IT rules for staff who work from home

Why home working needs its own rules

When work moved home in a hurry, most businesses did whatever got people working that week. Laptops went home, staff used family computers, the office server was opened up to the internet and nobody wrote anything down. Several years on, hybrid work is normal, but many offices are still running on those emergency arrangements. The office environment protected businesses in ways people didn't notice: a managed network, locked doors, a shredder, a printer nobody else could use. At home, those protections don't exist by default. A short set of rules brings the important ones back without making remote work a chore.

The device and how it connects

The simplest rule is that work happens on a business device. A company laptop with encryption, endpoint protection, automatic updates and device management can be secured and supported wherever it is. If staff must use a personal computer occasionally, limit it to browser-based access to email, Teams and SharePoint, without syncing files down.

Avoid exposing office systems directly to the internet so people can reach them from home. Older setups often used remote desktop ports forwarded through the router, which attackers scan for constantly. If staff need an office application, use a properly configured VPN, a cloud-hosted version or a virtual desktop service, with multi-factor authentication on every connection.

Home Wi-Fi and the router

Ask staff to check their home Wi-Fi is protected with a strong password and current encryption, and that the router's admin password has been changed from the default. Many NZ homes still use the router their internet provider supplied years ago, which may no longer get updates. That is worth raising, though most businesses stop short of managing home routers themselves.

Public Wi-Fi in cafes, airports and hotels is fine for most cloud services, which encrypt their own traffic, but staff should avoid entering passwords on login pages that look odd, and consider using their phone's hotspot for sensitive work. If your business has particular confidentiality needs, such as legal or health work, set a stricter rule.

Files, printing and conversations

Work files belong in OneDrive, SharePoint, Teams or Google Drive, not on a home computer's desktop or a USB stick. That keeps them backed up, accessible from the office and removable if a device is lost. Make it clear where each type of file belongs, so staff aren't tempted to save locally because they're unsure.

Printing at home is a common gap. Printed customer files on a kitchen bench are a privacy risk, and home printers often keep copies of scanned documents. Either ask staff not to print confidential material at home, or provide a shredder and clear guidance on disposal. Similarly, remind people that video calls and phone conversations about customers can be overheard by family members or smart speakers. Headsets and a closed door go a long way.

Video calls and being reachable

Agree the basics of remote collaboration: which tool is used for calls and chat, whether cameras are expected on, and how people show they're available. In Microsoft 365 that usually means Teams for calls and chat, with presence status set honestly. A business that uses three different calling apps confuses customers and staff alike.

Provide decent equipment where it makes a difference: a headset with a good microphone, a second screen for people who work with spreadsheets, a webcam for anyone whose laptop camera is poor. These are modest costs that make home working much more productive. Check your internet allowance rules too, if any staff are on limited plans or rural connections.

Getting help from home

Make sure staff know how to report a problem from home, including what to do if their laptop won't start or they're locked out of their account. Remote support tools let a technician see and fix most issues without a visit, but the person needs a way to reach support when their main device isn't working, such as an email address they can use from their phone.

For hardware failures, decide in advance how a replacement gets to the person: do they come into the office, does a technician drop one off, or is a spare couriered? Writing that down saves a lost day when it happens. Office IT supports remote staff across New Zealand this way, and the same planning applies whoever provides your support.

Put it on one page

Pull these rules into a single page that new staff read and existing staff sign. Keep it practical rather than legalistic, and review it once a year. Hybrid working changes over time, and so do the tools, so the rules should keep up with how people actually work. Ask staff once a year what gets in their way at home; their answers usually point to the next useful change.