Remote and hybrid work security policy

The Canadian Centre for Cyber Security's "Cyber security tips for remote work" (ITSAP.10.116) recommends working only from corporate devices where possible. That is the single most useful rule. A company laptop is encrypted, patched, protected by security software and managed; a family computer is not.

• Company data is accessed from company-managed computers. Personal phones may be used only through managed apps, as set out in the BYOD policy.
• Remote access to internal systems goes through the approved method (VPN, zero-trust access or cloud apps) with multi-factor authentication.
• Work devices are not shared with family members or used for personal accounts that install software.
• Devices lock automatically after a short idle period and are locked whenever left unattended.

• Home Wi-Fi uses WPA2 or, preferably, WPA3 encryption with a strong passphrase; the router's default admin password is changed and its firmware kept current.
• Where possible, put work devices on a different network from smart TVs, cameras and gaming consoles (many home routers offer a guest network for this).
• On public Wi-Fi (cafés, hotels, airports), use the company VPN or a phone hotspot. Never use public computers for work.
• Turn off automatic connection to open networks and Bluetooth when not in use.

• Work in a space where screens and calls are not overheard or overlooked; use a privacy screen in public places.
• Avoid printing at home. Where printing is needed, documents are kept secure and shredded with a cross-cut shredder, not put in household recycling.
• Paper files with client or employee information are not left in cars or taken on holiday.
• Laptops travel in carry-on bags and are never left visible in a vehicle.

• Use the company's approved meeting platform; meetings with confidential content require a lobby or authenticated attendees.
• Check what is visible behind you and on shared screens before presenting; close email and chat notifications.
• Don't use smart speakers or voice assistants in the room for confidential calls.
• AI note-takers and recording tools may be used only if approved, and participants are told when a call is recorded or transcribed.

The Cyber Centre's guidance for business travellers (ITSAP.00.087) advises taking only the devices you need, removing unnecessary data, updating software, enabling MFA, and assuming there is no privacy in hotels and public places when travelling, especially to higher-risk destinations.

Border officers in Canada and other countries may examine electronic devices. For lawyers and others holding privileged or highly confidential material, plan ahead: travel with a device that holds only what is needed and access the rest from the cloud once there. Get advice from counsel or your professional body on how to respond to a device examination.

• Tell IT before international travel so sign-in alerts from abroad are expected, not blocked.
• Consider a loaner device for high-risk destinations.
• Report any device taken out of your sight by officials or hotel staff.

Remote staff must know exactly who to call and must feel safe calling. The policy should say: report a lost or stolen device, a suspicious email you clicked, an unexpected MFA prompt, or a misdirected email immediately, day or night, to a named contact. No one is disciplined for reporting quickly; delays are what cause harm.

Review the policy each year, and have counsel review provisions that touch employee monitoring or home privacy. In Ontario, employers with 25 or more employees also need a written electronic monitoring policy, which should be consistent with this one.