Access Control: Remote Working

October Cyber Security Awareness Month banner emphasizing secure remote access and data protection for schools and trusts

: Tammy Buchanan; Information/Cyber Security; 16 October 2026

Access Control: Remote Working | October 16

Cyber Security Awareness Month has spent the last two days on who has access and how it's controlled inside your school's own walls. But for most schools and trusts today, "inside the walls" is only part of the picture. Staff mark books at home, SLT reply to emails on the train, and admin teams log into finance systems from a kitchen table. Remote working isn't an edge case anymore; it's routine. Which means access control has to work just as hard outside the building as it does inside it.

Your network doesn't end at the school gate

Every laptop taken home, every staff member marking books on the sofa, every admin team member logging in from a kitchen table, each one extends your school's network into a space you don't control. That's not a reason to ban remote working. It's a reason to make sure access control follows the device, not the building.

Securing the network itself

Home Wi-Fi should run WPA2 or WPA3 encryption, with the router's default password changed to something strong and unique.
Always connect through a school-provided VPN when accessing internal systems from outside the premises. It encrypts traffic and stops anyone on the same network from intercepting it.
Where your school has moved to a fully cloud-based, zero-trust setup, a traditional VPN may be less central, but the same principle applies: every connection should be verified and encrypted, not assumed safe because it "looks internal."

Securing the device

School-issued devices come with managed security built in: encryption, antivirus, remote wipe if lost. Use them wherever possible.
If BYOD is genuinely necessary, personal devices still need to meet the same bar: up-to-date operating system, antivirus, and encryption, before they touch school data.
Every device needs a strong password, PIN, or biometric lock, and should be physically secured (locked away, not left out) when not in use at home.

Authentication and access don't change just because the location did

MFA applies to every remote access point, VPN, cloud apps, email, with no exceptions for "just this once from home."
Least privilege still applies: working remotely is not a reason to have broader access than usual.
Work files belong in secure cloud storage or on managed network drives, not saved locally to a personal laptop "to work on later."

Training still matters more than technology

Remote-specific training, recognising phishing away from the usual IT support, knowing how to report an incident without walking down the corridor to the office, closes the gap that technology alone can't.

💡Your Daily Cyber Tip

Lock your screen every time you step away from your desk, home or school, even for a minute (Windows: Win+L, Mac: Ctrl+Cmd+Q). It's the single easiest habit to build and the easiest one to forget.

Where this sits in the DfE Digital Standards

This isn't a grey area in the DfE's guidance, remote and off-site working is addressed directly:

MFA "should be applied to any accounts and cloud-based applications for staff working away from the school or college, or remotely accessing the network" This sits alongside the wider MFA scope expansion covered on Day 14.
A software firewall should be enabled on any device used outside the school or college, including at home or on public Wi-Fi.
A VPN is recommended to encrypt data in transit for devices used off-site.
Remote access itself should be disabled by default and enabled only by authorised school or college staff when it's actually needed, not left switched on permanently "just in case."

InfoSec / Cyber