TL;DR
A remote work security policy fails for one reason more than any other: it forbids something people have to do anyway. Six short rules cover the ground, and the equipment clause is the one that quietly determines whether the rest holds.
- Do not ban public wifi. Require the controls that make it survivable.
- A VPN is an access route, not a reflex. Require it where it is one.
- Say whether personal devices are allowed. Silence means yes.
- Address family use. It happens and nobody writes it down.
- Ask for notice before extended work abroad.
- Review the equipment clauses first. They drift furthest.
When a short version is enough
Four stages, and only the last two need much.
Occasional home working. People are mostly in an office. A paragraph in the handbook is proportionate and a full policy would describe conditions you rarely face.
Best tools for HR Operations
Hybrid by default. Devices now travel twice a week and the physical risks are real. Worth stating the lock screen, the encryption and the reporting route.
Remote by default. The home is the workplace, you will never inspect it, and everything here applies. Honesty about what you cannot verify is the main drafting skill.
Remote across borders. Data location, support and recovery all differ by country. One wording stretched across every market produces unequal outcomes nobody chose.
Why a remote work security policy gets ignored
Most of these documents were written in a hurry, by people with no way to verify anything, for a situation everybody assumed was temporary. That origin shows in the drafting.
The clearest symptom is the unenforceable ban. No public wifi. No working from a cafe. No family in the room. Each sounds responsible and none can be checked, so people break them routinely and learn that this particular document does not describe real expectations. Once that lesson lands it applies to the whole policy, including the parts that mattered.
The second symptom is advice aimed at a threat model you do not have. Long sections about network segmentation and router firmware, written for a company with offices, handed to somebody working from a flat. It is not wrong. It is just not theirs.
Guidance on home and remote working from the National Cyber Security Centre leans heavily on device-level controls for exactly this reason: the device is the thing you issued and can configure, while the home network is not. Information security expectations in ISO/IEC 27001 point the same way, towards controls you can actually operate.
The six rules worth keeping
- Device standard. Company equipment, encrypted, current operating system, short automatic lock. This carries most of the real protection.
- Network, scoped honestly. No bans. State what must be true for company work, and require your access route for internal systems.
- Physical care. Not left visible in a car, not unattended in public, locked when you step away. Simple and genuinely effective.
- Local storage. What may be kept on the device and for how long, which is the rule most policies never attempt.
- Reporting. One route, hours not days, and a plain statement that reporting fast is expected and not penalised.
- Equipment return. What happens to the device at the end, named as a process rather than an obligation.
Six rules on one page. The test for each is whether a reasonable person could comply without inventing a workaround, because a workaround is the policy failing quietly.
Five questions before you draft
What can you actually verify? Write rules about those things and advice about the rest, and be clear which is which.
Do you supply equipment to everyone, including contractors? If not, a personal device ban is unenforceable by construction.
Which internal systems need your network? That list, not habit, decides your VPN rule.
What do people store locally today? Ask one person. The answer usually reshapes the storage clause.
Can you recover a device from every country you employ in? If not, the last rule is aspirational in those markets.
How teams enforce it, and the trade-offs
Policy and trust. Best for very small teams and cheap to run. It struggles on evidence, since you cannot show an auditor that anything was applied, only that it was published.
Device management with enforced settings. Best by a distance for encryption, patching and lock screens, because it makes the rule true rather than requested. It struggles on personal devices and on anything that stays offline.
Single sign-on with conditional access. Best for the network question, since it checks device state at the point of access instead of asking about the wifi. It struggles on cost and on tools outside it.
Training and regular reminders. Best for the physical rules, which are behavioural and cannot be enforced technically. It struggles on retention, which is why short and occasional beats long and annual.
