The home office has become a permanent fixture of modern work, and with it comes a security responsibility most employees never had when they worked in a corporate office with managed IT infrastructure. A secure home office setup addresses the specific gaps of working from home: an unmanaged router, mixed personal-and-work device use, no physical security controls beyond a front door lock, and the absence of network monitoring and endpoint management that corporate environments provide. This fits into the wider topic we cover in our Complete Guide to Online Security and Privacy.
This guide covers every layer — physical, network, device, and account — with practical steps for both employees working remotely and self-employed individuals running their practice from home.
Physical security — the layer most people overlook
Physical access to a device bypasses almost all digital security controls. Physical security in a home office doesn’t require a locked server room — it requires a few habits and configurations.
Screen positioning: a monitor visible through a window, to household members passing by, or within a video call camera’s field of view reveals the work being done without any technical attack. Position the screen away from windows and entrances. For laptop work in shared household spaces, a privacy screen filter (a physical overlay restricting viewing angle to directly in front) addresses this exposure without requiring a separate room.
Screen lock with automatic timeout: configure the computer to lock after 2–5 minutes of inactivity — Windows: Settings → Personalisation → Lock screen → Screen timeout; macOS: System Settings → Lock Screen → require password immediately. The keyboard shortcut (Windows + L; Command + Control + Q on Mac) provides instant manual locking. A screen never left unlocked when not actively in use prevents any household member, visitor, or camera-based observer from accessing open files or logged-in accounts.
Secure storage for physical documents: printed documents containing client data, financial records, or confidential business information should be locked away when not in use and shredded when no longer needed. Cross-cut shredding (not strip shredding) is the appropriate standard for documents with personal identifiers. A locked filing cabinet or drawer costs little and closes the physical data theft vector that most home offices leave completely unaddressed.
Network security — the critical infrastructure layer
The home router’s security configuration determines the baseline protection for every device connected through it. Essential configuration for any secure home office:
- WPA3 encryption (or WPA2-AES if WPA3 is unavailable) with a 20+ character random password
- Router admin credentials changed from defaults
- Firmware updated (router admin panel → Advanced → Firmware update)
- UPnP disabled
Network segmentation: create a separate network (VLAN or guest network) for work devices, keeping them isolated from IoT devices, smart home equipment, and family members’ personal devices. An IoT device on the same flat network as a work laptop can potentially reach the laptop through network protocols; segmentation prevents this lateral risk. Our guide on network security basics covers the router configuration steps for this segmentation.
VPN use: most employer-mandated configurations include a corporate VPN that routes work traffic through the employer’s network. Always connect to the corporate VPN before accessing any work system. Self-employed individuals without a corporate VPN benefit from a personal VPN from a provider with an audited no-logs policy. Check whether the corporate VPN uses split tunnelling (personal traffic goes directly to the internet) or full tunnelling (all traffic through the VPN) — this affects whether a personal VPN can run alongside it.
DNS over HTTPS: configure the browser or router-level DNS to use an encrypted DNS provider (NextDNS or Cloudflare 1.1.1.1) to prevent ISP logging of all domain lookups from the home network. Particularly relevant for home offices without a corporate VPN covering all traffic.
Device configuration and management
Work computer essentials:
- Full-disk encryption (BitLocker on Windows, FileVault on macOS) — protects all work data if the device is stolen
- Automatic OS and application updates enabled — security patches for the vulnerabilities that malware delivery exploits
- Antivirus/endpoint protection active (Windows Defender with Tamper Protection enabled; macOS GateKeeper and XProtect)
- Screen lock configured (as above)
- Separate browser profiles for work and personal browsing — completely separate cookie stores, history, and saved credentials
Personal devices accessing work data: mobile devices that access work email, calendars, or documents through apps need the same baseline: current OS version, screen lock, and ideally separate work profiles (Android Work Profile, iOS Managed Accounts) that isolate work data from personal apps.
Printer security is frequently overlooked. Network-connected printers are IoT devices with embedded OS software, network interfaces, and in many cases stored print jobs and scanned documents. Printer hardening includes:
- Change admin credentials from defaults (access through browser at the printer’s IP address)
- Update printer firmware through the admin interface
- Disable unnecessary remote access features
- Configure the printer to clear stored print/scan jobs from memory automatically
- For particularly sensitive documents: use a locally-connected (USB) printer rather than a network printer
Webcam and microphone: software permission controls determine which applications can access these, but a physical webcam cover provides hardware-level protection against any software that gains camera access through a vulnerability. Adhesive covers cost under £1/$1 and provide permanent protection when the camera is not in active use. For external webcams, unplugging when not in use is the equivalent control.
Account security and data protection
Work account security: work email accounts should have 2FA enabled — at minimum an authenticator app, ideally a hardware security key for phishing-resistant protection. Review active sessions on work accounts quarterly and terminate any unfamiliar sessions. Our guide on online account security covers the full account hardening process.
Backup strategy: home offices need a backup strategy covering both work and personal data. The 3-2-1 rule: three copies of important data, on two different media types, with one copy offsite (or in cloud storage). For work data: confirm whether the employer’s cloud storage (OneDrive, Google Drive, SharePoint) provides automatic backup, or whether local file backup is the employee’s responsibility. For personal data: external drive + cloud backup covers both failure modes.
