Secure remote access means remote staff reach company resources only after strong authentication, from devices you can trust, with access limited to what each person needs, over encrypted connections that you log. A VPN can be part of this, but it is not the whole design.
What does NIST say about remote work?
NIST SP 800-46 Rev. 2 covers security for enterprise telework, remote access and bring your own device. It notes that many organizations let employees, contractors, partners and vendors work from outside locations, and that all parts of these setups, including organization-issued and personal devices, should be secured against expected threats identified through threat models. It also recommends protections for each technology and gives guidance on writing policies.
The phrase "threat models" matters. A remote worker on a home network with a shared family computer faces different risks from one on a managed laptop, so you plan for each case.
Which controls form the baseline?
NIST SP 800-53 gives the building blocks:
- AC-17 Remote Access: establish and document usage restrictions, configuration and connection requirements for each type of remote access, and authorize each type before connections are allowed.
- AC-17(2): use cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
- IA-2(1): multi-factor authentication for privileged accounts. Many organizations apply it to everyone who connects remotely.
- AC-6 Least Privilege: allow only the accesses necessary for assigned tasks.
- SI-4 and AU-2: monitor for unauthorized connections and log the events that support investigation.
What does each layer protect against?
Strong sign-in blocks the most common route in: stolen or guessed passwords. Prefer methods resistant to phishing for administrators and finance staff.
Device trust addresses what a stolen login cannot: the state of the machine. A managed, patched laptop with disk encryption is a safer endpoint than an unknown personal computer.
Narrow access limits damage. If a login is stolen, the thief gets that person's access, not the whole network.
Encrypted sessions protect traffic on hotel, cafe and home networks.
Logging and alerts tell you when something unusual happens, such as a sign-in from a new country or a session at an odd hour.
What does a layered design look like?
A constructed example. A 60-person company has three groups of remote users. Engineers use managed laptops and reach the build system and code hosting through a VPN limited to those services. Finance staff use managed laptops and reach the accounting application through a browser session behind multi-factor authentication, with no network-level access. Contractors use their own devices and reach one web portal with time-limited accounts, and cannot download files.
Each group has a different path because each has a different risk. Every connection is logged with user, device and source address, and an alert fires if one account signs in from two countries within an hour.
What are common mistakes?
- A VPN that drops users onto the entire internal network.
- Shared accounts for contractors.
- Former staff whose remote access is not removed at departure.
- A VPN gateway that has not been updated, since these systems sit at the edge of the network and attract attacks.
- No policy for personal devices, so unmanaged ones appear anyway.
How to check or apply this
- List each way a person can connect remotely, and record who approved it, as AC-17 expects.
- Require multi-factor authentication for all remote sign-ins, preferring phishing-resistant methods for high-risk roles.
- Check device health before granting access where your tools allow it, and keep unmanaged devices on a narrower path.
- Replace broad network access with per-application access wherever practical.
- Update remote access gateways promptly, and subscribe to advisories for them.
- Remove access on the day someone leaves or changes roles.
- Log sign-ins and sessions and alert on impossible travel and new devices.
- Write a short remote work policy that covers home networks, personal devices and lost equipment.
Quick check
Is a VPN enough to secure remote workers?
No. A VPN encrypts the connection, but you also need strong authentication, device trust, limited access and logging.
Should personal devices be allowed?
They can be, with a narrower path, such as browser access to specific applications. NIST SP 800-46 expects personal devices to be secured against threats identified through threat models.
Sources
- NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and BYOD Security
- NIST SP 800-53 Rev. 5 control catalog, OSCAL JSON from NIST (AC-17, IA-2, AC-6, SI-4)
Last reviewed: 18 October 2026.
