You want the best remote work tools for small teams without a messy, risky setup. Choose a short, approved set covering collaboration, video calls and backups, then protect every sign-in with multifactor authentication.
This guide is part of our wider look at technology in business, where tools are judged by the work they support and the risks they add.
| Item | Value |
|---|---|
| Date of the Nextgov report on CISA’s telework guide | October 2, 2020 |
| Parts in the guide, by audience | 3 |
| Focus areas for executive leaders | 4 |
| Tips for remote employees | 4 |
| Suggestions for IT managers | 6 |
These figures come from Nextgov’s report on the guide and from CISA’s telework page. Guidance gets revised, so check the source before you rely on any of them.
Start with categories, not brands
The public guidance behind this article does not rank products. It focuses on how a team chooses and secures its tools, which is the part that stays useful when apps come and go.
CISA describes its Telework Essentials Toolkit as having personalized modules for executive leaders, IT professionals, and individual teleworkers, and calls it a great place to begin. In a small team, one or two people often cover all three roles, so it helps to read every module.
One caution: CISA’s telework page carries an archive notice saying the archive may contain outdated information that does not reflect current policy or programs. Treat it as background reading and confirm details with the live source.
A practical small-team stack usually covers these categories:
- Collaboration and messaging, so work does not scatter across personal inboxes.
- Video conferencing for meetings and one-to-one calls.
- Secure sign-in, with more than one proof of identity.
- Email protection against phishing and impersonation.
- Backups that survive a lost laptop or a ransomware attack.
Collaboration and video tools: keep the list short
Among its recommendations for IT managers, the CISA guide, as reported by Nextgov in October 2020, says to maintain a list of organizationally approved products, including collaboration tools and teleconferencing applications. For a small team, that can be a single page that everyone can find.
The same guidance asks IT managers to make sure hardware and software inventories include new items added because of teleworking. That way patching and vulnerability management stay effective, and nobody is running a forgotten app.
Video calls deserve their own check. CISA’s page points to a NIST blog, “Preventing Eavesdropping and Protecting Privacy on Virtual Meetings,” which addresses security concerns with virtual meetings.
Before you add any tool to the approved list, ask a few plain questions:
- Does it support multifactor authentication for every account?
- Who can see the files and recordings it stores?
- Does it replace an existing tool, or just duplicate one?
- Who on the team is responsible for removing access when someone leaves?
Sign-in and email: multifactor authentication first
CISA’s FAQ explains that multi-factor authentication is the practice of requiring more than one authentication mechanism to gain access to a system or device. Passwords are one example of a mechanism, and fingerprints and USB tokens are others.
The Nextgov report lists enforcing multifactor authentication for remote access to organizational systems and services among the IT manager suggestions. It is also the cheapest control to switch on across a chat tool, a file store and a video platform.
Email is the other weak point. The guide recommends a DMARC validation system, short for Domain-Based Message Authentication, Reporting and Conformance, to address the increased risk of phishing and business email compromise in remote working environments.
If you want a broader checklist beyond these remote-specific points, our guide to cybersecurity for small business covers the wider picture.
Backups and continuity for a distributed team
The same IT manager list says to perform frequent backups of the organization’s systems and important files, verify backups regularly, and store backups offline and offsite. A backup nobody has tested is a hope, not a plan.
CISA defines ransomware as a type of malware threat actors use to infect computers and encrypt computer files until a ransom is paid. Good backups are what let a small team recover without negotiating.
Sometimes a fix cannot be applied straight away. CISA’s FAQ says that where patching is not possible due to certain limitations, network segregation is highly recommended to limit exposure of the vulnerable system or host.
Backups are one piece of keeping the business running when something fails. If you are mapping the rest, read about what is a business continuity plan and how it ties tools to recovery steps.
What each person on the team should do
The Nextgov report says the guide is split by audience, so each person gets a short list. For employees working from home, it offers these tips:
- Make sure your home network is properly configured and hardened.
- Follow secure practices and organizational policies when handling sensitive data.
- Use caution when opening email attachments and clicking links in email.
- Report suspicious activity to your organization’s IT security team.
For leaders, the focus areas are about policy and culture rather than software:
- Review and update organizational policies and procedures.
- Implement cybersecurity training requirements.
- Determine the risks of moving assets beyond the traditional perimeter, such as printing from home and use of personal email and devices.
- Create a hybrid culture of remote and on-premise employees.
For further reading, CISA’s page lists NIST guidelines on telework and remote access, a Cyber Readiness Institute quick guide called “Securing a Remote Workforce,” and three simple work-from-home tips from the Global Cyber Alliance.
Frequently asked questions
Do small teams need many tools?
Show answer
No. The guidance points toward a maintained list of approved products, including collaboration tools and teleconferencing applications, rather than a long stack. Fewer tools mean fewer accounts to secure.
Which brand is the best?
Show answer
The sources used here do not rank brands, so this guide does not either. Judge any product against your approved-list questions, such as multifactor support and where files are stored.
What is multifactor authentication?
Show answer
It means requiring more than one authentication mechanism to access a system or device, according to CISA’s telework FAQ. A password plus a fingerprint or USB token is an example.
Is the CISA telework guidance still up to date?
Show answer
The Nextgov report is dated October 2, 2020, and CISA’s page carries an archive notice about possibly outdated information. Use them as a starting point and check the live CISA resources for current details.
What if a vulnerability cannot be patched right away?
Show answer
CISA’s FAQ recommends network segregation where patching is not possible, to limit exposure of the vulnerable system or host.
