Your security perimeter used to be a room. Here is the checklist that replaced it.

The office firewall is gone. Here is the checklist that replaced it.

Our security perimeter used to be a room. Then it became a laptop on a home router shared with a smart TV, a phone on cellular, and one sunny afternoon in a café with open Wi-Fi.

Remote work didn't make small teams less secure. It removed the single place where "we have a firewall" used to count as a plan. What replaces it isn't a product — it's a short list of habits that travel with the laptop.

The home-network pre-flight (once per person, one afternoon):

• Router admin password changed from the factory default — the default is printed on the physical router, and anyone who ever visited the house read it.
• WPA2/WPA3 with a real password, guest SSID for everything that isn't work: smart TV, doorbell camera, consoles.
• Full-disk encryption on — verified, not asked. This single setting turns "laptop left in a car" from a breach into a hardware loss.
• Automatic updates on, screen lock at five minutes. The home "office" has housemates and toddlers.

Write the result down per person — five lines. That note is what makes the next audit take ten minutes instead of a week of "I think mine's fine."

The admin lane (the rule that matters most):

The mistake isn't working from cafés. It's that the same browser profile opens the invoice dashboard and the news site. Admin and money paths get their own profile — or their own account — no extensions beyond the password manager, hardware security keys where supported. A key that doesn't care what network you're on is exactly what remote work needs.

And no shared logins on personal devices, ever. "Just log in as me on your iPad" is the login nobody can revoke when someone leaves.

The BYOD decision:

Someone's personal MacBook will touch company data. It happens in month one at every small company — the only choice is whether it happens with rules. Sane default: email and chat yes with MFA, code repos no, production and payment systems never. Inventory the devices anyway: owner, OS version, encryption, MFA status. That one-row-per-device table is the difference between a manageable incident and "we have no idea which laptops had access."

Coffee-shop rules, the four that matter:

1. Treat every network as hostile — including the café's. Do the above and the network stops mattering much. That's the design goal.
2. Privacy screen when facing the room. Shoulder-surfing is the cheapest attack on the board.
3. No confidential calls within earshot — customer names, invoices, incident details.
4. The laptop never leaves sight. Not "for one minute, getting a refill."

The failure modes that turn remote work into an incident:

• "VPN optional." Optional settings are read as "nobody checks." Pick where it's mandatory and make it mandatory.
• MFA on office accounts but not remote paths. Email reachable from anywhere is reachable from anywhere.
• Nobody knows the lost-device drill. Every remote worker should know without looking it up: who to tell, in what order, and that the laptop gets wiped remotely before it gets searched for. Rehearse it like your restore test — quarterly, twenty minutes.

We turned this into a full written checklist with the per-person pre-flight sheet, the BYOD decision table, and the quarterly lost-device drill — the same format as our other small-team ops checklists:

→ Remote Work Security Checklist for Small Teams: https://hive80-lab.github.io/ops-notes/remote-work-security-checklist.html

The printable versions live in the Ops Starter Kit ($14) — incident response for small teams — and the Automation Starter Pack ($19). Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout: https://hive80lab.gumroad.com

What does your remote setup look like — separate admin profile, or one browser for everything?