When a team works from homes, cafes and client sites, the laptop is the office. Verizon's 2025 Data Breach Investigations Report found that 46% of compromised systems holding corporate logins were unmanaged devices that also stored personal credentials. This guide sets out a practical baseline for small remote teams: who owns the device, how it is configured and patched, how people sign in, and what to do when a laptop goes missing.
Why the laptop is now the perimeter
A remote team has no office network to hide behind. Each laptop connects from a different router, carries saved browser sessions and often holds files that never reach a shared drive. If an attacker steals a session token or a password from one machine, they can reach email, the CRM and cloud storage without touching a server.
The numbers show how often this happens. The UK Cyber Security Breaches Survey 2025/2026 found that 43% of businesses identified a breach or attack in the previous 12 months, rising to 46% for small firms. Phishing was the most common route, reported by 38% of businesses. Verizon's 2025 report added that 46% of systems caught by infostealer malware with corporate logins were unmanaged devices mixing personal and work credentials.
Company-owned devices or bring your own device
The first decision is ownership. Company-owned laptops let you enforce encryption, updates and screen locks, and wipe the device when someone leaves. Personal devices cost less up front but give you weaker control. Among UK micro businesses, 64% allow access to company data only from company-owned devices, according to the 2025/2026 survey.
If you do allow personal devices, the NCSC's bring your own device guidance breaks the work into five actions: set objectives and understand user needs, develop a policy, weigh costs and implications, pick a deployment approach, and apply technical controls. A common middle path is to allow phones for email and chat through managed apps, while keeping finance, customer data and admin consoles on company laptops.
Set a baseline configuration for every device
Do not configure laptops by hand one at a time. The NCSC publishes platform guides for Android, ChromeOS, iOS, macOS and Windows, with configuration packs on its GitHub that can be loaded into mobile device management (MDM) software as a starting baseline. Its guidance on getting ready also covers zero-touch enrolment, so a new laptop can ship straight to a remote hire and configure itself on first login.
A workable baseline for a small team covers full-disk encryption, a short screen-lock timeout, a standard user account for daily work with admin rights held back, the built-in firewall and antivirus switched on, and browser settings that block unknown extensions. Write the baseline down in one page so that every new device is checked against it.
| Control | What to set | Why it matters |
|---|---|---|
| Ownership | Company laptops for customer and finance data | Lets you enforce settings and wipe on exit |
| Enrolment | Zero-touch enrolment into MDM | Remote hires get a configured device on day one |
| Encryption | Full-disk encryption on every laptop | A lost device does not expose stored files |
| Accounts | Standard user for daily work, separate admin | Limits what malware can change |
| Updates | Automatic OS and browser updates, tracked in MDM | Closes known holes quickly |
| Sign-in | Two-factor authentication on email and cloud apps | A stolen password alone is not enough |
| Logs | Keep device and sign-in logs for 180 days | Matches CERT-In log retention for Indian entities |
Patch quickly, including the network gear at home
Patching is where small teams slip. Verizon found that exploitation of vulnerabilities was the initial access route in 20% of breaches in its 2025 report, and that edge devices and VPNs made up 22% of exploitation targets, up from 3% a year earlier. Only about 54% of those edge device flaws were fully fixed, and the median time to patch was 32 days.
For a remote team, that means turning on automatic updates for the operating system, browser and office apps, and using MDM reports to spot laptops that have not updated in a week. If staff connect through a company VPN appliance, it needs the same urgency. The NCSC also advises applying available updates even where its own guides were tested on an older version.
Make sign-in harder to steal
Most remote work runs through cloud apps, so identity matters as much as the device. Only 47% of UK businesses use two-factor authentication, though uptake among micro businesses rose to 43% from 35%. Turn it on for email, file storage, the CRM, accounting software and the password manager first, because those hold the most data.
