Business Laptop Security Checklist for WFH

In the office, a work laptop sits behind a firewall someone configured, on a network someone monitors, in a building with a locked door. Take it home and all of that disappears. It now shares a Wi-Fi network with a smart TV, a games console and a teenager's downloads, and it spends part of the week on a café table.

That's not a reason to ban working from home. It's a reason to make the laptop secure on its own, so its safety doesn't depend on where it happens to be. Here's the checklist we work through for Australian businesses, roughly in order of how much damage each item prevents.

Why one laptop is a business-sized risk

Do the arithmetic on what's actually on a typical work laptop. A synced copy of the company's shared files. A browser that's signed into email, the accounting package and the CRM. Saved sessions that skip the login screen. A thief who walks off with it isn't stealing a $1,800 piece of hardware; they're potentially holding the keys to everything that person can access.

If your business is covered by the Privacy Act, a lost device holding personal information can also trigger the Notifiable Data Breaches scheme: assessing the breach, notifying affected people and reporting to the OAIC. Lost and stolen devices turn up in the OAIC's breach reports every year. Most of the items below exist so that a lost laptop becomes an insurance claim rather than a data breach.

The checklist

1. Encrypt the drive

This is the single most important item. With BitLocker (Windows Pro and Enterprise) or FileVault (Mac) switched on, the data on a stolen laptop is unreadable without the user's sign-in. Without encryption, anyone can pull the drive, plug it into another computer and browse it.

Make sure the recovery keys are stored centrally, not on a sticky note in the laptop bag. If you manage devices through Microsoft Intune, the keys are escrowed automatically.

2. Turn on multi-factor authentication everywhere

Stolen passwords, not stolen laptops, are the most common way into a business. MFA means a password alone isn't enough to sign in, and it's one of the ACSC's Essential Eight controls for good reason. The trick is setting it up so staff don't fight it; we've written about MFA your staff won't try to dodge.

On the laptop itself, Windows Hello for Business (face or fingerprint plus a PIN tied to that device) is both more secure and faster than a typed password.

3. Patch automatically, and check that it's happening

Patching operating systems and applications is two more of the Essential Eight, and home laptops are where patching quietly stops. The user postpones the restart for three weeks, and the laptop sits there with a known vulnerability.

Set updates to install automatically with a deadline, and monitor compliance centrally so you can see which machines are behind. Any laptop still running Windows 10 has been out of support since October 2025 and no longer receives security fixes, so it belongs at the top of the replacement list.

4. Run real endpoint protection, not just antivirus

Built-in antivirus catches known malware. Modern attacks often don't involve malware at all; they use stolen credentials and legitimate tools. Endpoint detection and response watches for suspicious behaviour and lets someone isolate a compromised laptop remotely. If the names confuse you, our explainer on what Microsoft Defender actually does untangles the five products called Defender. Pair it with managed detection and response so someone is actually watching the alerts.

5. Make sure you can find, lock and wipe it

Every company laptop should be enrolled in device management (Intune for most Microsoft 365 businesses) so that if it goes missing you can locate it, lock it, and remotely wipe it. Test this once. A remote wipe that's never been tried is a theory.

6. Take admin rights away from everyday accounts

Restricting administrative privileges is another Essential Eight control. If staff work day-to-day in an account that can install anything, so can any malicious link they click. Standard user accounts, with software deployed centrally, close that door.

7. Back up the files, automatically

Theft, ransomware or a dead SSD shouldn't cost anyone their work. OneDrive folder backup protects the Desktop and Documents folders, and the business data in Microsoft 365 needs its own backup too. We cover the gaps in backup that works when you actually need it.

8. Sort out the home network

You can't manage every employee's router, but you can give them a short list:

• Change the router's default admin password and update its firmware.
• Use WPA2 or WPA3 encryption with a strong Wi-Fi password.
• Put smart TVs, cameras and other gadgets on the guest network if the router supports it.

Better still, design for the network being untrusted. With cloud apps, MFA and conditional access policies that only allow compliant, managed devices to sign in, the home Wi-Fi matters far less.

9. Keep the work laptop for work

It's a family computer the moment someone else uses it. Kids installing games, partners checking personal email, a browser full of extensions from who-knows-where. A one-line policy (the work laptop is for the employee's work only) prevents a surprising amount of trouble. If staff need to use their own devices for work instead, that's a separate set of rules.

10. Physical habits

• Lock the screen with Windows + L whenever you step away, and set it to auto-lock after a few minutes.
• Use a privacy screen filter if you work in cafés, on trains or in shared spaces.
• Never leave a laptop visible in a parked car, even for "just a minute".
• Report a lost or stolen device immediately. The first hour matters for remote wipe and revoking sessions.

Running a laptop security check

To audit where you stand, go down the list for each device and mark it yes or no. Encrypted? Enrolled in management? Patched in the last 30 days? MFA on every account? Endpoint protection reporting in? Standard user account? Backed up?

In most small businesses we assess, the first pass turns up at least one laptop that fails three or four of these, usually the one belonging to the person who travels most. A cyber security assessment does this across the whole fleet and gives you a prioritised fix list.

The good news is that most of this checklist is included in licences many businesses already pay for. Microsoft 365 Business Premium includes Intune and Defender for Business, which covers encryption policy, patch compliance, endpoint protection and remote wipe. It's often just a matter of turning it on and configuring it properly, which is what our managed IT clients get by default.

Frequently asked questions

What is the most important laptop security measure for a business?

Full-disk encryption (BitLocker or FileVault) combined with multi-factor authentication. Encryption protects the data if the laptop is stolen; MFA protects the accounts if the password is stolen. Between them they stop the two most common ways a lost laptop becomes a breach.

Do I have to report a lost work laptop?

If your business is covered by the Privacy Act and the laptop held personal information that could cause serious harm, it may be an eligible data breach under the Notifiable Data Breaches scheme. A properly encrypted laptop that's remotely wiped usually changes that assessment, which is another reason encryption is item one.

Is a VPN enough to secure a home laptop?

No. A VPN protects traffic in transit, but it does nothing if the laptop is stolen, unpatched or signed in with a stolen password. Most businesses on Microsoft 365 get more from encryption, MFA, device management and conditional access than from a VPN.

How do I secure laptops for staff who work from home?

Enrol every laptop in device management, enforce encryption, automatic updates and MFA, run endpoint protection with monitoring, remove local admin rights, and back up files automatically. Then give staff a short home-network and physical-security checklist.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Not sure every laptop in the business would pass this checklist? Ask us for a device security check — we'll tell you which machines fail, and why.