The Remote Work Laptop Security Checklist Your IT Team Should Be Running
Remote work didn’t create the endpoint security problem. It made it impossible to ignore.
When everyone worked in the same office on the same network, a single firewall covered a lot of ground. Now a firm’s most sensitive data lives on laptops in home offices, coffee shops, client locations, and airport lounges. Each one is an endpoint that can be lost, stolen, or compromised — and each one represents a potential path into your business network.
Most firms have done something for remote laptop security. Most haven’t done everything on this list.
The Checklist
1. Full-disk encryption enabled. BitLocker on Windows, FileVault on Mac. If a laptop is stolen, full-disk encryption means the data on it is unreadable without credentials. This is table stakes — if it’s not enabled on every company laptop, that gap should be closed before anything else. We verify and enforce BitLocker status through our RMM platform across every managed endpoint.
2. Current EDR deployed and reporting. Not just antivirus. Endpoint Detection and Response (EDR) monitors for behavioral patterns of attacker activity that signature-based AV misses. Our Managed EDR solution is deployed across our managed client endpoints. If you’re not sure whether your current solution is EDR or traditional AV, that’s worth clarifying.
3. Auto-lock configured. Screen locks after 5-10 minutes of inactivity. This is trivial to set and often overlooked. A laptop left unattended in a conference room with no screen lock is an unlocked door.
4. Local admin rights removed from standard user accounts. Employees don’t need local admin rights to do their jobs, and granting those rights makes it significantly easier for malware to install itself or for an attacker to escalate privileges. Standard user accounts with admin access removed via Group Policy or Intune is a basic configuration step with meaningful security value.
5. Automatic OS and application updates enabled. Known vulnerabilities get patched. Unpatched systems stay exposed. Managed patching through our RMM platform ensures this happens on schedule rather than whenever an employee gets around to clicking “remind me later.”
6. VPN or conditional access configured for company resources. Remote employees should access internal systems through either a business VPN or Microsoft’s conditional access framework — not through direct exposure of systems to the public internet. For M365 environments, conditional access policies in Entra ID can require compliant device status before granting access to corporate data.
7. Device enrollment in MDM. Company laptops should be enrolled in an MDM platform so that security policy is enforced centrally, device health is visible, and the ability to remote-wipe a lost or stolen device exists. A laptop that isn’t enrolled in MDM is a device the firm doesn’t actually manage.
8. MFA enforced for all accounts. Covered in other posts, worth repeating here: every account that accesses company data — M365, CRM, time tracking, billing software — should require MFA. A compromised password is recoverable when MFA is in place. Without it, it’s an open door.
9. Separate network for work. Employees working from home should ideally be on a dedicated Wi-Fi network separate from smart home devices, personal computers, and family members’ traffic. A home IoT device compromise that reaches the same network segment as a work laptop is a real path to corporate data. This can be accomplished by setting up a dedicated SSID on a home router, or providing travel routers to employees with sensitive roles.
10. Browser and password manager policy. Saved passwords in Chrome profiles synced to personal accounts are not an acceptable substitute for a managed password manager. A managed password manager provides IT-visible, centrally managed credential storage with policy controls. Browser-based credential storage has no visibility and no controls.
11. Physical security awareness. This one doesn’t have a software fix. Employees with laptops containing sensitive client data should understand: don’t work on confidential matters in public where screens are visible, use a privacy screen in high-traffic environments, and report lost or stolen devices immediately so remote wipe can happen before data is accessed.
The Case for Rethinking the Laptop Entirely
For firms with higher security requirements, there’s a more fundamental option worth considering: Cloudtop®, our Desktop as a Service platform.
A Cloudtop® user runs their work environment on a remote desktop hosted on dedicated hardware at QTS in Doral. The laptop becomes a thin client — it connects to the hosted environment, but sensitive data never actually touches the local device. A stolen laptop becomes a stolen dumb terminal. The work environment, the data, and the applications are all in the data center.
For law firms handling confidential client matters, the security posture of a hosted desktop is significantly stronger than a laptop carrying local data. And because the compute is centralized, IT management is simplified — you’re managing one server environment instead of 20 individual endpoints.
Not every firm needs Cloudtop®, but for the scenarios where the risk profile of a locally stored data environment is genuinely high, it’s worth the conversation.
Getting Started
If you’re managing remote laptops today without full confidence that this list is covered, the fastest starting point is a device audit — checking current encryption status, EDR deployment, MDM enrollment, and update hygiene across your endpoint fleet. That snapshot tells you where the gaps are.
We run that audit as part of our onboarding process for new managed services clients, and on request for prospective clients who want to understand their current exposure before making any commitments.