Agencies should include device management, access control, data classification, VPN and network security, password and MFA requirements, acceptable use, client data handling, and incident response policies in their remote work handbook. These policies protect client confidentiality, meet compliance obligations like SOC 2 or GDPR, and reduce breach risk when staff work outside a controlled office network.

Most agencies treat the handbook as an HR formality and get this wrong. For a remote workforce handling sensitive client data, the security section is your first line of defense and often the first thing a prospect's procurement team asks to see during a security review.

Core security policies every remote work handbook needs

Here are the policies that matter most, grouped by what they protect.

1. Device and endpoint security

Define whether employees use company-issued hardware, personal devices (BYOD), or both. A clear bring-your-own-device policy should require:

  • Full-disk encryption (FileVault on macOS, BitLocker on Windows)
  • Automatic screen lock after 5 minutes of inactivity
  • Up-to-date OS patches and antivirus
  • Mobile device management (MDM) enrollment for any device touching client data
  • Remote wipe capability for lost or stolen devices
Illustration of a remote worker laptop with encryption shield, VPN connection, and MFA prompt icons

2. Network and VPN requirements

Public Wi-Fi is a common breach vector. State that employees must connect through a company VPN when accessing internal systems or client environments, and prohibit handling sensitive data on unsecured public networks. Require home routers to use WPA2 or WPA3 encryption with a changed default admin password.

3. Authentication and password management

Mandate a password manager, minimum password length (12+ characters), and multi-factor authentication (MFA) on every business account. The NIST SP 800-63B digital identity guidelines are a solid reference point for setting these standards without forcing counterproductive rules like frequent forced rotation.

4. Data classification and handling

This is the section procurement teams scrutinize. Define data tiers (public, internal, confidential, restricted) and rules for each:

  1. Confidential client data must stay in approved cloud apps, never on local desktops or personal cloud storage.
  2. Restricted data (PII, financials, source code) requires encryption in transit and at rest.
  3. No client data may be shared over personal email or consumer messaging apps.

If you respond to security questionnaires, a documented data classification scheme makes those answers far easier to populate.

Acceptable use and access control

Acceptable use policy

Spell out what employees can and can't do on work systems: no installing unapproved software (shadow IT), no using work accounts for personal services, and clear rules on AI tools. Many agencies now add a generative AI clause prohibiting staff from pasting confidential client material into public LLM chatbots.

Principle of least privilege

Grant access only to the systems each role needs. Document an offboarding checklist that revokes accounts within 24 hours of departure. This matters more for remote teams because there's no physical badge to collect.

Generate Proposals with AI in seconds.

Try now
Proposal album preview

Compliance and client-facing security

Agencies serving regulated clients need to align handbook policies with frameworks like SOC 2, ISO 27001, GDPR, or HIPAA. Reference the specific standard your agency targets so auditors see consistency between your written policy and operational reality. Strong documented controls also help when preparing for a discovery call where security maturity can become a deal qualifier, and they speed up vendor reviews during competitive evaluations like inbound versus outbound enterprise deals.

Diagram showing data classification tiers from public to restricted with corresponding security controls

Incident response and reporting

Every handbook needs a clear, blame-free incident reporting process. Employees should know:

  • Who to contact within 1 hour of a suspected breach or lost device
  • That reporting fast is rewarded, not punished
  • The steps the security team will take (containment, client notification, post-incident review)

A documented incident response plan with defined timelines is often a contractual requirement in enterprise master service agreements.

Sample policy checklist