How to Create a Work From Home IT Security Policy

Many organizations were not prepared for the repercussions of the COVID-19 pandemic on the way we work. With office workers accessing company systems from home, it led to potential vulnerabilities in networks. Employees used their own devices and third-party apps to conduct their work, possibly not even realizing the risks at hand. And 44% of IT professionals questioned said their company didn’t provide cybersecurity training to their staff on the threats of remote working, let alone draft a work from home IT security policy.  

As hybrid working goes from strength to strength in the future, it is time for businesses to provide employees with a robust framework to help them keep themselves and the organization safe from harm when working remotely. 

This article explores the benefits of a work from home IT security policy and explains how to create one for your business. 

What is a work from home IT security policy?

A work from home IT security policy is a document that sets out best practices for maintaining the safe use of company devices, software, and networks when employees work remotely. 

The aim is to maintain cybersecurity and to avoid threats and risks, such as malware, data loss, data protection issues, unauthorized access to systems, viruses, and compliance issues, that can result from people accessing their work resources from locations other than the office. 

The policy provides a guide to what employees should and shouldn’t do to maintain security, raising awareness of the potential IT risks of working from home. 

Benefits of having a work from home IT security policy

There are a number of benefits of having a policy to dictate work from home practices, including:

• Raising awareness to employees of the risks that come with carrying out work away from the security of the office environment and using unapproved software and hardware
• Reducing the opportunities for bad actors to access the company network and cause damage or gain access to sensitive information
• Protecting customer and employee personal data from breaches that could cause compliance issues for the organization
• Preventing attacks by malware and other viruses that could cause downtime for the business as well as the loss of important documents.  

What to include in your work from home IT security policy

To create a policy that protects your business and its networks, you should add these elements to your security policy for remote workers. 

Information systems security

Your policy should include guidelines for the safe use of information systems when working away from the office. This includes: 

Element	Guidance to include
Device hardware standards	You should ensure that employees use only devices that meet the minimum standards for security on your systems when accessed remotely.  It could be that you allow only company-issued devices or that you set out a list of acceptable devices that can be secured appropriately by the IT department to allow for safe remote working.
Minimum password standards	With 81% of data breaches caused by weak passwords, it is important that you instill in employees the need to create difficult-to-guess passwords for logging into work systems remotely. Set out minimum standards, such as the need to use special characters and numbers, as well as guidelines on length.
Password management	Besides creating minimum standards for password creation, you should also inform your employees of the best ways to manage their passwords. This could entail adding requirements for workers to change passwords at regular intervals, to use multi-factor authentication (MFA), to only store them in approved password management solutions, and other such actions that help prevent hacking.
BYOD requirements	Bring Your Own Device practices are increasingly popular, so your policy should either prevent employees from using their own devices or offer robust guidelines on how to use them safely.  This might include requiring that they use approved cloud services, implement MFA, install anti-virus software, and other similar measures.
Endpoint and malware protection	To keep the company network secure, users should utilize endpoint and malware protection that detects viruses within attachments and warns them about potential threats.  In the more relaxed atmosphere of home, employees can be less alert for threats, making it important to have safeguards in place.
Shadow IT usage	Shadow IT is hardware and software that is not approved by the IT department but is still used by employees because it is convenient, familiar, offers functionality that approved IT does not contain, or for any other reason. The threat of the vulnerabilities that shadow IT creates means that your policy should prevent its use. It should provide routes for employees to request and receive suitable approved solutions in good time.

Remote access control

When employees access your network remotely, it can create vulnerabilities unless you have security procedures in place. Your policy should indicate the correct route through which to connect to the company servers, allowing for secure access to the documents they need. 

This might involve using a virtual private network (VPN), remote desktop tools, a SaaS app, or another route whereby the IT department can secure the access that employees have. 

You might also control which files, folders, and drives people can access. This helps reduce the risk of a cybercriminal being able to access all of the company’s documents if they manage to breach the remote worker’s security.

Remote work sites

When an employee works from home, it doesn’t always mean that they are literally working at their own home. It is a catch-all term for remote working, which can take place in a range of locations. That’s why you need to make sure your policy helps users stay secure, whether they are in a home office, co-working space, coffee shop, or anywhere else. 

Requesting that workers use a VPN to disguise their IP address is one way to improve the security of working remotely on unsecured networks. Another option is restricting work from certain types of work sites where it is likely there are lax security standards. 

Backup and media storage

When workers in the office back up and store media, they do so in an environment that is secure. They often have to sign devices out and back in to allow IT to track where they have been. However, the same cannot always be said for those who are working remotely. 

If they work in public, there is a risk that they might leave portable storage devices by accident or that they could be stolen, giving access to sensitive information to unauthorized third parties. Even in the home, they are vulnerable to access by members of the employee’s family or their roommates. 

For this reason, you should develop a policy for safe use. Requiring the use of encrypted storage devices is one solution. Providing lockboxes for storing them when not in use is another that you could consider. 

Data breach guidelines

Data breaches can cause huge financial losses for organizations, as well as significant reputational damage. So, it is important for employees to understand how to recognize when a data breach has taken place and what to do in that event. 

If employees can spot the signs of a breach, they can report it swiftly, and IT can sometimes resolve it before the damage becomes too great. This can protect the organization and the security of the data it holds. 

In your work from home IT security policy, outline ways that remote employees can recognize that a breach might have taken place. This includes unexpected software on their device, reports from contacts about unusual emails or messages, user account lockouts, or other actions. Then, provide a route through which they can escalate their concerns. 

Violations and non-compliance

Besides providing guidance on how to act in a secure manner, your policy should also outline what happens if remote workers do not comply with the procedures that you provide. 

This is important for showing how seriously you take work from home IT security. It will help to motivate workers to keep IT security at the front of their minds as they carry out their duties, even if they do so in a more relaxed environment than the office. 

The difference between office IT security and remote access IT security

With office IT security, many of the security protocols are already in place. The devices that workers use and the storage solutions are easily monitored by the IT department in a formal environment. 

Outside of the office, there are additional concerns, such as the use of personal devices and unsecured networks, that make maintaining security a more complex job. This is why remote access security should concentrate on educating employees about best practices for safety. 

Remote work IT policy example

This remote work IT policy example is a template that you can use to create your own policy that comprehensively lays out your requirements for remote workers. It provides an idea of what your finished policy should entail. 

FAQs

What are the security risks of working from home?

Working from home creates security risks in the form of using unsecured networks, devices that are not updated with the latest security updates, and the use of unauthorized apps that could provide vulnerabilities.

How do you ensure data security when working from home?

Using only IT department-approved solutions for storing and sharing data is a good way to keep it secure. Ensuring that all hardware and software is up-to-date and protected is another method of increasing security.

How do you ensure your remote employees have the IT support they need?

IT must ensure that there are enough employees available to support remote workers in an efficient manner. There should be a frictionless workflow from raising a ticket to resolving a case that helps remote workers get the answers they need in good time. 

References and further reading

• Vaultry features
• About Vaultry
• How to create a shadow IT policy
• Checklist to secure your network
• Common shadow IT problems