Remote work in a small company: how to prepare IT without chaos

A salesperson's laptop is left in the car, and the car is left unlocked. A week later it turns out that the desktop held quotes from the past two years, the drive was not encrypted and email on that computer is still signed in. This is a typical start to a conversation about remote work in a small business, even though working from home has been in place there for a long time.

Getting IT in order for a team that works outside the office does not need a big budget. It needs decisions in five areas, written down so that a new employee gets the same set-up as the previous one. We start with the law, because it determines who pays for what.

Remote work in the Labour Code: what concerns IT

The remote work rules have applied since 7 April 2023. They were introduced by the Act of 1 December 2022 amending the Labour Code (Journal of Laws (Dz.U.) 2023 item 240). Below are only the parts that concern IT and the workstation. Contractual matters, remote work regulations and allowances are a topic for HR or a lawyer, and we do not interpret them here.

Tools and technical support. Under Art. 67²⁴ § 1, the employer provides the remote worker with work materials and tools, including technical equipment, as well as their installation, servicing and maintenance. It covers the cost of electricity and telecommunications services needed for remote work and provides training and technical support. The parties may also agree that the employee uses their own equipment; the Ministry of Family, Labour and Social Policy states that the employee is then entitled to a cash allowance.

Data protection. Art. 67²⁶ requires the employer to set out personal data protection procedures and provide instruction, and the employee confirms that they have read them. From an IT point of view this is a good moment for the procedure to describe specific settings: disk encryption, screen lock, how to sign in and what to do after losing equipment.

Inspection. Art. 67²⁸ allows the employer to inspect, at the place of remote work, compliance with security and information protection requirements among other things, in agreement with the employee and during their working hours.

Workstation health and safety. Under Art. 67³¹ the employer prepares an occupational risk assessment for remote work that takes into account, among other things, the effect on eyesight, the musculoskeletal system and psychosocial factors. The employee confirms they have read it and declares that safe and hygienic working conditions are ensured at the chosen location. For IT this also means questions about the monitor, keyboard and lighting.

Occasional work. Occasional remote work, at the employee's request, is limited to 24 days per calendar year and is partly governed by different rules. IT safeguards should still be the same, because data leaves the office regardless of the arrangement.

Access to company resources: VPN or cloud

The first question is: where is the data your staff use? If email, files and calendars are in Microsoft 365 or Google Workspace and you issue invoices in a browser-based application, you do not need a VPN for those services. Security there comes from the account, a second sign-in factor and access policies.

A VPN (virtual private network, i.e. an encrypted tunnel from the laptop to the company network) is needed when the office has a server with accounting or warehouse software, a network drive or a system with no cloud version. The rule is simple: nothing used for remote work on office computers should be exposed directly to the internet. In its ransomware guide, CERT Polska recommends making remote desktop available only through a company VPN with two-factor authentication.

With a few remote workers, a VPN running on the company router or firewall is enough, with a separate account for each employee. A shared VPN account for the whole team is a mistake that shows up the first time someone leaves: you cannot block one person without changing the password for everyone.

The employee's home network

The business has no control over the network in an employee's home. The same router serves the company laptop, the children's games console, the TV and guests' phones, and the administrator password is often the factory default. Instead of trying to control that network, assume it is untrusted. The laptop should have the system firewall switched on, an encrypted drive and access to company resources only through a VPN or cloud services with MFA. The same applies to working from a hotel, train or café. If an employee regularly works from somewhere with a poor connection, consider a company LTE or 5G modem: under the Labour Code the employer covers the telecommunications cost anyway.

MFA for all accounts, from email to VPN

MFA (multi-factor authentication) requires more than a password to sign in, most often a confirmation in a phone app or a hardware key. With remote work it matters more than in the office, because sign-ins from home networks and hotels look the same as sign-ins from someone who has stolen a password.

In its recommendations for authentication systems, CERT Polska advises support for two-factor authentication and passwords of at least 14 characters. The order of rollout in a small business: administrator accounts, everyone's email, VPN, and finally industry applications, if they support it.

An SMS code is better than a password alone, but an authenticator app is more convenient and harder to intercept. When rolling it out, prepare a procedure for a lost phone: who can reset the second factor and how they confirm the employee's identity. Without it, the first lost mobile ends with a call to the boss on a Saturday.

