Required security configurations for company laptops

Create a remote-specific acceptable use policy covering personal software installation, shared family networks, and approved cloud storage to protect company data while respecting employee privacy. Employees working from home often use the same machines for personal and professional tasks, creating security risks that traditional office policies cannot address. An AUP designed for remote teams establishes clear boundaries, protects sensitive data, and ensures everyone understands their responsibilities. This guide provides a practical template with concrete examples you can adapt for your organization immediately.

Why Remote Device Policies Differ from Office Policies

In a traditional office environment, IT teams have direct control over hardware, network access, and physical security. When employees take laptops home, that control disappears. A remote team’s acceptable use policy must account for:

Shared family devices and networks
Variable physical security (coffee shops, co-working spaces)
Personal software installations and subscriptions
Data synchronization across personal cloud accounts

Your policy needs to be explicit about what is allowed, what is prohibited, and what requires approval.

Core Components of an Effective AUP

1. Device Assignment and Ownership

Define whether employees receive company-owned devices or are expected to use personal hardware (BYOD). Most organizations prefer company-owned devices for security compliance.

## Device Assignment

All remote team members will receive company-issued laptops configured with standard security tooling. Personal devices are not permitted for accessing company systems unless explicitly approved in writing.

2. Acceptable Use Definitions

Clearly enumerate permitted and prohibited activities. For developers, this includes specific guidance on software installation, command-line access, and container usage.

## Permitted Uses

- Development work using approved IDEs and tooling
- Running company-provided containers and virtual machines
- Accessing internal documentation and repositories
- Communication via approved messaging platforms

## Prohibited Uses

- Installing unauthorized software or browser extensions
- Executing untrusted scripts from the internet
- Using personal cloud storage for company data
- Sharing devices with family members or roommates

3. Network and Connection Requirements

Remote work often involves varied network conditions. Specify minimum security standards for home networks and VPN usage.

## Network Security Requirements

- All work must be conducted behind a WPA2/WPA3 encrypted home network
- Public WiFi usage requires the company VPN to be active
- Mobile hotspot connections are acceptable as backup
- Network segmentation is recommended for developers working with sensitive systems

Technical Implementation Examples

For technical teams, your AUP should include configuration specifics. Here’s how to document endpoint protection requirements:

Endpoint Protection Policy

# Required security configurations for company laptops

# FileVault (macOS) - Full disk encryption
sudo fdesetup enable

# BitLocker (Windows) - Enable via group policy
# Ensure TPM protection is active

# Firewall rules - Always on
sudo defaults write /Library/Preferences/com.apple.sharing.firewall -bool true

Development Environment Standards

Developers need flexibility, but with guardrails:

# .dev-config.yml - Company development environment standards

allowed_package_managers:
  - npm
  - pip
  - cargo
  - go

required_security_tools:
  - secret_detection: true
  - dependency_scanning: on_push
  - codeql_analysis: required

prohibited_technologies:
  - crypto_miners: true
  - peer_to_peer_sharing: false
  - unverified_container_images: false

Data Handling and Privacy

Specify exactly how employees should handle company data on remote devices:

## Data Handling Guidelines

### Acceptable
- Storing code in company GitHub/GitLab organizations
- Using approved password managers for credentials
- Working with files in designated company cloud storage

### Prohibited
- Copying customer data to local drives
- Emailing sensitive documents to personal accounts
- Screenshotting proprietary information
- Storing unencrypted backups locally

Incident Response Procedures

Your policy must explain what happens when something goes wrong:

## Security Incident Response

If a company device is lost, stolen, or potentially compromised:

1. Immediately notify IT Security at security@company.com
2. Remote wipe will be initiated via MDM
3. Report within 24 hours to satisfy compliance requirements
4. Do not attempt to investigate the incident yourself

Enforcement and Acknowledgment

An AUP only works if employees understand and agree to it. Implement a system for acknowledgment:

# Example: Acknowledgment tracking script (Python)

import json
import datetime

def acknowledge_policy(employee_id, policy_version):
    acknowledgment = {
        "employee_id": employee_id,
        "policy_version": policy_version,
        "timestamp": datetime.datetime.utcnow().isoformat(),
        "ip_address": "logged_at_acknowledgment",
        "agreement": "I have read and agree to comply with this policy"
    }

    with open(f"acknowledgments/{employee_id}.json", "w") as f:
        json.dump(acknowledgment, f)

    return acknowledgment

Require re-acknowledgment whenever the policy updates.

