Work from home policy: Benefits, risks and how to secure it

In March 2026, 22.6% of U.S. workers teleworked or worked at home for pay, according to the Bureau of Labor Statistics. Remote work started as an emergency in 2020 and became how a lot of offices simply run, yet many never wrote a work from home policy. The bookkeeper works from home on Fridays, the practice manager answers email from the couch at night, and the owner approves payroll from a hotel.

A home office has a consumer router, a family computer down the hall and kids who know the Wi-Fi password. If your remote setup is still the one you put together in a hurry in 2020, it is time for a fresh look. We write work from home policies for our clients.

Why remote and hybrid work stays

Employees value the flexibility and the time they get back from commuting. Employers can hire outside a 30-minute drive, keep good people who move away, and sometimes get by with less office space. In Louisiana there is one more reason: work continues when a storm closes roads or the office loses power. Before a named storm, confirming that remote work and cloud failover are ready is part of the checklist we run with our clients.

None of those benefits require giving up control of your data. They do require deciding, in writing, how remote work is supposed to work.

Work from home policy template: what to include

Keep it short and specific, have each remote employee sign it, and review it at least once a year. A workable outline:

1. Eligibility: which roles qualify, and whether the arrangement is full-time remote, hybrid or occasional.
2. Equipment: who provides the laptop, monitor, headset and phone, and who pays for internet. Company-issued laptops are strongly preferred. If you allow personal devices, your BYOD policy applies.
3. Workspace: a private space for calls and for screens showing client data, and no client files in a coffee shop without a privacy screen and a secure connection.
4. Security rules: MFA, approved apps only, no saving files to personal cloud storage or USB drives, no printing sensitive documents at home unless approved, and company devices for the employee only.
5. Availability: core hours, expected response times, and which tools to use for chat, calls and meetings.
6. Reporting: who to call about a lost laptop, a suspicious email or a strange pop-up.
7. Leaving: how and when equipment comes back.

The security risks at home

In the office, your firewall, filtering and IT support sit between your people and the internet. At home most of that disappears. Family PCs carry games, browser extensions and missed updates. Old routers run default passwords and outdated firmware on the same network as smart TVs and kids’ devices. Remote staff can’t lean over and ask whether an email looks right, so they click more and report less. Files land on desktops, personal Dropbox accounts and USB drives where nobody backs them up. And calls with patients or clients can be overheard by family members or smart speakers.

Remote work security in five steps

1. Give remote staff company-managed laptops

This is the biggest single improvement. A company laptop enrolled in Microsoft Intune can be set up remotely, kept encrypted, patched on schedule and wiped if it is lost. Add endpoint detection and response watched by a 24/7 security operations center, which every one of our clients has, so a compromised laptop can be isolated wherever it is.

2. Verify every connection

Traditional VPNs give a remote laptop broad access to the office network once connected. Zero Trust access and secure access service edge (SASE) tools check the user, the device and its security status every time, and open only the specific apps each person needs. Pair that with MFA and Conditional Access in Microsoft 365, so a stolen password alone can’t get anyone in.

3. Keep files in the cloud

Store work in OneDrive, SharePoint and Teams with the right permissions. Files stay backed up, shareable without email attachments, and yours when an employee leaves. Back up Microsoft 365 separately as well.

4. Help staff lock down the home network

The NSA’s guidance for teleworkers is a plain checklist: replace aging routers and keep firmware updated, use WPA3 encryption, put work devices on a separate network from smart home gadgets, reboot routers regularly, and turn off remote administration. A one-page how-to sheet for staff goes a long way.

5. Train for the home environment

Remote staff need security awareness training and phishing simulations at least as much as office staff. Our clients run continuous simulations, and a click brings a short lesson right away. Make reporting easy and blame-free, and use real examples like fake Microsoft login pages, invoice scams and fake help desk calls.

Remote work and compliance

• Healthcare. The HIPAA Security Rule’s workstation and device controls apply to any device that can reach electronic protected health information, wherever it sits, including screen privacy, who else can use the device, and how paper records are stored and shredded at home.
• Accounting, tax and financial firms. The FTC Safeguards Rule requires encryption of customer information, MFA for anyone accessing it, and an inventory of the devices that hold it. Remote laptops are part of that inventory.
• Law firms. Confidentiality applies to video and phone calls taken at home. Headsets, private rooms and switching off smart speakers during client calls are reasonable steps.

Our compliance services can document how remote work fits into your program, which is often among the first things an auditor or cyber insurer asks about.

Check remote PCs for Windows 10

Windows 10 reached end of support on October 14, 2025. Since then, a Windows 10 PC only gets security fixes if it is enrolled in Microsoft’s paid Extended Security Updates (ESU) program. Business-owned PCs need commercial ESU, which is bought one year at a time, and the first year ended October 13, 2026. Microsoft’s consumer ESU program for home PCs runs until October 12, 2027, but Microsoft says it can’t be used in commercial scenarios.

Most of our clients have moved to Windows 11. We want every computer we support on it, and we’re working with the rest to upgrade or replace what’s left. If remote staff use personal or older company PCs, check what they are running, because a home computer that no longer gets security updates shouldn’t be opening client files. Our post on life after Windows 10 covers the options, and a device refresh plan keeps PCs on a three- to four-year cycle.

A review of a remote setup that dates back to 2020 shows quickly what needs to change. Book a 15-minute call and we’ll go through yours with you; it’s part of our managed IT services.

Related reading: IT onboarding checklist: How to set up new hires quickly and securely, Complete guide to strong passwords and multi-factor authentication and How business password managers work (and can they be hacked?).

Frequently asked questions

What is a work from home policy?

A work from home policy is a short written agreement that says who can work remotely, on what equipment, under which security rules, and how equipment comes back when someone leaves. Each remote employee signs it, and you review it at least once a year.

How do you write a work from home policy?

Cover eligibility, equipment, workspace, security rules, availability, reporting and what happens when someone leaves. Keep each section specific: company-issued laptops, MFA on every account, and no work files in personal cloud storage or on USB drives. We write these policies for our clients and map them to HIPAA or the FTC Safeguards Rule where those apply.