When your team works from home, the office door no longer controls who reaches your systems. Remote access has become one of the most widely used entry points for attackers targeting UK businesses — and for small and medium-sized enterprises it is often the weakest link.

This guide covers what secure remote access actually means for a business with 10 to 25 seats, what the NCSC and Cyber Essentials expect, and the practical steps you can take without rebuilding your IT estate.

Why remote access is the new front door

Every employee who logs in from a laptop, a café, or a kitchen table is opening a channel back into your network. That channel matters because it carries the same level of trust as someone walking into your office and handing their badge to reception.

The National Cyber Security Centre updated its zero trust architecture guidance in January 2026, reinforcing a simple premise: every access request must be verified, no matter where it comes from. Remote access is the point where that verification either happens — or is bypassed.

For owner-managed businesses in Sussex and Kent, the problem is often not malice but misconception. A typical assumption is that the home Wi-Fi router provides enough protection. It does not. Residential networks lack the segmentation, logging, and policy controls of a corporate environment.

What Cyber Essentials requires from remote working

Cyber Essentials treats remote working as one of its five foundational technical controls. The certification scheme, developed by the NCSC, does not prescribe a single technology. It requires that you demonstrate controls over how people access business resources outside the office perimeter.

The five technical controls that matter for remote access are:

Firewalls. Every device connecting to your systems must pass through a firewall that enforces an allow-list. If an employee can reach your server applications directly from the internet, you have not met this requirement.

Secure configuration. Devices and applications used remotely must be configured to corporate standards. That includes enforced encryption, up-to-date operating systems, and screensaver lock timers.

Security update management. Remote devices are often the first to fall behind on patches. Your organisation must have a programme to track and deploy security updates on machines that are not always on your network.

User access control. Access rights must be granted on a need-to-know basis. When a team member shifts from office to home, their access profile should not change — but the verification step before access is granted should be stricter.

Malware protection. Endpoint security must be active on every device, whether it sits on your network or on a dining table in Tonbridge. Antivirus and endpoint detection and response (EDR) must be installed, configured, and reporting.

Cyber Essentials Basic asks you to confirm these controls exist. Cyber Essentials Plus verifies them under technical audit. Either way, remote access configurations are examined.

Prepare for Cyber Essentials certification with support from Infinite Cloud IT.

The zero trust approach: verify before you trust

Zero trust is not a product you buy. It is an architecture principle: never trust, always verify. The NCSC zero trust framework sets out eight design principles, and several of them map directly onto remote access decisions.

For a small business, the practical takeaway is straightforward. When an employee in Brighton connects from a broadband line, the system should not assume that connection is safe. It should authenticate the user, authenticate the device, and authorise only the applications that person needs — nothing more.

That means replacing old-style VPN tunnels that grant broad network access with solutions that use identity as the perimeter. Multi-factor authentication becomes the first checkpoint, followed by conditional policies that evaluate device health, location, and time before granting access to your Microsoft 365 environment.

How zero trust differs from a traditional VPN

A traditional VPN extends your office network outward. A user who authenticates once gains access to servers, shared drives, and internal applications as though they were sitting at their desk in the office. That convenience is also its risk — if credentials are compromised, the attacker walks right in.

A zero trust approach gates access at the application level. Each request is evaluated independently. If someone's laptop fails a health check, they may still access email but not file servers. If a connection originates from an unrecognised location, additional verification is triggered. The network does not become the trust boundary — identity and policy do.

What Can You Do to Improve Remote Access Security?

You do not need a Fortune 500 budget to build secure remote access. You need a clear plan that addresses the right controls. Here is what to prioritise.

1. Enforce multi-factor authentication everywhere

MFA is the single most effective control for preventing unauthorised access. If your organisation still relies on passwords alone for remote logins, that is the first gap to close. Microsoft 365 includes MFA capabilities, and for a business of 10 to 25 users the configuration is manageable without expensive additional software.

The NCSC recommends phishing-resistant authentication methods — FIDO2 security keys or authenticator apps — over SMS-based codes, which are vulnerable to SIM swapping. For owner-managed businesses, the investment is minimal and the risk reduction is immediate.