MDM Tools for Enforcing Your AUP

Writing policy language is only half the job. You need tooling that enforces the rules automatically. Three platforms dominate enterprise remote device management:

Jamf Pro is the gold standard for macOS-heavy teams. It allows you to push configuration profiles, enforce disk encryption, lock down the App Store to approved apps, and trigger remote wipes. Pricing starts at roughly $4/device/month for Jamf Now (SMB) and scales to custom enterprise contracts for Jamf Pro.

Microsoft Intune integrates deeply into the Microsoft 365 ecosystem. If your team runs Windows devices and uses Azure AD for identity, Intune is the natural choice. It enforces compliance policies, manages software deployment, and produces audit reports that satisfy SOC 2 auditors. Intune is included in Microsoft 365 Business Premium and E3/E5 plans.

Kandji has emerged as a strong macOS-focused MDM with an excellent blueprint system that lets you template device configurations. It supports automated remediation—if a device falls out of compliance, Kandji can push corrections automatically rather than waiting for an IT ticket.

Regardless of which MDM you choose, configure at minimum: mandatory screen lock after 5 minutes of inactivity, full disk encryption enforcement, and automatic OS update installation within 30 days of release.

Handling Personal Device Exceptions (BYOD)

Some roles or budget situations make BYOD unavoidable. When employees use personal devices, the AUP must address the privacy tension directly. You cannot demand full MDM enrollment on a personal device without creating legal and morale problems.

A practical BYOD section addresses three things: what data may be accessed on personal hardware, what apps are mandatory (VPN, approved communication tools, endpoint security if acceptable to the employee), and what happens at offboarding. Many teams use containerization solutions like Microsoft Intune’s app protection policies or VMware Workspace ONE to create a managed “work container” on personal phones without touching personal data.

State clearly in your policy that the company will not monitor personal device usage outside of work applications. Employees are more likely to comply fully when they trust the policy is not designed to surveil them.

Practical Policy Review Checklist

Before finalizing your acceptable use policy, verify it addresses these points:

Policy Review Cadence

A policy that is never updated becomes a liability. Schedule a formal review every 12 months at minimum, and trigger an unscheduled review whenever any of the following occur: a security incident involving a remote device, a significant change to the technology stack, new compliance requirements in your jurisdiction, or a shift in team structure (merger, acquisition, rapid headcount growth).

Document every revision with a version number and changelog entry. Store historical versions so you can demonstrate to auditors that you maintained a reasonable standard of care over time.

Making Policy Accessible

Avoid creating a document that nobody reads. For technical teams, consider a condensed version:

# Quick Reference: Remote Device Do's and Don'ts

DO:
- Lock your screen when stepping away (Cmd/Ctrl + L)
- Use the VPN on public networks
- Report lost devices within 24 hours
- Keep software updated

DON'T:
- Install unapproved software
- Share credentials with anyone
- Store customer data locally
- Ignore security warnings

Post this reference in your team wiki, pin it in your main Slack channel, and include it in new-hire onboarding. The more visible the quick-reference version, the less likely employees are to claim they were unaware of a rule.

Common Mistakes When Writing Remote AUPs

The most common mistake is copying a template written for office environments without adapting it to the realities of distributed work. Generic language like “do not misuse company equipment” fails to address home network sharing, personal browser profiles, or the fact that a spouse might use the same WiFi router for streaming video.

A second mistake is making the policy so restrictive that engineers work around it. If your AUP prohibits all software installation without a ticket, developers will find ways to bypass it rather than wait a week for approval. Build a fast-track approval path for common developer tools, and maintain a pre-approved software list that employees can install without going through IT.

Finally, many organizations fail to address what happens to data when an employee leaves. Your AUP should explicitly state the offboarding process: device return timelines, remote wipe procedures, and access revocation steps. Document this in the policy itself rather than leaving it to an undocumented offboarding checklist that may not be consistently applied.

Built by theluckystrike — More at zovo.one