Working Safely from Home: Checklist for Employees and Managers

The BSI defines telework as any activity supported by information and communication technology that is performed wholly or partly outside the business premises (module OPS.1.2.4). A home workplace cannot be assumed to offer the same security as the office; it is often accessible to visitors or family members as well. The BSI therefore requires that all relevant aspects of telework be regulated and that employees receive the rules or an information sheet (OPS.1.2.4.A1).

The modules come from the IT-Grundschutz Compendium, Edition 2023. The BSI is replacing the Compendium with Grundschutz++; according to the BSI milestone plan, the methodology is to be published on October 27, 2026. The requirements for working from home remain valid in substance.

• Written telework agreement, including the locations where work is permitted (§ 2h para. 2 AVRAG)
• Rules for telework or an information sheet with the security measures handed out and regularly updated (OPS.1.2.4.A1)
• Security requirements for home office devices defined; only authorized persons have access, use only for permitted purposes (OPS.1.2.4.A2)
• Digital work equipment provided or reimbursement for personal devices agreed (§ 2h para. 3 AVRAG); for private devices, risk assessed (BSI)
• Secure remote access set up, such as a cryptographically secured VPN, restricted to trusted devices and persons (BSI)
• Rules defined on which communication tools may be used for work and whether private use is allowed (OPS.1.2.4.A7)
• Rules defined on which documents and storage media may be taken home and how they are transported (INF.8.A2)
• Employees made aware of the risks and instructed in the measures, repeated regularly (OPS.1.2.4.A5)
• Contact person for hardware and software problems named, reporting channel for loss and incidents known (OPS.1.2.4.A9, BSI)
• Means for the secure disposal of confidential documents provided (INF.8.A5)

• For work, use only the device provided or approved by the company
• Lock the screen as soon as you leave your desk, even briefly; family members and visitors do not use the device
• Do not postpone updates and antivirus updates; the BSI counts current patches and signatures among the standard measures
• Laptop and portable storage media encrypted, as the BSI recommends for portable devices
• Access internal systems only through the designated secure access, such as the company VPN
• Do not store data permanently on the local device or on private storage; according to the BSI, important data should ideally not be stored locally at all

• Router administration protected with its own secure password, unless the device comes with an individual factory password
• Check the router firmware regularly for updates and install them
• Wi-Fi password with at least 20 random characters
• Default network name replaced so that it reveals nothing about the manufacturer or model
• Remote access to the router turned off if you do not need it
• Guest Wi-Fi for visitors and insecure devices, separate from home office applications
• Open the router configuration only via https; change firewall settings only with expert knowledge

Public Wi-Fi in a café, hotel, or train: Access internal systems only through a secure channel such as the company VPN (BSI).

• Keep work documents and storage media in a lockable cabinet or mobile pedestal (INF.8.A1)
• Leave the workspace tidy, do not leave confidential information lying around (INF.8.A1)
• Close windows and lock doors when the workspace is unoccupied (INF.8.A3)
• If possible, a separate room or clearly separated area, set up ergonomically (INF.8.A4)
• Avoid printouts; do not put confidential paper in household waste, dispose of it according to company rules (INF.8.A5)
• On the go, use a privacy screen filter and consider which tasks should not be done in public places (BSI)
• Conduct confidential phone calls and video conferences so that housemates, visitors, or neighbors cannot overhear; check camera and screen sharing beforehand

The item on phone calls and video conferences is a TOMORIS recommendation; it follows from the BSI's observation that a home workplace is often accessible to visitors or family members as well.

1. 1

   Report loss immediately

   Device or storage medium lost or stolen: report it immediately through the known reporting channel so that the company can change passwords and block access (BSI).

2. 2

   Report suspicions, do not resolve them yourself

   Report suspicious emails, unusual messages, or sign-in requests to the designated contact, write down your observations, and take action only when instructed.

3. 3

   Use support

   For hardware or software problems, contact the designated person instead of opening devices yourself or installing software without approval (OPS.1.2.4.A9).

This checklist is a TOMORIS recommendation based on the BSI modules and recommendations cited. In Austria, the law requires in particular the written agreement and the work equipment under § 2h AVRAG; for personal data, Art. 32 GDPR also applies.