2. Deploy a zero trust network access (ZTNA) solution

Traditional VPNs are giving way to zero trust network access platforms that verify each session rather than establishing a persistent tunnel. Microsoft Entra Conditional Access, for example, evaluates risk signals continuously and adjusts access permissions in real time.

For SMEs already on Microsoft 365, Conditional Access policies can be configured to require MFA for any sign-in originating outside your trusted network, enforce device compliance checks, and block access from high-risk locations. The licence cost sits within existing Microsoft 365 Business Premium or E3/E5 plans.

3. Inventory every remote device

You cannot protect what you do not know about. Remote access security starts with an accurate register of devices that connect to your business systems. That includes company-owned laptops, personal devices approved under BYOD policies, and even contractors' machines.

Each device should be enrolled in your endpoint management solution so that you can enforce encryption, patch levels, and application allow-lists regardless of where the device is connected from.

4. Segment network access by role

Not every employee needs access to every application. Role-based access controls ensure that a finance assistant cannot reach HR records, and a field technician cannot access payroll data. This limits the damage if credentials are stolen and supports the Cyber Essentials user access control requirement.

5. Monitor and log every connection

Logging remote access events is not optional. It is a requirement for Cyber Essentials, a foundation for incident investigation, and a baseline for insurance compliance. Your logging solution should capture authentication attempts, device health signals, and access decisions — and send them to a centrally managed SIEM or cloud logging platform.

Common mistakes that small businesses make

The pattern is repetitive. In conversations with businesses across Sussex and Kent, the same issues surface again and again.

Leaving legacy VPNs running. Older VPN appliances may still be in use from a previous setup. They often lack MFA enforcement, do not inspect traffic for malware, and can be exploited through known vulnerabilities that the manufacturer no longer patches.

Assuming home Wi-Fi is secure. A typical residential broadband connection has no network segmentation. If a family member's device is compromised, the attacker has a direct path to your corporate resources through the VPN.

Skipping device health checks. MFA protects the identity. It does not protect the device. If a compromised laptop connects to your network, MFA cannot stop the malware already running on it. Device posture checks should happen before any access is granted.

No contractor or third-party controls. Remote access policies frequently cover employees but overlook contractors, temporary staff, and managed service providers. Each of these is an additional access vector that should be governed by the same standards.

Getting started: the Security Triage Call

If you are unsure where your remote access setup stands against these requirements, the first step is not a long audit or a procurement exercise. It is a Security Triage Call — a focused session to understand your current posture, identify the gaps that matter most, and agree a practical plan to close them.

Book a Security Triage Call to get clarity on your remote access controls and what needs to change.

FAQ

Does Cyber Essentials require a specific type of remote access solution?

No. Cyber Essentials does not mandate any particular product or vendor. It requires that you demonstrate controls over how remote users access business resources. That can be achieved through a VPN with proper MFA, a zero trust network access platform, or a cloud-based access gateway — as long as the five technical controls are satisfied.

Can my small business use Microsoft 365 for secure remote access?

Yes. Microsoft 365 includes Conditional Access, which enforces MFA, evaluates device compliance, and blocks high-risk sign-ins. Combined with Microsoft Intune for device management, it provides the core controls needed for secure remote access without introducing a separate vendor stack.

What happens if a remote device is lost or stolen?

Device loss requires immediate remote wipe capability and the ability to revoke access tokens. Mobile device management (MDM) platforms like Microsoft Intune allow you to remotely wipe company data from a lost device while preserving personal data on BYOD setups. Access tokens should also be revoked through the identity provider to prevent any further use of compromised credentials.

How often should remote access policies be reviewed?

At minimum quarterly, and immediately after any security incident or significant change to your team structure. Cyber Essentials certification is renewed annually, but waiting until then to review remote access controls is too late if an incident has occurred. Regular reviews ensure your policies reflect current threats and business changes.

Is a zero trust approach too expensive for an SME?

Zero trust is an architecture principle, not a licence type. The cost depends on which tools you already use. If you are on Microsoft 365 Business Premium or above, Conditional Access and Intune are included. The real expense is in the configuration and ongoing management — which is where specialist IT support adds value.