

Multi-factor authentication (MFA) or two-step verification (2SV) should be enforced across all accounts that store or access business data. This includes email (Microsoft 365), cloud storage, VPN, and any SaaS applications used for client work. The NCSC's small organisations guide lists 2SV as one of the fastest controls to implement — often achievable within five minutes per account.

Remote workers tend to log in from different devices and locations. Without MFA, a stolen password gives an attacker unrestricted access from anywhere in the world.

What to verify: Check your Microsoft 365 admin centre to confirm MFA is enforced for every user account. Document the settings in your IT security log.

2. Standardise login methods across the organisation

Not every team member uses the same device or the same browser. Decide on one standard sign-in method and apply it consistently. Where Microsoft 365 is your email platform, enable passkeys where available — the NCSC now recommends passkeys as the preferred authentication method because they cannot be intercepted or phished the way passwords can.

What to verify: Confirm all staff have been migrated to the approved login method and record the date each user completed the switch.

3. Manage access rights on a need-to-know basis

When employees switch between office and remote work, their access profile should not change — but the verification step before access is granted should be stricter. Review permissions quarterly and remove access that is no longer required. This applies to former employees, contractors, and anyone whose role has changed.

What to verify: Keep a register of who has access to what, reviewed at least quarterly.

4. Lock down admin accounts

Administrative accounts carry elevated privileges. If compromised, they give an attacker control over the entire environment. Require MFA on admin accounts. Do not use admin credentials for routine daily tasks — including remote email checks.

What to verify: Identify how many accounts have administrative rights. That number should be small, and every one must be protected by MFA.

Device security

When a team member works remotely, the device itself becomes the office perimeter. The NCSC treats device security as a non-negotiable control.

5. Enforce device encryption

Every laptop and mobile device that accesses business data must have full disk encryption enabled. For Microsoft Windows devices, this means BitLocker. For Apple devices, FileVault. Encryption protects data if a device is lost or stolen — a common scenario with remote staff who carry laptops on trains, in cars, or in café bags.

What to verify: Run a scan of all registered devices to confirm encryption is active. Record the result in your asset register.

6. Ensure endpoint protection is active and reporting

Every device connecting to your systems must have security software installed and reporting. This includes antivirus or, ideally, endpoint detection and response (EDR) software. The software must be configured to update automatically and to report status to a central console.

What to verify: Confirm that your security management console shows all devices as active. Flag any device that has not checked in within the last 48 hours.

7. Keep devices and software up to date

The NCSC stresses that keeping operating systems and applications patched is one of the most impactful things a small organisation can do. Remote devices are often the first to fall behind on updates because they are not consistently connected to the office network.

Configure automatic updates where possible. For managed environments, your patch management tool should push updates to remote devices whether they are on the office network or at home.

What to verify: Check that your patch management dashboard shows all remote devices within your acceptable patch-age window (typically 14 days).

8. Establish a bring-your-own-device policy

If staff use personal devices for work, you need a written policy covering what is and is not allowed. The NCSC's guidance on bring-your-own-device recognises that SMEs often rely on staff devices. A good policy specifies minimum device requirements — encryption, up-to-date OS, approved security software — and gives the organisation the right to refuse connection from non-compliant devices.

What to verify: Confirm your BYOD policy exists, is current, and has been acknowledged by every staff member who uses a personal device.

Network security

Remote workers connect through networks the organisation does not control. That does not mean you have no influence.

9. Require a corporate VPN for sensitive access

If your remote workers need to access file servers, internal applications, or on-premise systems, they should do so through a corporate VPN rather than exposing those services directly to the internet. The VPN encrypts the connection and routes traffic through your firewall, preserving the same access controls you apply inside the office.

Cyber Essentials requires that any internet-facing services are behind a firewall. If an employee can reach your server applications directly from home Wi-Fi without a VPN, this requirement is not met.

What to verify: Confirm that remote access to internal resources goes through the VPN. Audit connection logs for any direct-exposure connections.

10. Advise remote workers on secure home network practices

You cannot configure a customer's home router, but you can advise. A basic checklist for remote staff includes: changing the default router admin password, updating the router firmware, enabling WPA3 or WPA2 encryption on Wi-Fi, and turning off remote management features.

Some devices manufactured before 2022 do not support WPA3. Advise staff to check their router specifications and replace hardware older than five years if it only supports the outdated WPA standard.

What to verify: Distribute a one-page guide to staff and record that it was communicated. Verify compliance through your annual policy review.

11. Block direct internet-facing remote desktop connections

If any team member has Remote Desktop Protocol (RDP) or similar remote tools exposed to the internet, this creates a significant vulnerability. Attackers routinely scan for open RDP ports and attempt brute-force login attacks. If RDP is required for remote support, it must sit behind a VPN or a zero trust network access (ZTNA) solution that verifies identity before allowing any connection.

