Remote Work Security Policy for Small Business: A One-Page Template (2026)

Also on CyberFence: compare CyberFence to other VPNs side-by-side · the free CyberFence security tools .

If your employees work from home, from a coffee shop, or from a client's office, you already have a remote work security policy. The only question is whether it is written down. For most small businesses, it is not. One 2026 benchmark report from Senscy found that 75% of companies surveyed had no written cybersecurity policies and formal training process, while 23% did. It is a vendor survey, so treat the exact figure as a signal, not a census.

Size matters too. A CrowdStrike survey of 291 US small business professionals (organizations with 1 to 249 employees, fielded February to March 2025) found just 47% of micro-businesses have a security plan, compared with nearly 90% of larger small and mid-sized businesses.

This guide gives you a one-page policy you can copy today, and then deals with the part most templates skip: how to find out whether your team is following it.

Why a Written Policy Is Worth the Hour

A written policy does three things. It tells new people what is expected, it gives you something to point to when a rule is skipped, and it forces you to decide what you actually care about. It also matters because the threats keep changing. Verizon's 2026 breach report summary says the human element was present in 62% of breaches, and that exploitation of vulnerabilities (31%) has overtaken credential abuse (13%) as the most common way in. That makes two rules in particular worth writing down: keep software updated, and protect every login.

CISA, the US cyber agency, says policies should focus on human behavior and cover the basics, including phishing, software updates and passwords, and that they should be "clear, updated, and communicated to the workforce regularly," according to its Telework Essentials Toolkit. That is a good test for your own draft: if a new hire cannot read it in five minutes, shorten it.

The One-Page Template

Copy these eight rules into a document, change the wording to fit your business, and share it with everyone who touches company data.

1. Devices. Company data is accessed only from devices approved by the owner. Every approved device uses a screen lock, has automatic updates turned on, and is reported immediately if lost or stolen.
2. Accounts. Everyone has their own login. No shared passwords for email, banking or customer systems.
3. Passwords. Use a password manager and a different password on every account. Passwords are never sent by text or email.
4. Two-step sign-in. Turned on for email, file storage, accounting and anything that allows remote access. CISA lists security keys and authenticator apps as stronger choices than text-message codes.
5. Connections. On home Wi-Fi, change the router's default password and use WPA2 or WPA3. On public or shared Wi-Fi, use the company VPN before opening anything work-related.
6. Phishing. Do not enter a work login on a page you reached from a message. Forward anything suspicious to one named person, and reporting a mistake early is always welcome.
7. People joining and leaving. New people get only the access their job needs, and access is removed the day someone leaves.
8. Who to call. Name one person who answers "I think I clicked something" and give their phone number.

That is the whole policy. It fits on one page, and every line is something an employee can actually do. For deeper checklists on the first and last rules, see our guides to onboarding new hires and closing the offboarding gap.

The Gap: A Rule Nobody Checks

Writing the policy is the easy half. The harder half is that people nod, mean well, and skip the step. CISA's small business guidance says this directly: "Ensure MFA is mandated using technical controls, not faith." It adds that some organizations have told users to enroll but not all of them did, so you need to regularly look for non-compliant accounts and fix them.

The same logic applies to your VPN rule. If the policy says "use the company VPN on public Wi-Fi," the owner needs a way to know who has actually set it up. Without that, the policy is a wish. We cover this problem in more depth in how to know if employees are actually using your company VPN.

How CyberFence Teams Fits the Policy

Here is how the team plan lines up with the rules above, using what the CyberFence Teams page describes:

• Rule 5, connections. The VPN helps protect each person's internet connection, and Web Shield helps block harmful websites as they browse. Each person gets their own account, which can be used across their supported devices (iPhone, iPad, Android, Mac and Windows).
• Rule 6, phishing. Web Shield DNS blocking can stop known phishing and malware domains before a page loads. It cannot catch a brand-new domain nobody has reported, so the habit still comes first. Our post on how DNS filtering works explains the limit.
• Rule 3, passwords. Breach Monitor watches each member's email for known breaches, so you hear sooner when a password may be exposed. It does not replace unique passwords. See what Breach Monitor is.
• Rule 7, joining and leaving. You invite people from the dashboard, and when someone leaves you can revoke their access and make that seat available for another member. Added seats are prorated to the current billing cycle.

Visibility, not surveillance

Owners often worry that a team plan means watching employees. The Teams dashboard shows setup, device and connection information, and the page states plainly that it does not show employees' browsing history, DNS queries or destination IP addresses. That is enough for the question a policy actually needs answered: has everyone set this up?

What it does not do

Setup status is not a guarantee of continuous protection, and a dashboard is not a substitute for training. CyberFence is part of a broader security program. It is not a certification and not a guarantee of compliance, and reports are meant to support your own internal reviews. If clients or insurers ask for specific controls, check what they require before assuming any tool covers it.

Compare the Alternatives Honestly

You can enforce a VPN rule without a team plan. You can ask each person to buy an individual subscription and send a screenshot, and some small teams do exactly that. The weak spots are what we describe in team VPN versus individual subscriptions: nothing is in one place, someone has to chase the screenshots, and removing a departing employee depends on them cancelling their own account.

For a two-person team, CyberFence Teams starts at $24 a month, billed annually, which works out to $12 per person per month. Taxes and any valid discount are calculated at checkout, and the final total is shown before payment. If that is not the right fit yet, the one-page policy above still helps, and you can add tooling later.

Roll It Out in One Week

• Monday: Edit the template and decide your named contact.
• Tuesday: Turn on two-step sign-in for email and file storage, starting with admin accounts.
• Wednesday: Share the policy in a ten-minute team call and answer questions.
• Thursday: Get everyone onto a password manager and the company VPN.
• Friday: Check who has finished, follow up personally with anyone who has not, and put a quarterly review on the calendar.

CISA's Cyber Essentials guide for small business leaders adds one more line worth borrowing: learn who is on your network by keeping inventories of user accounts, vendors and business partners. A policy that names who has access is easier to keep honest.

The Bottom Line

A one-page policy is the cheapest security improvement a small business can make, and it only works if someone checks it. Write the eight rules this week, decide who follows up, and pick tools that let you see setup status instead of trusting everyone to do it alone.

Want to go deeper? Read the CyberFence competitor comparison hub , our free privacy and security tools , or CyberFence plans and pricing .