A remote work security checklist puts one question to a firm: what can its people show on a home day? This one asks three staff to show nine things, one at a time, and then marks what they show. It serves two readers: the leader who wants to know where the firm stands, and the IT lead who does the asking. Someone other than the marker picks the three, which stops the marker choosing the people likely to pass. Used this way, the sheet acts as a work from home security checklist for the firm as a whole. The broader job of keeping staff who work from home secure has a Signisys page of its own.
Last reviewed 2026-11-02 by Manish Sharma.
Remote Work Security Checklist: Nine Checks, Three People to Ask
Three words come up throughout. A remote worker is anyone doing the firm’s work from a place such as a home desk or a café table. The marker is whoever runs the sheet. A sample is the three people someone else chooses for the marker to ask.
The sample comes from different teams and includes at least one person on their own device. During a video call, the marker asks each person to show the check on screen or in hand.
The nine checks sit under four headings, each with its own question.
The headings, the checks and the sample of three form a Signisys working method; it is no standard and carries no legal weight. Each heading then gets a section of its own below.
Remote Work Security Checklist: Demonstrated, Described or Not Yet Shown
Before the call, the marker writes the date and the three names at the head of the sheet. Each check then gets a single mark for the whole sample. The marking scheme here is Signisys’ own.
Demonstrated (2): all three sampled people show it on screen or in hand. Described (1): they say it holds but do not show it, or only two of the three show it. Not yet shown (0): the marker did not ask, or a sampled person shows that it is not in place.
Should a check not suit the way the firm works, the marker writes N/A, adds the reason and lowers the highest total by two. Check 5 is one example, if the firm’s tools are single-user by design. With no N/A line, the highest total is 18.
The sheet sets no pass mark and no bands; the total describes three people on one day. Two firms with the same total may have quite different open lines.
Key Takeaway Because the total depends on who was asked and when, write the date and the three names beside it.
A Locked Screen and a Current Update
The first heading covers the device each person works on at home. Take the checks singly, and wait while the person finds each one. What changes for that device on a home day is mapped in the machines IT could see and four other office safeguards.
| Check | Ask to see | Demonstrated when |
|---|---|---|
| 1. Each sampled person has a screen lock on each work device they use at home | The lock setting on screen, then the device locking | All three show a lock that asks for a PIN or password to open |
| 2. Each person has updated the work device and the work apps | The update page, then the list of work apps | None of the three has an update waiting that is older than the limit the firm wrote down |
| 3. Each person has told the firm in writing which devices they use for work, firm-issued or their own | The person’s line in the firm’s device list, and the device itself | The list matches the device the person shows, including its type |
The update limit is the firm’s to set, but no figure is given here.
The firm learns that a personal device is in use when the staff member writes it down, and check 3 asks for that line. If a person shows a tablet that has no line in the list, check 3 gets Not yet shown.
Who Signs In, and With What Second Step
The second heading covers how each person gets into work email and the main work app.
| Check | Ask to see | Demonstrated when |
|---|---|---|
| 4. Each person signs in to work email and the main work app with a second step as well as a password | The person signing in during the call | All three pass the second step while the marker watches |
| 5. Each person has an account of their own for each work tool | The person’s line in the firm’s account list | None of the three shares a login with a colleague, a relative or a team |
How staff reach applications from home is a separate job. Which set-up carries that access, a tunnel or checks at each app, is weighed in comparing the two ways staff connect from outside the office. Signisys covers how staff get to work applications on another page.
If a person signs in on a phone the firm has not listed, the marker notes it against check 3 as well. A shared team login found during check 5 goes on the sheet under the sign-in heading. The team head’s name then goes beside it.
Where the Work Files Sit at Home
The third heading covers where current work lives and what happens to paper.
| Check | Ask to see | Demonstrated when |
|---|---|---|
| 6. Each person keeps current work files in the firm’s storage, not in a personal mailbox or on the device alone | The folder path the person opens a current file from | All three open a current file from the firm’s storage |
| 7. Each person has a set place for printed work and says what happens to it when the job is done | The place, shown on camera | The person shows the place, then says what happens to the paper afterwards |
For check 7, the marker asks the person to show one corner of the room where they keep printed work. If the person declines, the check earns a Described mark, which is not a fault.