What to verify: Run a port scan against your public-facing addresses. Confirm no RDP ports are directly accessible from the internet.

Monitoring and response

Controls without monitoring create a false sense of security. The NCSC emphasises that organisations should know when something unusual happens.

12. Centralise security event logging

All security events — failed login attempts, device connections, file access anomalies — should flow into a central logging system. For a Microsoft 365 organisation, Microsoft Sentinel or the built-in Microsoft 365 Defender portal can aggregate sign-in logs, device compliance reports, and threat alerts in one place.

What to verify: Confirm that a monitoring dashboard is active and that alerts are routed to a responsible person. Review alerts weekly at minimum.

13. Maintain a remote work incident response plan

Your incident response plan should cover scenarios specific to remote work: a staff laptop stolen from a car, a compromised home Wi-Fi network, or a phishing email clicked on a device connected from a hotel. The plan should specify who is contacted, what tools are used to isolate the device, and how client data is assessed for potential exposure.

The 2025/2026 GOV.UK Cyber Security Breaches Survey found that only 50% of small businesses had written guidance on who to notify following an incident — down from 55% the previous year. This is a measurable gap.

What to verify: Confirm your incident response plan includes a remote-work scenario and that every staff member knows how to raise an alert.

14. Test your backup and restore process

The NCSC's small organisations guide stresses that every organisation should back up critical data and test restoring from those backups. Remote workers generate data just as prolifically as office-based staff — often more, because they use personal devices and unmanaged applications to collaborate. Ensure your backup covers the data on remote devices and can be restored quickly.

What to verify: Perform at least one restore test per quarter. Record the result and the time taken.

Running the checklist

A checklist is only useful if it is run on a schedule. For a 10-to-25-seat SME, the most natural timing is during the annual policy review that most businesses conduct before the spring budget season. Here is a suggested cadence:

• Monthly: Verify device compliance (encryption, updates, endpoint protection). Review flagged devices.

• Quarterly: Review access rights. Test backup restores.

• Annually: Complete the full checklist. Update policies. Brief all remote staff on any changes.

If you find gaps during any review, address them in order of impact. Identity and access controls usually provide the highest return on effort. Device encryption and endpoint protection are the next logical step. Network controls and monitoring follow once the first two are in place.

What happens if gaps remain unchecked?

Unchecked gaps do not remain hidden. The GOV.UK Cyber Security Breaches Survey 2025/2026 found that 38% of businesses experienced a phishing attack in the last 12 months. That is not a distant risk — it is a current reality for businesses of every size.

Missing MFA on a single email account can cascade into full compromise through password-reset chains. An unencrypted laptop stolen from a vehicle may contain client data subject to GDPR notification requirements. An internet-facing RDP port left open is the difference between a closed door and an unlocked entrance.

The Cyber Essentials certification process examines exactly these controls during technical audit. Cyber Essentials Basic asks you to confirm your controls exist. Cyber Essentials Plus verifies them. Either way, remote work configurations are examined.

Next steps

A checklist is a starting point, not a finish line. The value comes from understanding what your specific organisation actually has in place — and what is missing.

Book a Security Triage Call to assess your current remote work controls against recognised standards and identify the gaps that matter most for your business.

FAQs

Is Cyber Essentials mandatory for UK businesses?

Cyber Essentials is not a legal requirement for most businesses, but it is the minimum standard recommended by the UK Government and the NCSC. It has become a procurement requirement for many government contracts and is increasingly expected by private-sector clients. Some cyber insurers also require it as a condition of cover.

What is the difference between Cyber Essentials Basic and Plus?

Cyber Essentials Basic is a self-assessment questionnaire that confirms you have the five foundational technical controls in place — firewalls, secure configuration, security updates, user access control, and malware protection. Cyber Essentials Plus adds a technical verification step where an independent assessor tests your controls against live samples of your systems. For remote work environments, Plus provides more confidence because it validates configurations rather than asking you to declare them.

How long does it take to implement a remote work security checklist?

Most items on this checklist can be addressed within a few weeks for an SME with 10 to 25 seats. MFA rollout is the fastest — often achievable within a single day for a Microsoft 365 environment. Device encryption and endpoint protection coverage can usually be completed within one to two weeks if devices are centrally managed. Network controls and monitoring depend on your existing infrastructure.

Can I apply this checklist if most of my team works from home?

Yes. This checklist is written specifically for businesses with significant or full remote work arrangements. The controls apply whether your team works from home two days a week, three days a week, or fully remotely. The key principle is that every remote connection to your systems must be verified and protected — the same standard that applies in the office.