Closing the equipment clause with a recovery route. Disclosure: RemoAsset is owned by the same people who publish this site. It handles delivery, retrieval and certified wiping across 80 or more countries, which matters because the return rule is the one clause that depends entirely on logistics. Where it struggles: it will not configure your devices, enforce a setting or decide your VPN position. The narrow part it covers is whether the device comes back and is wiped.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| Occasional home working | Any | Office based | Low exposure | A handbook paragraph |
| Hybrid by default | 50 plus | One IT owner | Devices travelling | Device standard plus physical care |
| Remote by default | Any | No office | Nothing verifiable | Enforce at the device, advise the rest |
| Personal devices in use | Any | Any | Ban is theatre | Supply kit, or permit and scope it |
| Several countries | 100 plus | HR and IT | Rules do not travel | Core policy plus local annexes |
| Devices rarely returned | Any | Any | Last clause aspirational | Fix recovery before rewording |
What an unfollowable policy costs
The first cost is credibility, and it spreads. Somebody breaks the public wifi rule, nothing happens, and they correctly conclude the document is advisory. That conclusion then covers the encryption rule and the reporting rule, which actually mattered.
The second is silence when something goes wrong. A policy written in the language of prohibition teaches people that admitting a mistake invites blame. So the laptop left in a taxi gets mentioned on Monday rather than Thursday, and the delay costs more than the loss.
The third is the gap between what you wrote and what you can show. Stating that all remote devices are encrypted is a claim. Demonstrating it for a named machine on a named date needs a record somebody made at issue, and most policies assume that record exists without requiring it.
The fourth is the clause at the end. Every one of these policies says equipment must be returned, and the companies where that is reliably true are the ones with a route rather than the ones with firmer wording.
So the question is not whether your policy covers remote work. It is whether somebody working from a cafe this afternoon is following it, and whether they could.
The clause that depends on logistics
Five of the six rules can be met by configuring a device and asking people to behave sensibly. The sixth cannot, because returning hardware involves a person who no longer works for you and a courier.
Three signals say that clause is weaker than it reads. You cannot list which devices are currently with former staff. Collections from outside your main market stalled or never finished. And the return process starts when somebody notices rather than when notice is given.
Those are operational rather than editorial problems. A firmer sentence does not reach them, and a stricter clause you cannot deliver is worse than a loose one, because it sets an expectation you then miss in front of whoever is reviewing you.
Worth settling before the next revision, since it is the only rule in the document whose success is measurable in days. Looking at how delivery, recovery and wiping run as one tracked process tells you whether this clause is real.
See how equipment is handled for distributed teams
Read our guide to the information security policy
Related reading
- The information security policy
- The acceptable use policy
- BYOD, and where it breaks
- The work from home policy
- Remote work equipment, practically
Frequently Asked Questions
What should a remote work security policy cover?
Device standards, network expectations, physical security away from home, what may be stored locally, how to report a problem, and what happens to equipment when somebody leaves. Six areas, each short. A longer policy is not a stronger one, it is a less read one.
Should we ban public wifi?
A ban is unenforceable and people will use it anyway, which teaches them the policy is optional. The useful version requires the controls that make it acceptable, such as a current operating system, full disk encryption and company traffic going over your own connection where that applies.
Do people need a VPN at home?
It depends on what you are protecting rather than on habit. If your systems are cloud services behind single sign-on and multi-factor, a general purpose VPN adds little. If you have internal systems reachable only on your network, it is the access route and should be required for those.
Can people use personal devices?
Decide explicitly rather than leaving it unsaid, because unsaid means yes in practice. If you permit it, state which systems may be reached and what the device must have. If you do not, you need to actually supply equipment, including to contractors, or the rule becomes theatre.
What about family using the work laptop?
Say something, because it happens constantly and silence is read as permission. A workable line is that the device is for the employee only and must be locked when unattended. That is enforceable in spirit and does not pretend you can police somebody’s living room.
How do we handle somebody working abroad?
Require notice before an extended stay, because the questions it raises are tax, employment and data related rather than purely technical. From a security angle the practical issues are device recovery and support from that country, both of which are easier to arrange in advance.
How often should it be reviewed?
Annually, and whenever your working pattern changes materially. Many of these policies were written quickly during a sudden move to remote work and describe a temporary arrangement that became permanent. The equipment clauses drift furthest from practice, so read those first.
