What are the best practices for securing a distributed workforce?

To secure a distributed workforce for the long term, protect three things: the identity (strong multifactor authentication), the device (managed or checked before it connects) and the access path (patched remote access, least privilege). Then write a remote work policy that people can actually follow, and review it as tools change.

What does NIST say to cover?

NIST SP 800-46 Revision 2, the guide to enterprise telework, remote access and bring your own device security, starts from a plain point: employees, contractors, partners and vendors use remote access technologies to work from outside, and all components, including organization-issued and personally owned devices, should be secured against threats identified through threat models. It covers several types of remote access solutions and gives advice on creating security policies.

That "threat model" instruction is the first step. A remote worker on a home network with a shared router faces different risks from a contractor using a personal laptop. List the situations you have, then decide controls for each.

How should identity be handled?

Identity is the new perimeter for remote staff. CISA's ransomware guidance says to apply multifactor authentication on VPN connections, and if MFA is not available, to require teleworkers to use passwords of 15 or more characters. It also recommends phishing-resistant MFA, passwordless options and password managers with MFA turned on.

Add two practices. Remove access promptly when people change roles or leave. And treat administrator accounts separately, with their own stronger authentication and no use for everyday email.

How should devices and access paths be handled?

For devices, decide which are allowed and what state they must be in. A managed laptop with disk encryption, a current operating system and a screen lock is one tier. A personal phone that only reads email through a protected app is another. NIST's guide covers both organization-issued and personal devices, so your policy should name both.

For access paths, CISA's guidance is specific. Update VPNs, network infrastructure devices and the devices people use to connect with the latest patches and security configurations. Audit for systems using RDP, close unused RDP ports, enforce account lockouts, apply MFA and log login attempts. Disable SMB version 1. CISA's DarkSide advisory lists the same family of weak points, noting that attackers have gained access through phishing and through remotely accessible accounts and systems.

Many teams are moving from a VPN that puts a person on the whole network toward access granted per application. NIST SP 800-207 describes this approach, zero trust, as granting no implicit trust based on network location and authenticating and authorizing before each session.

What about the human side?

Remote staff are easier to reach with social engineering, and they cannot ask the person at the next desk. Give them a simple way to check a strange request: a known phone number or a chat channel with the security team. CISA's phishing guidance recommends verifying a request through contact details you already have, not details from the suspicious message.

Keep training short and tied to what people actually see.

What does a failure look like?

Constructed example. A contractor works from a personal laptop and connects to the company VPN. The laptop has not been updated in a year and has a saved password for the VPN. Malware on it steals the saved credential. With no MFA, the attacker signs in from another country. With MFA on the VPN, a managed device check and an alert on a login from a new location, any one of those three would have stopped or flagged the intrusion.

How to check or apply this

1. Write a one page threat model: which people, which devices, which networks.
2. Require MFA on every remote access path, and use phishing-resistant methods for administrators.
3. Define device tiers, and allow only the tier needed for the data being accessed.
4. Patch VPNs and gateways on a fixed schedule and audit exposed RDP.
5. Log remote sign-ins and alert on new locations and repeated failures.
6. Publish a short policy, covering personal devices and home networks, and review it yearly.
7. Remove access the day a role changes.

Quick check

Sources

• NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and BYOD Security
• CISA #StopRansomware Guide
• CISA and FBI advisory AA21-131A, DarkSide Ransomware
• NIST SP 800-207, Zero Trust Architecture
• CISA, Avoiding Social Engineering and Phishing Attacks

Last reviewed: 18 October 2026.