A remote work baseline for a small engineering team is ten checks: disk encryption, automatic updates, host firewall, screen lock, protected SSH keys, MFA, a password manager, a hardened home router, a lost device plan and a leaver process. Each one is cheap, testable and worth writing down with the evidence you will keep.
Why a baseline, not a policy binder
NIST SP 800-46 Revision 2 covers enterprise telework, remote access and BYOD, and says the components should be secured against expected threats identified through threat models. For a small team a full threat modelling exercise is rarely practical, so start with the failures that are common and cheap to prevent. Write it as a one page standard people can follow.
The ten checks
- Disk encryption on. FileVault or BitLocker. Evidence: a screenshot or a device report.
- Recovery keys held by the company. See where to store recovery keys.
- Automatic updates on. Evidence: OS version report. See Mac updates.
- Host firewall on. See the firewall guide.
- Screen lock after a short idle time, and a strong login password.
- SSH keys with passphrases or on hardware tokens. See passphrases and ssh-agent.
- MFA everywhere it exists, with phishing resistant methods for admins. See which MFA to require.
- A password manager for work credentials, and no secrets in plain text files or chat.
- A home router checked once. Use the router checklist.
- A lost device plan and a leaver process. See the first hour checklist and the offboarding checklist.
How to make it stick
- Onboard with it. New starters do the ten checks in their first week, with a buddy.
- Re-attest quarterly. A five minute form, plus a spot check on two machines.
- Keep exceptions in writing. If someone cannot meet an item, record why, who approved it and when it will be reviewed. See how to set up a security exception process.
- Do not use it to police. The goal is a team that can show a buyer a clear answer on questionnaires, and recover quickly from a lost laptop.
What the baseline leaves out
It does not cover the code you ship. Dependency risk, secrets in repositories and build pipeline security are separate work. Safeguard covers SBOM and dependency scanning, reachability analysis and policy gates for that side, and you can try a free scan at gold.safeguard.sh/scan.
The demo below shows how a dependency inventory comes together.
Click through it at your own pace, or open it full screen.
Quick check
Do we need device management software to apply this baseline?
No. A short form and screenshots work for a handful of people. Management tools become worth it as the team grows and evidence collection gets tedious.
Sources
- NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and BYOD Security
- Home network security, CISA
Last reviewed: 19 October 2026.
