Remote Work Security Checklist for Australian Businesses - MSP Guide Australia

The New Normal

Remote and hybrid work is here to stay. But with it comes new security risks. This checklist covers everything Australian businesses need to secure remote work. For a broader security framework, see our Essential 8 Implementation Checklist which covers the ASD's baseline controls in detail.

The Checklist

Device Security

• [ ] Company devices only (no personal devices for work)
• [ ] Full disk encryption enabled
• [ ] Auto-lock after 5 minutes
• [ ] Remote wipe capability
• [ ] Regular patching schedule
• [ ] Antivirus/EDR installed and updated

Network Security

• [ ] VPN for all work access
• [ ] Split tunnelling disabled
• [ ] DNS filtering enabled
• [ ] Guest Wi-Fi separate from work
• [ ] Home router password changed from default
• [ ] WPA3 encryption on home Wi-Fi

Identity & Access

• [ ] MFA on all accounts (see Essential 8 Control 7 for MFA maturity levels)
• [ ] Password manager required
• [ ] No password reuse
• [ ] Conditional access policies
• [ ] Device compliance checks
• [ ] Regular access reviews

Data Protection

• [ ] Data classification labels
• [ ] DLP policies configured
• [ ] No local data storage (use cloud)
• [ ] Encryption for sensitive files
• [ ] Regular backups
• [ ] Secure file sharing

Communication Security

• [ ] Approved collaboration tools only
• [ ] No personal email for work
• [ ] Encrypted messaging for sensitive topics
• [ ] Regular security awareness training
• [ ] Phishing simulations
• [ ] Incident reporting process

Compliance

• [ ] Privacy Act compliance
• [ ] Industry-specific regulations
• [ ] Data sovereignty requirements
• [ ] Audit trail logging
• [ ] Regular compliance reviews
• [ ] Incident response plan

Common Remote Work Threats

1. Phishing emails — Targeting remote workers
2. Public Wi-Fi risks — Unsecured networks
3. Physical device theft — Laptops left unattended
4. Shadow IT — Unauthorized tools and services
5. Weak passwords — Reused across personal and work accounts

Implementation Priority

Immediate (This Week): - Enable MFA - Set up VPN - Configure auto-lock

Short-term (This Month): - Deploy DLP policies - Implement conditional access - Security awareness training

Medium-term (This Quarter): - Zero trust architecture - Advanced threat protection - Regular security audits

The Bottom Line

Remote work security isn't optional — it's essential. Start with MFA and VPN, then build from there. The cost of a breach far exceeds the cost of prevention. For a deeper look at M365-specific security gaps, see M365 Governance: 10 Mistakes That Are Costing You.

Related Guides

• Cyber Security