Clear Path step · Business · Open for business on Monday
Manage remote and personal devices, and tell staff how real IT reaches them
Why it matters: Remote staff are reached through devices and channels you don't see. Central management keeps those devices patched and recoverable, and a clear 'how IT contacts you' rule defeats fake help-desk messages that try to get staff to install remote-access tools or hand over codes.
On your path if you picked “Remote or hybrid staff” or “Staff use personal phones or laptops” for “What runs your business?”.
Best after: Put phishing-resistant sign-in on email and every admin account
Do it
- Enroll every company laptop in device management and require full-disk encryption, a screen lock, automatic updates and remote wipe.
- For personal phones that get work email, use app-level protection so company data stays inside managed apps and can be removed without wiping the phone.
- Tell staff in writing how real IT will contact them, and that IT never starts with a message from an outside chat account or asks them to install a remote-access tool or read out a code.
- Give remote staff a short home-router checklist: change the default admin password, turn on automatic updates and use WPA3 or WPA2.
- If you have no on-site servers, prefer cloud sign-in with MFA and device checks over a VPN.
- Practice what happens when a laptop is lost: who reports it, who wipes it, and how fast.
Check it worked: Every work laptop is managed centrally with encryption, screen lock, updates and remote wipe; personal phones with work email keep company data in protected apps that can be wiped without touching personal data; and staff know real IT never starts a conversation through an outside chat account.
If an outside IT company handles your IT, send them this:
Hi, could you please enroll every company laptop in device management with full-disk encryption, screen lock, automatic updates and remote wipe? For personal phones with work email, we'd like app-level protection so company data can be removed without wiping the phone. Please also send a short note we can give staff on how you will and won't contact them. Please confirm when every device is enrolled.
Simply put
It's like giving every remote worker a company car with a remote lock and regular servicing, plus a clear rule about who's allowed to call about repairs. Managed devices stay patched and recoverable, and fake 'IT' messages stand out.
In detail
Fake IT messages through workplace chat apps, often after a flood of spam email, are an established way into small businesses; restricting outside chat in the tenant settings and a written contact rule work together. Device checks at sign-in are the small-business version of zero trust: access depends on a healthy, managed device, not on being on the office network.
Points toward the Long View: access that depends on a healthy, managed device, wherever the work happens.