TL;DR:

  • Remote workers create security gaps — home Wi-Fi, personal devices, and unsanctioned apps are the main risks
  • A written policy doesn’t need to be long — one clear page covering key rules is enough for most small businesses
  • Zero-trust access is replacing VPNs as the preferred approach for small teams working remotely

Remote work security is one of the most overlooked gaps in small business cybersecurity. Many UK businesses shifted to remote or hybrid work quickly and never wrote down the rules. When employees use personal laptops on home networks with whatever apps they prefer, the security controls that protect your office network don’t follow them. Here’s what actually goes wrong, and what a practical remote work security policy looks like.

The real security risks of remote work

The attack surface for a business expands significantly when people work from home. Three risks stand out.

Unsecured home Wi-Fi. Many home routers still run on default passwords and outdated firmware, and WPA2 encryption (or worse, plain WPA) leaves traffic vulnerable. An attacker on the same network, whether at a coffee shop or through a compromised home router, can potentially intercept unencrypted traffic and conduct man-in-the-middle attacks.

Personal devices (BYOD) — when employees use personal laptops and phones for work, you have no visibility into whether those devices are up to date, what other software is installed, or whether they’ve been compromised. A personal device with malware becomes a path straight into your business systems.

Shadow IT — employees solving problems with tools you haven’t approved. Personal Dropbox for sharing files, personal Gmail for work email, free VPN apps from unknown vendors. Each unsanctioned tool is a potential data leak and a UK GDPR headache — you may not even know where your customer data is ending up.

VPN vs zero-trust: which approach is right for you

A VPN (Virtual Private Network) creates an encrypted tunnel between a remote worker’s device and your office network. Traditional VPNs treat everyone inside the tunnel as trusted — which becomes a problem if a compromised device connects.

For small businesses with an office server or network resources that employees need to access remotely, a VPN is still a reasonable solution. WireGuard is a modern, lightweight VPN protocol that’s much simpler to set up than older options. Tailscale (built on WireGuard) provides a simple managed VPN for up to 20 devices on its free plan.

Zero-trust access takes a different approach: instead of trusting everyone inside a network perimeter, it verifies every user and device for every application access, regardless of location. Never trust, always verify. This is increasingly the preferred approach for remote-first teams, and it maps well to how most UK small businesses actually operate — with data living in cloud services rather than on an office server.

In practice, zero-trust for small businesses means SSO (so all app access goes through one identity provider like Google Workspace or Microsoft 365), MFA on every application, and conditional access policies that block access from unmanaged devices or unfamiliar locations.

Cloudflare Access provides zero-trust network access and is free for up to 50 users. It sits in front of internal applications and requires authentication before access is granted, without a traditional VPN.

Securing home Wi-Fi

Your remote work policy should include clear guidance on home network security. Employees should use WPA2 or WPA3 encryption — they can check this in their router’s wireless settings. The router admin password should be changed from the factory default. If the router supports it, a separate work network or VLAN keeps work devices isolated from IoT devices and family devices. And public Wi-Fi should be avoided for anything sensitive — if it’s necessary, use the VPN or a mobile data hotspot instead.

BYOD vs company devices

BYOD (Bring Your Own Device) is common in UK small businesses because company-issued devices cost money. It’s workable with the right rules — but those rules need to be written down and signed.

A practical BYOD policy requires a PIN or biometric lock on any device used for work, device encryption (enabled by default on modern iPhones and most Android devices; requires activating BitLocker on Windows), approval for work apps, separation of work and personal data where possible, and explicit consent to remote wipe rights — the business needs to be able to wipe work data from a lost device, even if it’s personal. Get this in writing before the device is used for work.

If budget allows, company-owned devices for people handling sensitive client data or finances are worth the cost. A decent refurbished business laptop with proper configuration runs £250–400.

Approved app lists and screen privacy

A short approved software list removes ambiguity. Specify which tools are used for file sharing, communication, and collaboration. Anything not on the list requires approval before use with business data.

For communication: your primary platform (Slack, Teams, or Google Chat) plus video conferencing. For file sharing: your designated cloud storage only. For email: company accounts only — never personal Gmail or Outlook for work correspondence.

Screen privacy matters too. Remote workers should be aware of their physical environment. A brief policy point about privacy screens for public locations and being mindful of who can see their screen isn’t paranoia — it’s good practice for anyone handling client data or personally identifiable information.

What to put in your written policy

A remote work security policy doesn’t need to be a 20-page document. One page covering approved devices and operating system requirements, network requirements (WPA2 minimum, VPN usage rules), approved applications and prohibition on shadow IT for sensitive data, BYOD terms if applicable, screen privacy and physical security expectations, and what to do if a device is lost or suspected compromised (report within 2 hours to [contact]) is sufficient for most small businesses.

Have every remote worker sign it annually. This creates accountability and ensures people have actually read the rules — and it demonstrates to your insurer and to the ICO that you have policies in place.

Bottom line

Remote work security comes down to three things: ensuring devices are managed and updated, ensuring network connections are secure, and ensuring people know the rules. A one-page written policy signed by every remote employee, Tailscale or Cloudflare Access for secure connectivity, and basic BYOD requirements covers the vast majority of the risk at minimal cost.