Can a cyber risk assessment cover remote workers?
Yes. A cyber risk assessment can include remote workers by examining the devices, identities, connections, applications, data and working practices involved in accessing business systems away from the office, then identifying appropriate safeguards for those risks.
Remote working should be assessed as part of the organisation’s overall cyber risk picture, not treated as a separate issue or excluded because staff are away from the office. The assessment should examine how remote work changes the likelihood and impact of incidents, then determine whether existing controls remain suitable for those working arrangements.
A useful assessment considers the different ways people work remotely. This may include working from home, travelling between sites, using shared workspaces, accessing systems from customer premises, or working from a personal device. Each arrangement can introduce different risks, particularly where the business has limited visibility of the environment in which company information is accessed.
Key areas to examine include:
- Identity and access: how users authenticate, whether multi-factor authentication is required, how access is limited by role, and how leavers or compromised accounts are removed or restricted.
- Devices: whether laptops, tablets and phones are owned or managed by the business, how they are configured, whether security updates are applied, and how lost or stolen equipment is reported and protected.
- Connections: how remote users connect to business services, whether traffic is appropriately protected, and whether insecure networks or unapproved connection methods create additional exposure.
- Applications and cloud services: which systems can be accessed remotely, how access is logged, whether administrator functions are restricted, and whether suppliers’ security settings have been reviewed.
- Information handling: where files are stored, downloaded or printed, how sensitive information is protected on local devices, and whether confidential conversations or documents can be overheard or viewed by others.
- Home and shared working environments: whether screens, paperwork, removable media and work equipment can be accessed by unauthorised people.
- People and processes: whether staff understand phishing, social engineering, incident reporting, password security and the rules for using personal equipment or public networks.
The assessment should distinguish between a control that exists on paper and one that operates effectively. For example, a policy may require secure access, but the review should establish whether remote access is actually restricted, whether exceptions are approved, and whether relevant activity is monitored. Similarly, a requirement to update devices is more meaningful when supported by records showing that updates are applied and unsupported software is identified.
Remote working can also affect incident response. A business should consider how it would contain a compromised account or device when the user is not on company premises. This includes the ability to revoke sessions, reset credentials, isolate equipment, preserve relevant evidence and contact the user through a reliable channel. The assessment should identify dependencies, such as whether a remote worker needs access to a particular device or system to continue essential operations during an incident.
Home networks generally fall outside the organisation’s direct control, so the assessment should focus on the risks that arise from relying on them and the safeguards available to reduce those risks. These may include managed business devices, secure authentication, approved applications, endpoint protection, encrypted storage, restricted permissions and clear rules for handling data. The appropriate combination depends on the sensitivity of the information and the access required, rather than on whether the worker is in a home office or another location.
Bring-your-own-device arrangements need specific attention. A risk assessment can examine whether personal devices are permitted, what business information they can access, whether the organisation can enforce security requirements, and what happens when the device is lost, sold or used by another member of the household. If the organisation cannot apply adequate controls, limiting access or requiring a managed device may be a more appropriate treatment than relying solely on user guidance.
Travel and shared locations may introduce further risks, including unattended equipment, visual eavesdropping, exposed conversations, unfamiliar networks and opportunistic theft. These risks should be considered in relation to the tasks being performed. Access to a low-sensitivity collaboration tool may present a different risk from downloading customer records or administering core infrastructure.
The findings should be recorded in the same structured way as other cyber risks. Each finding should describe the affected asset or activity, the threat, the vulnerability or control weakness, the potential consequence, the people responsible for treatment and the evidence supporting the conclusion. Actions might include changing access permissions, improving device management, revising remote-working rules, providing targeted training or implementing additional monitoring.
Remote workers should also be included when testing whether controls are understood and usable. If security measures are too difficult to follow, users may create workarounds, transfer data through unauthorised services or delay reporting a suspected incident. Practical interviews, configuration reviews and sample checks can reveal issues that would not be apparent from policies alone.
A remote-working assessment has limits. It cannot remove every risk associated with an employee’s surroundings, personal behaviour or third-party services, and it should not be presented as a guarantee that an incident will not occur. Its purpose is to make those risks visible, evaluate the controls that can reasonably be applied, and support decisions about which risks the organisation will treat, transfer, tolerate or avoid.
Where remote working arrangements change significantly, the assessment should be revisited. Examples include introducing personal-device access, moving a business application to a new cloud service, changing the categories of data available remotely, expanding access to contractors, or adopting a substantially different working model. A review may also be appropriate after an incident, a serious near miss or a material change in the organisation’s systems.
S2 Technology Group can support small and medium-sized organisations with the wider IT, cyber security and cloud considerations that inform this type of assessment. The objective is to connect identified remote-working risks with practical requirements for secure and manageable business technology, while keeping the assessment aligned with the organisation’s actual operations.
A remote-worker assessment should also consider the boundaries of security monitoring. Controls such as device telemetry, access logs and activity alerts may provide useful evidence, but the organisation should establish what is collected, why it is needed, who can view it and how long it is retained.
These arrangements should be explained clearly to staff and applied consistently. Monitoring designed to identify suspicious access should not provide unrestricted visibility of personal activity, particularly where a device or connection is shared. Documenting these boundaries helps the business investigate genuine security concerns while maintaining a proportionate approach to employee privacy.
