Securing Company Laptops at Home: What Every Practice Manager Should Know
A staff member steps away from their home office laptop to answer the door. The screen is on, the browser is open to your practice management system, and the laptop is unlocked. Nobody is watching. In an office, that moment is low-risk. At home, the variables are different - shared households, visitors, neighbours, open windows. The laptop is the same. The environment is not.
Working from home changes the environment around a device, even when the device itself is well set up. In an office there are natural limits: fewer people around, consistent networks, a shared sense of professional space. At home, that same laptop ends up on kitchen benches, shared with family members, and connected to Wi-Fi that was configured years ago and never touched since. None of that is careless - it is just how homes work. But it creates real exposure for your business and the client data you hold.
The risks are not abstract. A laptop left logged in and unattended can be accessed by someone who did not mean any harm. A family member borrowing a work device for five minutes can accidentally install a browser extension or click a link that creates a problem your IT support team then has to untangle. Home Wi-Fi running on default settings or outdated firmware is a weaker connection than most business owners realise. And when staff access your systems remotely from a device that has not been properly maintained, you are extending the boundaries of your network into spaces you cannot see or control. Under the NZ Privacy Act 2020, the obligation to protect personal information does not stop at the office door.
When remote work is set up properly, none of this has to be complicated. Laptops should lock automatically after a short period of inactivity, and staff should get into the habit of locking them manually whenever they step away. Work devices stay work devices - not shared with family, not used for personal browsing, not left on the couch or in the car. Screen locks, strong passphrases, and multifactor authentication - where a second confirmation step is required at login - become the default rather than something IT has to chase people about. Security updates get applied promptly, because most attacks exploit problems that have already been fixed in an available update. Work files stay in approved systems, not personal cloud storage or email accounts. Home Wi-Fi gets a strong password and modern encryption settings. When all of that is in place and consistent, working from home carries manageable risk rather than unnecessary exposure.
The practical challenge is turning these basics into something your whole team follows without a constant reminder. That means clear expectations, devices configured correctly before they leave the office, and someone checking that protections are actually in place rather than assuming. It also means having a plan for when something does go wrong - who gets contacted, what gets isolated, and how quickly your team can respond. If a genuine incident occurs, CERT NZ is the right first contact for guidance and reporting.
For Canterbury practices managing client data across a remote or hybrid team, getting the security basics right is worth doing once and doing properly rather than patching gaps after something goes wrong.
ITstuffed works with professional services businesses across Canterbury to make sure remote work is set up securely from the start. A 15-minute IT Fit Check is a good place to find out where your current setup stands.