Company laptop or the employee's personal computer

This is the decision the rest of your security depends on. A comparison from the IT perspective:

Criterion	Company laptop	Employee's personal computer
Disk encryption	Enabled and controlled by the business	Depends on the employee, hard to verify
Updates and protection	Managed centrally	Outside the business's control
Employee leaves	Equipment returned, data stays with the business	Company data may remain on a private drive
Loss or theft	Remote lock and data wipe	Usually not possible
Costs under the Labour Code	Provided by the employer	Cash allowance for the employee

A sensible standard for a small business: a company laptop with an encrypted drive (BitLocker on Windows, FileVault on macOS), a user account without administrator rights, automatic updates and centrally managed antivirus protection. If someone works on their own equipment, limit their access to browser-based applications, with no file downloads and no saved passwords.

The encryption recovery key must be stored on the business's side. Without it, a motherboard failure means losing the data from the laptop even when the drive itself is fine.

Backing up data from remote workers' laptops

Laptops are the least protected place for data in a small business. An employee saves a quote to the desktop because it is quicker, and for six months that file exists nowhere else.

The simplest solution is to redirect the Desktop and Documents folders to the company OneDrive or Google Drive, so that they save to the cloud automatically. Remember that synchronisation is not the same as a backup. A file deleted or encrypted on the laptop is deleted or encrypted in the cloud too. So you need a separate backup of cloud data, with version history and a retention period longer than the recycle bin. This also applies to mailboxes, which in small businesses often hold the only copy of contracts and arrangements with customers.

In its ransomware guide, CERT Polska reminds readers of the 3-2-1 rule and the need for regular restore tests. For a remote team the test is simple: once a quarter, restore a random file from one person's laptop from a backup a week old. We write about this in more detail in our article on in-house backups.

Communication and reporting problems in a remote team

In the office, a printer problem is sorted by asking across the desk. Remotely you need to agree three channels: one messaging app for work, one place to report IT problems and one number for urgent matters. When tickets arrive by text, email and chat, some of them get lost.

Urgent matters are worth describing on a single sheet: what to do after losing a laptop or phone (whom to notify, how quickly, who blocks the accounts), what to do after clicking a suspicious link and how to confirm unusual payment instructions. A change to a supplier's bank account number sent by email should always be confirmed by phone, using a number from earlier correspondence.

We described how tickets are handled when the employee is at home and the server is in the office in our article on remote and on-site IT support.

Checklist before sending your team to work remotely

Go through it before the first remote working day of every new person and repeat it once a year for the whole team, because equipment, people and services change.

• every employee has their own accounts, with no shared accounts;
• MFA enabled for email, VPN and administrator accounts;
• laptops with an encrypted drive and the recovery key stored by the business;
• automatic updates and antivirus protection on every device;
• desktop and documents synchronised with the cloud, plus a separate backup of cloud data;
• remote desktop available only through the VPN;
• a procedure for lost equipment and suspicious messages that everyone knows;
• a data protection procedure confirmed by the employee in line with the Labour Code.

If you want to check how much of this list you already have in place, book free IT review. We implement MFA, encryption and backups for remote teams as part of our cybersecurity.

---

We discuss the law here only as far as IT tools and the workstation are concerned. This is not legal advice. Prepare the remote work agreement or regulations, allowances and the occupational risk assessment with HR, a health and safety specialist or a lawyer.

Sources

• Ministry of Family, Labour and Social Policy, Remote work, https://www.gov.pl/web/rodzina/praca-zdalna (accessed 02/10/2026)
• Sejm of the Republic of Poland, Act of 1 December 2022 amending the Labour Code and certain other acts (Ustawa z dnia 1 grudnia 2022 r. o zmianie ustawy - Kodeks pracy oraz niektórych innych ustaw), Journal of Laws (Dz.U.) 2023 item 240, https://api.sejm.gov.pl/eli/acts/DU/2023/240/text.html (accessed 02/10/2026)
• CERT Polska, Ransomware guide (Poradnik ransomware), https://cert.pl/uploads/docs/CERT_Polska_Poradnik_ransomware.pdf (accessed 02/10/2026)
• CERT Polska, CERT Polska technical recommendations for authentication systems (Rekomendacje techniczne CERT Polska dla systemów uwierzytelniania), published 10/01/2022, updated 2025, https://cert.pl/posts/2022/01/rekomendacje-techniczne-systemow-uwierzytelniania/ (accessed 02/10/2026)

As of 2 October 2026.