Remote Work Security Checklist for 2026

Remote and hybrid work stopped being temporary years ago. Security models that assume everyone's in one building haven't caught up, and home Wi-Fi, shared PCs, and coffee-shop logins are now part of your attack surface.

This checklist is for operators securing 10–150 distributed staff without a corporate campus.

Identity and access

• MFA enforced on all cloud identity (no SMS-only for admins)
• Conditional access blocks legacy authentication protocols
• Shared accounts eliminated or strictly limited with logging
• Offboarding disables access same day, including SaaS apps
• VPN/ZTNA uses individual credentials, not shared keys

Devices

• Company laptops enrolled in MDM with encryption required
• Patch compliance policy, out-of-date OS blocked from sensitive apps
• Personal devices blocked from PHI unless formal BYOD program exists
• Remote wipe tested on at least one device annually

Network

• Split tunnel vs full tunnel decision documented with rationale
• Admin access to infrastructure requires more than VPN alone (MFA + jump host or PAM-lite)
• Home router guidance provided to staff (change default password, firmware updates)

Applications and data

• Sensitive data lives in controlled cloud storage, not desktop downloads
• External sharing defaults restricted on SharePoint/Drive
• Printing and local copy policies considered for PHI environments

Monitoring and response

• EDR deployed on endpoints with alerts triaged by a human
• Impossible travel / risky sign-in alerts reviewed
• Staff know how to report phishing, and simulations run quarterly

Physical and human

• Screen lock timeout enforced
• Clean desk guidance for home workers handling sensitive calls
• Incident contact tree works if email is compromised

Review cadence

Run this checklist quarterly. Remote work drift is real, policies erode one exception at a time.

Need help closing gaps? Contact Precipice.