Data separation: avoid mixing work and personal data in the same locations. Don’t sync work files to personal cloud storage; don’t store personal financial documents in work folders; don’t use work email for personal registrations. Data separation limits the blast radius if either context is compromised, and it simplifies compliance with any data handling policies the employer specifies.
Video call security
Video calls are the dominant communication medium for remote work, and they introduce specific exposure points that most home office security guides don’t address:
- Virtual or blurred background: household details visible behind you — family photos with identifiable people, whiteboards with sensitive project information, visible mailing addresses on packages — can be seen by all call participants and in any recording. Virtual or blurred backgrounds address this with one setting toggle.
- Headphones for sensitive calls: using speakers means conversation audio is audible to anyone else in the home. Use headphones for calls involving confidential client information, business strategy, or personnel matters.
- Before screen sharing: minimise or close all applications not relevant to the meeting, disable notification previews that might show personal message content, and verify no sensitive content is visible in the background. Share a specific application window rather than the entire desktop where possible.
- Meeting room locks: enable meeting passwords and waiting rooms for video calls where confidentiality matters — these prevent uninvited attendees from joining a link that was forwarded without authorisation.
The two-hour home office security audit
For existing home offices that haven’t been deliberately secured: work through each layer systematically in a single two-hour session.
- Network (30 minutes): log into the router admin panel; verify WPA3 or WPA2-AES; check connected devices for any unknowns; update firmware if available; create IoT guest network if not already configured
- Work device (30 minutes): verify full-disk encryption is active; check that automatic updates are enabled; review which applications have camera and microphone access and revoke unnecessary ones; confirm antivirus/endpoint protection is active and current
- Accounts (30 minutes): verify work email has 2FA enabled; review active sessions and terminate unrecognised ones; confirm backup strategy is active with a recent successful backup
- Physical (30 minutes): confirm screen lock timeout is appropriate; install webcam cover; identify any printed sensitive documents that should be secured or shredded; review printer admin settings
Schedule this audit annually and after any significant change — new router, new work device, change of role that changes the data handled. A two-hour investment brings an existing home office to the protection level that new deployments start from, closing the configuration gaps that accumulate over years of device use without deliberate review. For home offices handling particularly sensitive data, our guide on secure remote desktop covers the specific remote access security decisions that go beyond network-level home office setup. If this sounds familiar, Secure Your Laptop is worth a look.
Self-employed home office — additional considerations
Self-employed individuals, freelancers, and sole traders running a practice from home face additional security considerations that employees don’t: Our guide on Digital Privacy for Journalists covers an adjacent issue.
- No IT department fallback: all security decisions are yours. Build a relationship with a local IT consultant or managed service provider who can help with significant security incidents — having this contact before you need it prevents scrambling during a crisis.
- Client data handling obligations: depending on your profession and jurisdiction, you may have legal obligations for how you handle client data. GDPR applies to any EU resident whose data you hold; HIPAA applies to healthcare professionals in the US; various professional bodies have their own data handling standards. Understand your specific obligations before architecting your data storage and security approach.
- Business continuity beyond backup: a malware infection or hardware failure that takes down your only work device for a week is a significant business continuity event. Consider: a spare laptop that can be pressed into service quickly, cloud-based work software (Google Workspace, Microsoft 365) so that any device can resume work immediately, and a documented list of critical contacts and credentials in a physically secure location.
- Separate work and personal finances: a dedicated business bank account and payment card separate from personal finances limits the blast radius of any financial fraud targeting the business, simplifies accounting, and is required for certain business structures. A business card compromised in a data breach doesn’t affect personal finances and vice versa.
Home office security checklist — quick reference
| Layer | Control | Done? |
| Physical | Screen positioned away from windows and common areas | ☐ |
| Physical | Screen lock: 2-5 minute auto-lock + manual shortcut habit | ☐ |
| Physical | Webcam cover installed | ☐ |
| Physical | Sensitive printed documents secured/shredded | ☐ |
| Network | Router on WPA3 or WPA2-AES with strong password | ☐ |
| Network | Router admin credentials changed from defaults | ☐ |
| Network | Router firmware updated | ☐ |
| Network | Work devices on separate network from IoT devices | ☐ |
| Network | Corporate VPN connected before any work activity | ☐ |
| Device | Full-disk encryption active (BitLocker/FileVault) | ☐ |
| Device | Automatic OS and application updates enabled | ☐ |
| Device | Antivirus/endpoint protection active | ☐ |
| Device | Printer admin credentials changed; firmware updated | ☐ |
| Accounts | Work email 2FA enabled (authenticator app or hardware key) | ☐ |
| Accounts | Unique passwords for all work accounts in password manager | ☐ |
| Data | Backup strategy active with recent successful backup | ☐ |
| Data | Work and personal data kept separate (different drives/accounts) | ☐ |
A secure home office setup is not a one-time project — it’s a maintained configuration that needs to be reviewed as devices change, roles change, and the threat landscape evolves. The checklist above provides a concrete, auditable record of the current state, making it straightforward to verify that controls are in place rather than assumed to be. For employees: review this with your employer’s IT security policy to identify any employer-specific requirements that supplement the controls above. For self-employed individuals: this checklist represents the baseline that most professional data handling obligations require at minimum. See also Network Security Basics for a related case.
