Mandatory security measures for work laptops used at home

A work laptop used at home needs at least seven security measures: disk encryption, a centrally managed antivirus, two-step verification, working with data on a server or in the cloud, with backup, up-to-date software, a secure connection to the company network, and a plan for when the laptop goes missing.

More and more companies allow employees to work from home, at least a few days a week, and this has created the need to raise the level of device security.

In this article, we present a minimum list of security measures that must be in place on every company device, so that there’s no risk of company data being lost or compromised. If employees also use personal laptops, read what you need to know about personal devices used for work as well.

Data encryption

So that company data isn’t put at risk when a device is lost or stolen, we recommend encrypting the data on it. Laptops compatible with Windows 11 all have a hardware module called TPM 2.0, which stores the encryption key. Windows 11 Pro and Enterprise encrypt the disk with BitLocker Drive Encryption, and Windows 11 Home has, on compatible computers, a simplified form of encryption called Device encryption. On a MacBook, FileVault plays the same role.

Data stored on an encrypted disk can’t be recovered without the decryption key, and the algorithm used is practically impossible to crack. Keep the recovery key in Microsoft Entra ID or Active Directory, not on a piece of paper stuck to the laptop.

Older laptops without TPM 2.0 can’t run Windows 11. Windows 10 has not received free updates since October 14, 2025, and companies can buy Extended Security Updates (ESU), paid per computer, until October 2028 at the latest, at a cost that rises every year. Plan to replace these laptops; you’ll find details in the article on the problem of end-of-life (EOL) technologies.

Installing a premium antivirus

Once we’ve made sure company data can’t be accessed by people with malicious intent, it needs to be protected. Antivirus solutions managed through cloud consoles have become the standard for businesses, because they offer better device security than ordinary antivirus programs: the IT department can see from the console whether a laptop is unprotected or infected, even when the employee is working from home. See also what we recommend in the article on the best antivirus for business.

Every company should invest in security, because losing data can cost more than a monthly or annual subscription to an antivirus vendor.

Two-step verification (MFA)

A password stolen through phishing is no longer enough for an attacker if email, the VPN and cloud apps also ask for a second factor: an authenticator app on the phone or a security key. For companies that fall under NIS2 (in Romania, GEO 155/2024), two-step verification is one of the required security measures.

Working on the file server and including it in a robust backup

Whether it’s a cloud file server or one located at the company’s office, working on the server makes data easier to secure and also makes collaboration easier. This way, several users can work on the same files at the same time, and IT administrators can secure the data easily, because the file server’s backup doesn’t depend on users’ internet connections. For backups, see Backup as a Service.

Regularly updating applications and the operating system

To reduce the number of vulnerabilities in the operating system, laptops used in a business environment should be updated regularly. Along with new features, developers include security patches for known vulnerabilities in their updates. Updates must be installed automatically and checked from the IT console, not left to each employee’s discretion.

A secure connection to the company network

Access to the company’s servers and applications goes through a VPN connection or through cloud apps protected with two-step verification, not through ports opened directly to the internet. You’ll find details in the article why VPN connections help secure your company’s infrastructure. The home network matters too: a strong Wi-Fi password and an updated router. See how to secure the wireless network at the office or at home.

What should you do if a work laptop is lost or stolen?

Tell the IT department right away, so they can block the employee’s account and change the passwords. If the laptop is centrally managed (for example through Microsoft Intune), it can be locked or wiped remotely.

If the disk was encrypted, the risk of the data reaching someone else is very low. If it wasn’t encrypted and it contained personal data, the company must assess the incident and, if there is a risk to the people concerned, report it to ANSPDCP (the Romanian data protection authority) within 72 hours, as the GDPR requires.

RezolvIT is an IT outsourcing company that provides personalized support to companies. With a very good understanding of business needs, the company proactively proposes and implements high-performance technical solutions, both for work done at the office and to make remote work easier. We set up computers and accounts for new employees and close access for those who leave, through our IT maintenance and IT security services.