The NCSC's advice to end users still holds: never share a password with anyone, including IT staff or a manager, do not reuse passwords across systems, and never store a written password with the device. A company password manager makes this easy to follow. Where possible, tie app access to an enrolled device so that a password used from an unknown laptop is refused.
Plan for lost devices and risky habits
Laptops get left in taxis. The NCSC tells users to report loss or theft to the helpdesk straight away, since faster reporting gives more time to lock accounts and wipe the device. It also advises keeping the device with you or locked away, watching who can see your screen, charging only with trusted cables, and not plugging into unknown computers or sharing the connection without approval.
Turn that advice into a short checklist every new starter signs. Give one named person the job of receiving loss reports, with the steps written out: revoke sessions, reset the password, send a remote wipe and record the time. Staff should also stop using a device they think has been tampered with and hand it to IT, not a commercial repair shop.
- Report a lost or stolen device within minutes, not at the end of the day
- Revoke active sessions and reset passwords before wiping
- Use only approved chargers, cables and peripherals
- Take work laptops abroad only with approval
Know your incident duties in India
Indian companies have firm deadlines. Under CERT-In's April 2022 directions, covered entities must report cyber security incidents within six hours of noticing them, keep ICT system logs for 180 days on a rolling basis and synchronise clocks to NTP time servers. Non-compliance can lead to imprisonment of up to one year, a fine of up to ₹1 lakh, or both, under Section 70B.
If a lost laptop held customer personal data, the Digital Personal Data Protection Rules, notified on 14 November 2025, also require you to tell affected people without delay. The Act allows penalties of up to ₹250 crore for failing to keep reasonable security safeguards. Encryption and remote wipe are the simplest evidence that you took those safeguards.
A 30-day plan for a small remote team
Start with an inventory of every laptop and phone that touches company data, then choose an MDM tool and enrol company devices. In week two, apply the baseline: encryption, screen lock, standard accounts and automatic updates. In week three, turn on two-factor authentication across core apps and roll out a password manager. In week four, write the lost device procedure and test it on a spare laptop.
Only 25% of UK businesses have a formal incident response plan, according to the 2025/2026 survey, so even a one-page plan puts a small team ahead. XDQ Labs helps teams set up and verify these controls on systems they are authorised to manage, and the same plan works whether you have five laptops or fifty.
Frequently asked questions
What is the most important security step for remote employee laptops?
Enrol every company laptop in device management so you can enforce encryption, screen locks and automatic updates, and wipe it remotely. Then add two-factor authentication on email and cloud apps. Those two steps cover the most common ways remote laptops lead to breaches.
Should a small business allow employees to use personal laptops?
It can, but with limits. Personal devices are harder to control, and Verizon found 46% of infostealer-hit systems with corporate logins were unmanaged. Many small firms allow personal phones for email through managed apps but keep customer and finance data on company laptops.
How fast must an Indian company report a cyber incident?
CERT-In's April 2022 directions require covered entities to report cyber security incidents within six hours of noticing them. They also require ICT logs to be kept for 180 days on a rolling basis and clocks to be synchronised with NTP servers.
What should an employee do if a work laptop is lost?
Report it to IT immediately. The NCSC notes that faster reporting allows more to be done to protect information. IT should then revoke active sessions, reset passwords, send a remote wipe and record the time, in case a regulatory report is needed.
Sources
- 2025 Data Breach Investigations Report: Executive Summary, Verizon, 2025
- Cyber security breaches survey 2025/2026, GOV.UK (Department for Science, Innovation and Technology), 2026
- The CERT-In Cyber Security Directions: More Questions Than Answers, Cyril Amarchand Mangaldas, 2022
- Device security guidance: platform guides, National Cyber Security Centre (UK), 2025
- End user devices: advice for end users, National Cyber Security Centre (UK), 2016
- Verizon's 2025 Data Breach Investigations Report: news release, Verizon, 2025
- Digital Personal Data Protection Rules, 2025: backgrounder, Press Information Bureau, Government of India, 2025
