Why laptops are the weakest link
Laptops travel. They are left in cars, dropped at airports, spilled on in cafes and stolen from homes. They also spend long stretches away from the office network, so any backup that depends on being connected to an office server simply stops running. A staff member who works from home three days a week may go a fortnight without their laptop ever seeing the old backup drive.
People also save things in odd places. The Downloads folder holds signed contracts, the Desktop is covered in drafts, and an email attachment edited in place may live in a temporary folder. When a laptop dies, those are exactly the files the person needs and cannot find anywhere else. Asking staff to change their habits rarely works for long, so the protection has to cover the places people actually save, not the places they are supposed to.
Option one: move the work into the cloud
For businesses on Microsoft 365, OneDrive's known folder move redirects Desktop, Documents and Pictures into OneDrive automatically. Staff keep working exactly as before, but every file they save in those places is stored in the cloud and synced. Google Workspace offers a similar approach with Drive for desktop. Applied through device management, the setting can be enforced on every company laptop so nobody has to remember to turn it on.
Remember that this is sync, not backup. It protects against a lost or broken laptop, but not against deletion or ransomware that syncs across. So the cloud data itself must be covered by a separate Microsoft 365 or Workspace backup, which then protects the laptop files as a bonus. Check after setup that the redirection really applied on every machine, because a laptop that was offline during rollout can be missed.
Option two: an endpoint backup agent
Some roles cannot keep everything in OneDrive. Designers working with large files, engineers using local project databases, or staff with software that stores data in its own folders may need a dedicated backup agent. These small programs run in the background and back up chosen folders, or the whole drive, to a cloud service whenever the laptop has an internet connection, wherever it happens to be.
Choose an agent that is managed centrally, so whoever looks after your IT can see every laptop's last successful backup on one screen and receive alerts when a device has not checked in for several days. Without that view, a laptop that quietly stopped backing up months ago looks no different from one that ran last night.
Handling home internet and data caps
The first full backup of a laptop can be large. Over a slow rural connection or a mobile hotspot it may take days and use a lot of data. Good agents throttle themselves, pause on metered connections and resume where they left off. Seed the first backup while the laptop is in the office on fast fibre, or let it run overnight at home with the charger plugged in.
After that, only changes are uploaded, which is usually modest. If a staff member regularly works from a hotspot, check the agent's settings so it does not burn through their mobile data, and make sure it catches up once they are back on broadband. The management console should show when each device last completed a backup, which makes a stalled upload easy to spot.
Security for laptops that leave the building
A lost laptop is a privacy risk as well as a data risk. Turn on full disk encryption, BitLocker on Windows or FileVault on Mac, so a stolen device does not expose client information. Use device management so you can lock or wipe a laptop remotely, and require a PIN or biometric sign-in. Under the Privacy Act 2020, a lost unencrypted laptop containing personal information may need to be reported as a notifiable privacy breach if it is likely to cause serious harm.
Backups themselves should be encrypted in transit and at rest. If the agent offers a private encryption key, record where it is kept, because losing it means losing the ability to restore. Keep that key in a business password manager or a sealed offline record, not in the head of whoever set the system up, and make sure at least two people know how to retrieve it.
Getting someone working again quickly
Plan for the day a remote worker's laptop dies. With files in OneDrive and a managed device setup, a replacement laptop can be shipped to their home, signed in and ready within hours, with their files syncing down automatically. With an endpoint agent, restore their data onto the new device before sending it, or let the agent pull it down once they sign in.
Keep one or two spare laptops prepared if downtime is costly, and test the replacement process once with a willing staff member. Knowing the steps and the timing makes a lost laptop an inconvenience rather than a crisis. Add the steps to your onboarding and offboarding checklists so every new laptop is protected from the first day and every returned laptop is checked before it is wiped.
In short
- Redirect Desktop and Documents into OneDrive or Drive so work is not stuck on the laptop.
- Back up the cloud data separately, because sync is not a backup.
- Use a centrally managed endpoint agent for staff who must keep local files.
- Encrypt every laptop and be able to lock or wipe it remotely.