Systems, security and tools

Offshore work should follow the same security principles as local work: named access, least privilege, managed devices, strong authentication, documented processes and prompt removal of access when roles change.

Give each person an individual account and only the permissions needed for their responsibilities. Avoid shared credentials because they weaken accountability and make access changes harder to manage.

Maintain an access register, review permissions when roles change and revoke access promptly when employment ends. Plan secure remote access with qualified IT support where systems are not cloud-based.

Provide an approved business password manager and enable multi-factor authentication wherever available. Do not send passwords through ordinary chat or email.

Confirm device configuration, authentication recovery and security awareness with the partner. Train employees to recognise phishing and social-engineering attempts and provide a clear reporting route.

Document who supplies and manages equipment. Depending on risk, controls may include encryption, endpoint protection, automatic updates, restricted local storage, remote management and secure disposal.

For home-based work, address workspace privacy, primary and backup connectivity and the separation of work from personal devices. For office-based work, review physical access, visitor controls and clean-desk practices.

Identify and classify the data the role will use. Minimise access, mask sensitive fields where possible and separate systems or data sets that are not required for the work.

Put appropriate contractual, confidentiality and incident-response arrangements in place. Confirm the privacy, data-transfer and sector obligations that apply in every relevant jurisdiction with qualified advisers.

Document recurring work in one controlled location with an owner and review date. Combine concise written steps with screenshots or short recordings where helpful.

Invite the people doing the work to improve the procedures. Version control and scheduled review prevent old instructions from becoming an invisible source of risk.

Approve specific tools and accounts, define what data may be entered and require appropriate human review of outputs. Consumer and business products may have different privacy, retention and administration settings; assess the actual service being used.

Train employees on acceptable uses, prohibited information, verification and escalation. Review the policy regularly as tools, contracts and risks change.