Remote work security checklist for small teams: when the office is a laptop in a café

Your security perimeter used to be the office network. Now it's a laptop on a home router shared with a smart TV, a phone on cellular, and a spare afternoon in a café with open Wi-Fi. Remote work didn't make small teams less secure — it removed the single place where "we have a firewall" used to count as a plan. This checklist replaces it with habits that travel with the laptop.

1. The home-network pre-flight (once per person, one afternoon)

Do this when someone goes remote and re-run it once a year. It's fifteen settings, not a project:

• Router admin password changed from the factory default, admin interface not reachable from the internet. The default password is printed on the physical router — anyone who has ever visited the house can read it.
• WPA2 or WPA3 with a real password, not the ISP's sticker. If the router is older than the person's laptop, say so in writing — old firmware with known CVEs is the actual entry point.
• Guest network for everything that isn't work. The smart TV, the doorbell camera, the kids' consoles live on the guest SSID. If a camera gets owned, it shouldn't be able to see the laptop's file share.
• Full-disk encryption on (FileVault / BitLocker). This is the one setting that turns "laptop left in a car" from a breach into a hardware loss. Verify it — don't ask.
• Automatic OS and browser updates on, with a reboot cadence. A remote laptop that hasn't rebooted in 60 days is running a different threat model than the office fleet.
• Screen lock at 5 minutes or less, password on wake. The home "office" has housemates, partners, and toddlers.

Write the result down per person — a five-line note in the shared doc. The note is what makes the next audit take ten minutes instead of a week of "I think mine's fine."

2. The separate admin lane

Not every remote session deserves the same trust. The mistake isn't that people work from cafés; it's that the same browser profile opens the invoice dashboard and the news site:

• Admin and money paths get their own browser profile — or better, their own user account. No casual browsing, no extensions beyond the password manager, in the admin profile.
• Hardware security keys for admins where the platform supports them. A yubikey-style key doesn't care what network you're on, which is exactly why it's the remote-work factor.
• Access to production and payment systems goes through VPN or a zero-trust proxy — not "port 22 open to the world because the office had a static IP once." The server hardening checklist covers the server half; the laptop half is this line.
• No shared logins on personal devices. A shared mailbox is delegated access or scoped app passwords, never "just log in as me on your iPad." When someone leaves, shared-device logins are the ones nobody can revoke.

3. The BYOD decision (make it before the personal laptop shows up)

Someone's personal MacBook will touch company data. It happens in month one at every small company, and the only choice is whether it happens with rules:

• Decide what personal devices may touch what. A sane default: email and chat yes with MFA, code repos no, production and payment systems never.
• Inventory them anyway. A one-row table per device — owner, OS version, disk encryption, MFA status — is the difference between a manageable incident and "we have no idea which laptops had access."
• Personal devices get the same hygiene bar as company ones: encryption on, updates on, screen lock, password manager. If a device can't meet it, it doesn't get access — and that's a conversation you have before the data is on it.
• MDM-lite is fine. Full device management on someone's personal phone breeds resentment; a workspace app or managed browser profile gets 90% of the control for 10% of the friction.

4. Coffee-shop rules (the four that matter)

• Treat every network as hostile — including the café's. With MFA everywhere, admin on a separate profile, and no plaintext services, the network being untrusted stops mattering much. That's the design goal.
• Privacy screen when facing the room. Shoulder-surfing is the cheapest attack on the board, and it works best in exactly the places remote work happens.
• No confidential calls within earshot — customer names, invoices, incident details. The headset fixes half of it; the other half is choosing the table.
• The laptop never leaves sight. Not "for one minute, getting a refill." The lost-laptop runbook exists for the day this rule is broken; the rule exists so the day is rare.

5. The mistakes that turn remote work into an incident

• "VPN optional." Optional security settings are read as "nobody checks," and the people who most need them are the ones most likely to skip them. Pick the systems where VPN or zero-trust is mandatory, and make it mandatory.
• MFA on office accounts but not remote paths. Email that's reachable from anywhere is reachable from anywhere. The MFA rollout should treat remote access as the main case, not the exception.
• Phishing surface grows quietly. Remote teams live in chat and email; a rushed Friday click happens at the kitchen table, not behind the office firewall. Keep the phishing first-hour checklist where people actually work — the chat pin, not the wiki.
• Nobody knows the lost-device drill. Every remote worker should know, without looking it up: who to tell, in what order, and that the laptop gets wiped remotely before it gets searched for. Rehearse it like the restore drill — once a quarter, twenty minutes.

Takeaways

• Per-person pre-flight, written down: router password changed, guest SSID, disk encryption verified, updates and screen lock on. Fifteen settings per person, once.
• Admin and money paths get a separate lane — own profile, hardware keys, no casual browsing — so the café news site and the invoice dashboard never share a browser.
• Make the BYOD decision on purpose, inventory the devices, and hold them to the same hygiene bar. The personal laptop arrives in month one either way.

---

The Ops Starter Kit ($14) includes the access-inventory and onboarding sheets that make the pre-flight list a five-minute per-person pass, and Automation Starter Pack ($19) turns the annual re-run — encryption status, firmware age, update cadence — into a recurring workflow instead of a promise. Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout.