remote work security checklist

CISA Aligned 30/90 Day Remote Work Security Checklist for SMB Leaders

Remote worker verifying secure device access

Enforce phishing-resistant MFA, automate patching, encrypt and test your backups, and harden every remote device before you touch anything else. Those four moves close most of the gaps that lead to a ransomware event or a data breach. The rest of this remote work security checklist builds out the policies, monitoring, and training that keep those controls working over time.

TL;DR:

Enforcing MFA on email, VPN, and admin accounts is critical since credential theft is the fastest entry point for attackers.

Patching internet-facing systems and testing backup restores should be done immediately, with inventory and device hardening completed within 30 days.

Centralized endpoint detection and response, along with regular vulnerability scans and patch management, are essential for maintaining ongoing security.

Using offline, immutable, and encrypted backups that are regularly tested ensures data recovery capability in case of ransomware.

Implementing phishing-resistant MFA methods like security keys and managing remote device security via enrollment, encryption, and secure access controls greatly reduces breach risks.

Building Your Remote Work Security Checklist: A 30/90-Day Plan
What Should a Remote Work Security Policy Cover?
How Do You Harden and Provision Remote Devices?
Are VPNs Enough to Secure Remote Access?
Which MFA Method Should You Actually Require?
How Should You Manage Endpoints and Patches?
What Backup Strategy Actually Survives Ransomware?
How Do You Lock Down Cloud Tools and File Sharing?
How Often Should Remote Teams Get Security Training?
What Belongs in an Incident Response Plan for Remote Teams?
How Great Plains Networking Applies This Checklist in the Field
What Small Businesses Consistently Get Wrong
Get Help Implementing Your Remote Work Security Checklist
Sources
FAQ

Building Your Remote Work Security Checklist: A 30/90-Day Plan

A remote work security checklist only works if someone owns each line item and a date forces the work to happen. Below is a prioritized sequence built around risk, not alphabetical order. Items marked "now" should be done promptly; other items are staged by feasibility with current resources or requiring additional coordination.

Enable MFA on email, VPN, and admin accounts (now). Why: credential theft is the fastest path into a network. Verify: run an MFA coverage report; owner: IT lead.
Patch internet-facing systems and anything on CISA's Known Exploited Vulnerabilities list (now). Verify: vulnerability scan showing zero critical CVEs open past 15 days; owner: IT/managed provider.
Test one full backup restore (now). Verify: documented restore time; owner: backup admin.
Inventory every remote device and its patch/encryption status (30 days). Verify: asset list with disk encryption confirmed; owner: IT.
Remove local admin rights from standard user accounts (30 days). Verify: spot-check five machines; owner: IT.
Close unused RDP/SMB ports and enforce VPN MFA (30 days). Verify: external port scan; owner: network admin.
Draft or update the telework/BYOD policy (30 days). Verify: signed acknowledgment from staff; owner: security program manager.
Deploy centralized EDR across all endpoints (90 days). Verify: dashboard shows 100% agent coverage; owner: IT.
Run a phishing simulation and track click/report rates (90 days). Verify: quarterly report; owner: HR/IT.
Build and test an incident response plan with a tabletop drill (90 days). Verify: after-action notes; owner: leadership.

When resources are tight, triage by blast radius: fix anything that touches money movement, patient or client data, or domain admin credentials before anything else.

What Should a Remote Work Security Policy Cover?

Technical fixes decay without a policy that makes them permanent. A telework or BYOD policy should spell out three things clearly: which devices qualify for network access, what data classes each access tier can touch, and what happens when an employee leaves or a device is lost. NIST's guidance on enterprise telework recommends tiered access for BYOD versus organization-issued hardware, plus device posture checks before granting connections, because a personal laptop with unknown patch status is a different risk than a managed company laptop.

Illustration of remote access policy tiers

Governance needs an owner, not a committee. CISA's small business guidance recommends naming a security program manager who reports MFA adoption, patch compliance, and backup restore success on a fixed schedule, monthly for most small organizations, weekly during active remediation.

