Guide

Remote Work Security: Securing Your Team Without Enterprise Software

Your team is working from Starbucks, their living room, and maybe an Airbnb in Bali. This flexibility is great for morale but a nightmare for security. How do you protect company data when it's outside your office walls?

By SecureBusinessHub Editorial, International cybersecurity desk — · 6 min read

Your team is working from Starbucks, their living room, and maybe an Airbnb in Bali. This flexibility is great for morale but a real problem for security. How do you protect company data when it's outside your office walls? The practical steps below cost little and take minutes each, and they work best when they're backed by a written BYOD and remote work policy so everyone follows the same rules rather than their own judgement.

No public Wi-Fi without a VPN

Public Wi-Fi is dangerous. Someone in the same lobby can intercept unencrypted traffic. If you don't have a corporate VPN, get a team subscription to a trusted option like NordVPN or ExpressVPN. Better yet, tell employees to use their phone hotspot — LTE and 5G are far more secure than coffee shop Wi-Fi.

Beyond a basic VPN

A standard VPN might not be enough anymore. Businesses that are serious about remote security use always-on VPNs that establish a secure tunnel the moment the laptop starts, before the user even logs in. This prevents data leaking from traffic sent before someone remembers to click Connect, and routes all traffic through a gateway where filtering and threat detection can apply.

Pair that with conditional access. Instead of only asking "do they have the password?", ask "is this device in a known-good state?". Conditional access blocks a login if the laptop is running an outdated operating system or has its antivirus disabled, turning device health into a layer of authentication so only verified hardware touches sensitive files or financial data.

Disk encryption is mandatory

If an employee loses their laptop in an Uber, that data is gone — unless the disk is encrypted. On Mac: search "FileVault" in settings and turn it on. On Windows: search "BitLocker" or "Device Encryption" and turn it on. It's free, takes five minutes, and makes the drive unreadable to anyone without the password.

Manage devices, and be able to wipe them

Use a mobile device management (MDM) tool to confirm remote devices are encrypted and can be wiped remotely if lost. For any laptop carrying client data, this isn't optional — it is the difference between a lost device being an inconvenience and being a breach. MDM also lets you push security settings consistently instead of trusting each person to configure their own machine correctly.

Use encrypted communication

Stop using consumer apps like WhatsApp for sensitive business discussions. Switch to tools with end-to-end encryption by default — Signal, or dedicated business platforms that support it — so that a conversation about a client or a contract can't be read in transit.

Separate work and personal use

Set up a separate user account on the computer for work. Don't let household members use the same profile that accesses company bank accounts or client files.

In a remote setup, your security is only as strong as the weakest device on the employee's home network. Consumer IoT devices rarely receive security updates, and a compromised home camera can be a jumping-off point to an unsecured laptop on the same network. Advise your team to put work devices on a guest Wi-Fi network at home, physically separating business data from vulnerable household gadgets.

Zero-touch provisioning

As you add headcount, you can't manually configure every laptop. Use zero-touch provisioning tools like Apple Business Manager or Windows Autopilot. Ship a laptop directly to a new hire, and the moment they connect to Wi-Fi, the device installs your security policies, encryption settings, and VPN configuration automatically — security from day one, without a tech call. For a more advanced architecture, see our Zero Trust vs VPN comparison.

NIS2 requirements: the second regime to know about

Data protection law is not the only European regime a business gets asked about. The NIS2 directive sets baseline cybersecurity and incident-reporting obligations for organisations in a defined list of sectors, and it is the source of most of the security questions that now arrive attached to contracts. The two regimes cover different ground: data protection law governs personal data and what people can ask you to do with it, while the NIS2 requirements govern the security and resilience of network and information systems, whether or not personal data is involved. A single incident can engage both, on separate clocks, to separate authorities.

The directive applies to organisations in its listed sectors that are at least medium-sized, meaning broadly fifty or more employees or turnover and balance sheet above ten million euros. That size rule puts most small businesses outside its direct scope, and the honest answer for a ten-person company is usually that the directive does not regulate it. What the size rule does not do is keep the requirements away, because one of them is supply chain security: organisations inside scope are expected to consider the security practices of their direct suppliers, and the way that expectation shows up in the world is as a questionnaire in your inbox.

The measures the directive names are a reasonable checklist for any business, which is why they are worth knowing even when they do not apply to you directly. They cover risk analysis and written security policies, incident handling, business continuity and backups, supply chain security, secure development and vulnerability handling, basic cyber hygiene and training including for management, encryption and access control policies, and multi-factor authentication. Reporting is staged and fast for the organisations it covers: an early warning within twenty-four hours of becoming aware of a significant incident, a fuller notification within seventy-two hours, and a final report within one month.

Because the directive is national law in each member state rather than a single rulebook, the details of scope, thresholds and reporting differ by country. For a fuller explanation of the instrument itself, see our guide to what the NIS2 directive is, and for the supplier side of the supply chain obligation, our walkthrough of vendor risk assessment. The reporting clocks that run alongside data protection deadlines are covered in data breach notification requirements.

Frequently asked questions

Does NIS2 apply to a small business?

NIS2 generally applies to organisations in its listed sectors that are at least medium-sized, meaning broadly fifty or more employees or turnover and balance sheet total above ten million euros. Most smaller businesses fall outside its direct scope, unless a member state has specifically designated them or they sit in one of the size-independent categories such as DNS service providers or trust service providers. Being outside scope does not stop the directive reaching you through customers who are inside it.

What is the difference between GDPR and NIS2?

GDPR governs personal data: what you may collect, why you may hold it, and what rights people have over it. NIS2 governs the security and resilience of network and information systems in specific sectors, whether or not personal data is involved. One incident can engage both regimes at once, on separate reporting clocks and to separate authorities.

How long do you have to report a data breach?

Under the European model, a personal data breach is reported to the supervisory authority without undue delay and, where feasible, within seventy-two hours of becoming aware of it, and affected individuals are told without undue delay where the risk to them is high. Organisations in scope of NIS2 carry a separate obligation: an early warning within twenty-four hours, a fuller notification within seventy-two hours, and a final report within one month.

Does a small business need a data protection officer?

Under GDPR a data protection officer is required where the organisation is a public authority, where its core activities involve regular and systematic monitoring of people on a large scale, or where its core activities involve large-scale processing of special category or criminal offence data. Most small businesses meet none of those tests and are not required to appoint one, though naming someone internally as the contact for privacy questions is worth doing regardless.

What should a small business do when a client's security questionnaire asks about NIS2?

Answer what you actually do rather than what you think the client wants to hear. The questions usually cover written security policies, incident handling and how fast you would notify them, multi-factor authentication, access control when staff join and leave, backup and recovery arrangements, and which of your own subprocessors touch their data. Gaps are common, and disclosing one with a date for closing it lands far better than an answer that does not survive the follow-up question.

Do these rules reach a business based outside the EU?

They can. GDPR reaches organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour, and other regions have their own regimes with their own triggers. NIS2 obligations follow the sectors and the member states that transpose it, but its supply chain expectations travel through contracts, which is how they reach suppliers anywhere in the world.

Related reading