Remote and hybrid working have transformed how businesses operate. Employees can work from home, on the road or from client sites while staying connected and productive. But every laptop, smartphone, tablet and home Wi-Fi network also creates another potential entry point for cyber criminals.

Many SMEs assume cyber attacks only target large organisations, but attackers often look for the easiest route in. A single unsecured device, weak password, missed update or poorly managed account can be enough to cause disruption, data loss and costly downtime.

The good news is that improving remote working security does not require a huge budget or complex technology. Often, it is the fundamentals that make the biggest difference. Use this checklist to assess your organisation’s readiness and identify any gaps before cyber criminals do.

Passwords alone are no longer enough, especially when employees are accessing business systems from multiple locations and devices. Cyber criminals regularly use phishing, credential theft and leaked password databases to attempt sign-ins to email, cloud storage, finance platforms and Microsoft 365 accounts.

For SMEs, MFA is one of the most effective and practical security controls because it reduces the risk of an attacker gaining access with only a stolen password. It adds an extra identity check, such as an authentication app prompt, security key or trusted sign-in method.

Remote workers should be protected wherever they log in from. That means MFA should not only apply to email, but also to admin accounts, VPNs, remote access tools, business applications and any system that stores sensitive data.

Actions to Review:

• MFA is enabled on Microsoft 365 accounts
• MFA protects email access
• MFA is used for VPNs and remote desktop services
• Admin accounts have stronger authentication controls
• Legacy authentication is disabled where possible
• Employees understand how to use MFA safely and report suspicious prompts

Every laptop, tablet and mobile phone used for work should meet a consistent security standard. Remote working can quickly create gaps if employees are using personal devices, unpatched laptops or machines without endpoint protection.

Managed devices make it easier to apply updates, enforce encryption, monitor threats and remove access if a device is lost or stolen. This gives the business better visibility and reduces reliance on employees remembering to manually install updates or change settings.

For SMEs, device management does not need to be complicated. The aim is to make sure business data stays protected whether someone is working from home, at a client site, in a coffee shop or while travelling.

Actions to Review:

• All devices are encrypted
• Devices automatically receive security updates
• Business-grade endpoint protection is installed
• Lost or stolen devices can be remotely wiped
• Unauthorised software installations are restricted
• Employees use approved business devices where possible
• Personal devices are reviewed before being used for work

The office network is usually protected by business-grade security controls, but home networks are often overlooked. A poorly configured router, weak Wi-Fi password or outdated firmware can increase risk when employees are regularly accessing company systems from home.

Employees do not need to become networking experts, but they should understand the basics. Simple actions such as changing default router passwords, using WPA2 or WPA3 security and keeping router software up to date can make a meaningful difference.

Home working security should also include practical guidance. For example, staff should avoid sharing work devices with family members, use trusted networks where possible, and speak to IT before connecting to unknown or public Wi-Fi.

Actions to Review:

• Router admin passwords have been changed
• Wi-Fi uses WPA2 or WPA3 security
• Router firmware is regularly updated
• Guest networks are used where appropriate
• Default router settings have been reviewed
• Employees understand safe home network practices
• Staff know when to ask IT before using unfamiliar networks

Remote and hybrid workers are frequent targets for phishing because they may be making quick decisions away from colleagues and without immediate support nearby. Attackers know this and often create urgent messages designed to push employees into clicking links, opening attachments or approving unexpected sign-in prompts.

Phishing is no longer limited to obvious emails with spelling mistakes. Modern attacks can arrive through email, Teams messages, text messages, QR codes, social media and fake file-sharing notifications. Some are highly convincing and appear to come from trusted suppliers, colleagues or senior leaders.

Security awareness should be practical, regular and easy to apply. Employees need to know what suspicious activity looks like, how to report it, and how to verify unusual requests before taking action.

Actions to Review:

• Staff receive regular security awareness training
• Employees know how to report suspicious emails
• Phishing simulations are carried out periodically
• Staff understand the risks of QR-code phishing
• Employees verify unusual requests for payments or data
• New starters receive security awareness guidance
• Reporting suspicious activity is encouraged and made simple

Cyber attacks, accidental deletions, hardware failures and ransomware can all result in data loss. Many businesses believe they have backups in place, but only discover weaknesses when they need to restore something urgently.

A reliable backup strategy should cover critical files, cloud data, Microsoft 365 environments and key business systems. It should also include clear restore processes, secure storage and access controls so backup data cannot easily be altered or deleted by an attacker.

Testing is just as important as backing up. If backups are not regularly restored and checked, the business cannot be confident that data will be available when it matters most.

Actions to Review:

• Critical business data is backed up regularly
• Microsoft 365 data is independently protected
• Backup data is stored securely
• Restoration tests are performed regularly
• Backup access is restricted
• Recovery procedures are documented
• Backup responsibilities are clearly assigned

Access permissions often build up slowly over time. Employees move roles, projects finish, suppliers change and temporary access is forgotten. Without regular reviews, people may retain access to systems or data they no longer need.

For remote teams, access control is especially important because users are logging in from different locations and devices. The principle of least privilege helps reduce risk by giving people only the access they need to do their job.

Regular access reviews also support compliance and good governance. They help identify unused accounts, excessive admin rights, shared logins and third-party access that should be removed or tightened.

Actions to Review:

• Users only have access they genuinely need
• Former employees are fully offboarded
• Admin privileges are reviewed regularly
• Shared accounts are eliminated where possible
• Access reviews take place at least quarterly
• Third-party access is monitored
• Inactive accounts are disabled or removed

Even with strong security controls in place, incidents can still happen. An employee may click a suspicious link, lose a device, notice unexpected account activity or receive a convincing request that does not feel right.

The speed of response can make a major difference. If staff know exactly who to contact and what information to provide, the business can act quickly to isolate devices, reset credentials, investigate activity and reduce potential damage.

Incident response should be simple enough for every employee to follow. It should include clear reporting routes, emergency contacts, escalation steps and guidance on what not to do, such as deleting suspicious messages before they can be checked.

Actions to Review:

• Staff know how to report a cyber incident
• Emergency contact details are readily available
• Suspicious activity is escalated immediately
• Devices can be isolated when required
• Incident response procedures are documented
• Key decision-makers understand their roles
• Employees know not to ignore or hide potential mistakes

Before you finish, ask yourself:

• Is MFA enabled across every critical system?
• Are all remote devices managed and protected?
• Have employees secured their home Wi-Fi networks?
• Does your team know how to identify phishing attacks?
• Can you recover quickly if data is lost?
• Are access permissions regularly reviewed?
• Does everyone know what to do during a cyber incident?

If you answered “No” or “Not Sure” to any of these questions, it may be time to review how secure your remote and hybrid working setup really is.

At Stiperstone, we help SMEs strengthen remote working security through managed IT support, Microsoft 365 security, cyber security services, backup and recovery, endpoint protection and proactive monitoring.

We can review your current setup, highlight practical risks and recommend clear next steps to help protect your people, devices and business data.

Find out where your biggest gaps are and what practical steps you can take to reduce risk. Speak to Stiperstone today to book your free review.