A telework policy should address:

Which device types are approved (managed only, or BYOD with conditions)
What network segments or applications each access tier can reach
Data handling rules for sensitive records on personal devices
Offboarding steps, including access revocation timing
Reporting requirements when a device is lost, stolen, or compromised

Track open gaps with a plan of action and milestones worksheet, essentially a running list of what's broken, who owns the fix, and the target date. It doesn't need software. A shared spreadsheet with four columns (gap, owner, fix date, verification method) beats a polished slide deck nobody updates.

Pro Tip: Review your gap worksheet in the same meeting where you review revenue or client metrics. Security stays a priority only when leadership treats it like one.

How Do You Harden and Provision Remote Devices?

Start with the device, not the user. Every laptop, phone, or tablet touching company data should be enrolled in mobile device management before it leaves the office, whether it's company-owned or a BYOD unit approved under your policy. Organization-issued hardware is the safer default. When BYOD is unavoidable, tie it to conditional access rules that check device health before granting entry, a control NIST SP 800-46 treats this as a baseline for telework environments.

A practical hardening sequence:

Remove local admin rights from the standard user account so malware can't install itself silently.
Enable full-disk encryption (BitLocker or FileVault) so a stolen device is unreadable without credentials.
Lock down BIOS/UEFI settings with a password to block boot-order tampering.
Disable SMBv1 and RDP unless the role explicitly requires them, and put both behind VPN and MFA when they are.
Apply a standard security baseline image so every new device starts from the same configuration, not whatever the last technician happened to install.
Maintain an asset inventory that tracks serial number, assigned user, patch status, and encryption state.
Document shipping and return procedures, including a remote wipe step before any device is reissued or retired.

Devices leaving the fleet without a wipe risk exposing client data. Include wiping in the offboarding checklist as a mandatory step.

Are VPNs Enough to Secure Remote Access?

A VPN without MFA is a lock with the key taped to the door. CISA's StopRansomware guidance recommends enforcing MFA on every VPN connection, limiting exposed RDP services, and closing unused SMB and RDP ports outright, since attackers scan for exactly those openings.

Home network hygiene matters more than most leaders assume, since a compromised router can undermine every other control on the device connected to it. Employees should change the router's default admin password, run WPA2 or WPA3 encryption, and put smart-home devices and guests on a separate SSID from work traffic.

Require MFA on all VPN and remote desktop connections, no exceptions for convenience.
Log and alert on repeated failed login attempts against remote access points.
Restrict RDP to a jump host or bastion rather than exposing it directly to the internet.
Change default router admin credentials and disable remote router administration.
Block inbound traffic on commonly abused ports (3389, 445) at the firewall unless explicitly needed.

Longer term, plan a phased move toward zero trust network access or a secure service edge model, which reduces reliance on flat VPN access entirely. CISA's joint guidance on modern secure access recommends piloting ZTNA with one department first and keeping centralized logging active throughout the transition, so you're not flying blind while old and new systems run in parallel.

Pro Tip: If you can't fully retire RDP right away, at minimum move it behind a VPN with MFA and restrict source IPs to a known range. That single change blocks most opportunistic scanning.

Securing the connection is only half the job. For a deeper walkthrough of closing exposed RDP, our guide on RDP security best practices breaks the fix into a 24/72/30-day sequence.

Which MFA Method Should You Actually Require?

Not all MFA is equal, and treating a text-message code the same as a hardware security key is a mistake that shows up in breach reports every year. CISA's Cross-Sector Cybersecurity Performance Goals rank phishing-resistant MFA, meaning FIDO/WebAuthn security keys or passkeys, as the strongest option available. App-based soft tokens with number matching come next. SMS or voice codes are the fallback, used only when nothing stronger is supported.

Statistic Callout: CISA's own performance goals place phishing-resistant methods (FIDO/WebAuthn/PKI) at the top of its MFA strength ranking, with mobile app push and number-matching tokens as the next-best tier, and SMS/voice reserved as a last resort.