If none of the three prints at home, the marker writes N/A against check 7, with that reason beside it.
The Call When a Bag Goes Missing
The fourth heading covers what happens when a laptop or phone goes missing. Data held only on a lost device is one of the cases sorted in the five groups from deleted files to records that expire.
| Check | Ask to see | Demonstrated when |
|---|---|---|
| 8. Each person has the loss contact saved, with the way to reach it, in case a device goes missing or someone steals it | The number or address as saved on the person’s phone | All three have it saved before being asked, and it matches the firm’s written note |
| 9. A test report sent through that route reaches the named person, who answers within the time the firm has set | The test message and the reply | The reply came before the set time ran out |
For check 9, the marker sends one test for the firm and then files the reply with the sheet.
A UK guide covers related ground. The UK National Cyber Security Centre published a short home working guide for organisations. It tells them to make sure staff know the steps to take, and who to phone, if a device goes missing or is stolen. It also encourages staff to report any loss promptly.
The guide’s text speaks of the coronavirus (COVID-19). Read it as written for that period, not as a recent update.
Remote Work Security Checklist: Fixing the Open Lines in Order
Once all nine checks have a mark, the marker starts a second sheet. When a check is marked Described or Not yet shown, it goes onto the second sheet under its heading. Beside each line go a name and the date of its next marking.
For each line, the marker asks whether a missing device or a doubtful sign-in could go unreported today. Under this Signisys working method, the lines answered yes are marked first on the sheet. Until check 1, 4 or 8 reaches Demonstrated, the team has no shown answer for a lost device or doubtful sign-in.
The remaining lines follow later, in the order of the headings. A remote work security checklist marked this way leaves the open lines in order, with a name on each.
The total describes the three people sampled on the day. Reading it as proof that the firm is secure, or that it meets any law, would be a mistake.
The sheet stops at the open lines, with no subtotal for each heading and nothing set against other firms’ results.
An Online Tutoring Company Marks the Sign-in Check
This example is invented, and Signisys had no part in it. An online tutoring company has teachers in several cities who teach live classes from their own laptops. The operations head’s assistant picks three teachers, and the marker takes check 4 with each in turn.
In the first scene, each of the three signs in to the class-booking tool during the call and passes the second step. That earns Demonstrated.
Picture a second scene, where two teachers sign in. The third says she has set up the second step, but her phone is charging. The mark is Described; the marker saw two of three, not three.
In a third scene, the marker runs short of time and does not ask about check 4 at all. The mark is Not yet shown, and the line goes onto the second sheet.
Someone other than the marker chose the teachers, and the marker had no chance to pick the ones likely to pass. That choice keeps the score honest.
Key Takeaway Because the mark follows what the marker saw, a gap in asking shows up as a gap on the sheet.
Marking Again After a Change of Staff or Kit
A new joiner, a replaced laptop or a changed tool each calls for a fresh round. When one comes up, the marker takes the affected checks again with the people concerned. The new sheet then goes beside the old one, with the three names, the date and notes on the evidence. Before filing it, the marker makes sure the IT owner and the team heads can open it. Setting up the order of work behind these checks is a separate task. A starting sequence for a small firm that has none yet is laid out in who decides what first when staff work from home. Signisys can work through the marked sheet with the IT owner and help put the open lines in order.
Signisys offers digital workplace and endpoint management and end-user computing services. A reader should weigh the sheet’s advice with that interest in mind.
Remote Work Security Checklist FAQ: Queries From Owners
Can the remote work security checklist be marked from a video call?
Who should pick the three staff for the remote work security checklist?
When should the remote work security checklist be marked again?
What if a remote worker declines to show a check on screen?
Does a full total show that home working is safe?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.