Remote work spreads access across accounts, devices and networks. A practical plan identifies who can use business information, which devices are supported and what happens when access is lost or compromised.
Map accounts, devices and responsibilities
List the services staff use and the information each role needs. Identify organisation-owned and personal devices, supported software and the people responsible for updates. A written rule is useful only when the working arrangements make it practical to follow.
Decide how access is granted and removed, including supplier and temporary-worker access. Use named accounts and appropriate permissions rather than a shared administrator login. Review account recovery so a lost phone or departing staff member does not leave the business without control.
Protect the device and the sign-in
Use supported updates, appropriate encryption and automatic locking for business devices. Encryption can help protect information on a lost device; it does not protect an unlocked session or resolve every account compromise. Recovery keys need controlled availability.
Enable suitable MFA and prefer phishing-resistant methods where supported. Review recovery options and privileged access as part of the same plan. A VPN or office firewall does not replace account and device protections.
Agree how information is shared
Use approved storage and collaboration tools with appropriate access. Avoid passing passwords or sensitive project exports through a public enquiry form or unmanaged personal channel. Check the recipient and access settings before sharing a document.
For personal devices, establish what is permitted and how support, removal of access and business-data handling work. Do not assume the organisation can safely manage or erase a personal device without an appropriate arrangement.
Prepare for a lost device or suspicious session
Give staff a clear reporting route that still works if business email is unavailable. An authorised responder can assess the situation, restrict access and preserve relevant records. Remote lock or wipe options depend on the managed device and its connection; do not assume they will succeed.
An illustrative readiness exercise is to ask who receives a lost-laptop report, who can revoke sessions and how work continues while the incident is investigated. Record missing access or dependencies rather than testing with an actual loss.
Keep the plan current
Review the arrangement after material changes in staff, systems or information handled. Check current ACSC remote-working guidance and platform instructions before changing a live system.
Our infrastructure scope and cybersecurity page explain how responsibilities are discussed. This is general planning information; system-specific controls and incident actions require appropriate technical judgement.