Prioritize the rollout by risk, not convenience:

Deploy phishing-resistant MFA first on email, admin accounts, and financial systems.
Use app-based soft tokens with number matching everywhere hardware keys aren't yet supported.
Block legacy authentication protocols that bypass MFA entirely.
Require separate, dedicated admin accounts, never a daily-use account with elevated rights.
Log all privileged account activity and review it monthly, not just after an incident.

Audit privileged accounts quarterly at minimum. It's common to find former contractors or vendors still holding admin rights months after a project ended, simply because nobody remembered to revoke them.

How Should You Manage Endpoints and Patches?

Endpoint detection and response tools that report to a central console beat standalone antivirus because they give your IT team visibility across every remote device at once, not just alerts from the one machine that got infected. Configure automatic updates with a defined maintenance window so patches don't sit unapplied because nobody wanted to interrupt someone's workday.

Deploy centralized EDR with telemetry feeding a single dashboard, not device-by-device antivirus with no shared visibility.
Set automatic patching schedules with a weekly maintenance window for critical updates.
Cross-reference open vulnerabilities against CISA's Known Exploited Vulnerabilities catalog and patch those first.
Run quarterly vulnerability scans to catch configuration drift before an attacker does.
Restrict which remote management tools are authorized on the network; unapproved RMM software is a common lateral-movement path.

StopRansomware guidance specifically calls out patch prioritization tied to known exploited vulnerabilities, rather than patching everything on the same generic 30-day cycle regardless of severity.

What Backup Strategy Actually Survives Ransomware?

Backups only count if they're separate from the systems they protect and if someone has actually tried restoring from them. A backup sitting on the same network as the servers it's meant to recover is one lateral movement away from being encrypted alongside everything else.

Keep backup storage physically or logically separate from production systems, ideally offline or air-gapped for critical data.
Use immutable backup storage where possible, so a compromised admin account can't delete or overwrite recovery points.
Encrypt backups at rest and in transit, matching the same standard you'd apply to live data.
Test restores on a fixed schedule, partial restores monthly, full restores at least quarterly for critical systems.
Document RTO and RPO for each system class so recovery expectations are set before an incident, not during one.
Keep third-party recovery contacts and an escalation path in the backup documentation itself, not buried in an email thread somewhere.

Statistic Callout: CISA recommends testing backup restores at least annually, and more frequently for critical systems, noting that many ransomware victims discovered their backups weren't actually recoverable when they needed them most.

An untested backup is a hypothesis, not a safety net. The only way to know it works is to restore from it before you're forced to.

How Do You Lock Down Cloud Tools and File Sharing?

Single sign-on should be mandatory for every SaaS application your remote team touches, not optional for the tools that seem "low risk." Once SSO is in place, data loss prevention rules and external-sharing restrictions become far easier to enforce consistently across the whole stack instead of tool by tool.

Require SSO for all approved SaaS applications and disable direct username/password logins where possible.
Apply DLP rules to flag or block sensitive files (client records, financial data) from leaving approved sharing channels.
Set meeting platforms to generate unique meeting IDs, enable waiting rooms, and restrict co-host and recording permissions by default.
Monitor cloud configuration continuously to catch accidental public exposure of storage buckets or shared drives.
Use infrastructure-as-code scanning before deploying cloud changes to catch misconfigurations before they go live.

Certificate and uptime monitoring tools like Otterwatch can flag SSL expiration or downtime on customer-facing systems before it becomes a security incident or a client-facing outage.

How Often Should Remote Teams Get Security Training?

New hires need security training in week one, not whenever the next scheduled session happens to land. Everyone else needs an annual refresher, plus targeted modules for finance staff (wire fraud, invoice scams) and IT staff (privileged access hygiene).

Run onboarding security training for every new hire within their first week.
Schedule annual refreshers for the whole team, with role-based add-ons for finance, HR, and IT.
Run quarterly phishing simulations with a clear one-click reporting path for suspicious emails.
Track click rates, report rates, and time-to-remediation as trend lines, not one-off scores.
Tie MFA coverage, patch compliance percentage, and backup restore success to quarterly business reviews.

CISA's guidance for small businesses frames phishing training as a measurable business process, not a compliance checkbox, because role-based simulations and consistent reporting channels demonstrably cut successful social-engineering attempts over time. A structured 90-day plan works better than a single annual seminar; our phishing awareness training guide walks through exactly that cadence.

Pro Tip: Reward employees who report phishing attempts, even false positives. A team that reports too much is far easier to manage than one that's stopped reporting at all.

What Belongs in an Incident Response Plan for Remote Teams?

A remote workforce means your incident response plan needs a communications tree that works when nobody's in the same building. It should name who investigates, who talks to clients, and who calls legal counsel or law enforcement, all before an incident happens.

Assign clear roles: who investigates, who communicates externally, who handles legal and insurance contacts.
Run a tabletop exercise at least twice a year, simulating a realistic scenario like a phished credential or a ransomware note.
Test a live restore during at least one drill so recovery isn't purely theoretical.
Maintain a current vendor-access and revocation list, updated whenever a contractor's engagement ends.
Treat near-misses as free lessons, updating the plan after every drill and every real close call.

CISA recommends reviewing the incident response plan on a regular schedule, not just after something goes wrong. Plans that sit untouched for two years are usually missing half the systems they're supposed to cover.

How Great Plains Networking Applies This Checklist in the Field

Nicholas and the Great Plains Networking team build this exact sequence into every remote-work engagement across Norman, Moore, and Oklahoma City. A typical 30/90-day remediation starts with MFA rollout and a backup restore test in week one, then moves to device hardening and patch automation by day 30. For a broader view of how these priorities fit into a full-year IT plan, see our IT services checklist for 2026. A free network assessment or a 10-minute readiness audit is the fastest way to see where your own gaps sit.

What Small Businesses Consistently Get Wrong

The same three gaps show up almost every time: MFA rolled out on email but skipped on VPN and admin accounts, backups that have never been restore-tested, and standing local admin rights nobody remembers granting. Start with those three. Fix them in a month, and most of the real risk is already gone.

— Nicholas

Get Help Implementing Your Remote Work Security Checklist

This service offers a plain-language alternative to hiring a full internal security team, designed to help small businesses implement this checklist effectively. Our Managed IT Support covers 24/7 monitoring and patch automation, our Cybersecurity service handles MFA rollout and vulnerability remediation, and Backup & Recovery builds the immutable, tested backup architecture this checklist requires.

The service works with same-day response and without long-term contracts, providing flexible IT support to address critical gaps. If your team runs on Microsoft 365, our Microsoft 365 Support closes the identity and sharing gaps covered above. The next step is simple: request a free network assessment and we'll show you, in plain terms, exactly where your remote setup stands against this checklist.

Sources

FAQ

Which MFA method should remote teams use first?

Phishing-resistant options like FIDO security keys or passkeys are the strongest choice, according to CISA's performance goals. App-based soft tokens with number matching are the next-best option where hardware keys aren't yet supported.

Is BYOD safe for remote work, or should companies issue devices?

Organization-issued, managed devices are the safer default. If BYOD is necessary, NIST recommends tiered access rules and device posture checks before granting network access, rather than treating personal and company devices the same.

How often should we test backup restores?

Test restores on a regular schedule, at least annually and more often for critical systems, since CISA notes many ransomware victims discovered their backups weren't recoverable only after an attack.

Who should own remote work security inside a small business?

CISA recommends naming a specific security program manager who reports on MFA coverage, patch compliance, and backup success on a fixed schedule. For businesses without internal IT staff, a managed provider like Great Plains Networking can fill that role directly.

What does Great Plains Networking charge for a security assessment?

The Free Network Assessment and the 10-minute readiness audit are both offered at no cost. Pricing for ongoing managed services is available on request through the Great Plains Networking site.

Want help putting this into practice?

We'll audit your security, speed, and hardware in under an hour — no commitment, no sales pitch. Just a clear roadmap of what to fix and why.

Schedule Your Free Assessment

CISA Aligned 30/90 Day Remote Work Security Checklist for SMB Leaders