 |
| How to Set Up a Personal Laptop for Work |
Plenty of remote workers use their own laptop for work, either because their employer doesn't provide one or because it's simply more convenient. It's workable, but done carelessly it creates two distinct risks: your employer's data sitting unprotected on a personal machine, and your personal data becoming visible to — or deletable by — your employer. Here's how to set it up properly.
First: Check Your Employer's Policy
This isn't a formality. Many organisations have explicit rules about using personal devices, and some require installing management software as a condition of access. That software can, depending on configuration, enforce security policies, monitor activity, or remotely wipe the device.
Ask specifically: Does the company require device management software? What can it see and do? Can it wipe the whole device or only company data? What happens when I leave?
People are frequently surprised by the answers, and the time to find out is before you install anything — not after a remote wipe takes your personal photos with it.
Create a Separate User Account for Work
This is the single most effective step, and it's free.
Create a second user account on the machine used exclusively for work. Both Windows and macOS support this natively. The benefit is real isolation: separate desktop, separate browser profiles and saved passwords, separate file storage, separate application sign-ins.
What this prevents:
- Accidentally sharing personal files or notifications during screen shares
- Personal browser sessions and passwords mixing with work accounts
- Work files scattering into your personal documents folder
- Confusion about what belongs to whom if you leave the job
What it doesn't prevent: If your employer installs management software with full device access, a separate user account doesn't hide your personal account from it. Account separation is about organisation and accident prevention, not about defeating device management.
If you can't create a separate account, use separate browser profiles at minimum. Every major browser supports multiple profiles with independent cookies, history, and saved logins, and switching between them is a two-click operation.
Turn On Full Disk Encryption
If your laptop leaves the house — or even if it doesn't — disk encryption ensures that someone who physically takes the machine can't simply pull the drive and read everything on it.
- Windows: BitLocker on Pro editions; Device Encryption on many Home edition devices. Check under device security settings.
- macOS: FileVault, in the privacy and security settings.
Turn it on, and store the recovery key somewhere safe that isn't the laptop itself. This is often a hard requirement for accessing company systems anyway.
Use a Password Manager and Turn On MFA
Reusing passwords across work and personal accounts is the single most common way one breach becomes several. A password manager solves this properly by generating and storing unique credentials for everything.
If your employer provides one for work accounts, use it for work and keep a separate personal one. Don't store personal passwords in a company-controlled vault — you lose access to them when you leave.
Enable multi-factor authentication on every account that supports it, starting with your email. Email is the master key: anyone with access to it can reset passwords on nearly everything else. Authenticator apps are meaningfully more secure than SMS codes, which can be intercepted through SIM swapping.
Keep Software Updated — Properly
Most successful attacks exploit vulnerabilities that were patched months earlier. Enable automatic updates for your operating system, browser, and any application you use daily.
The friction is usually the restart, so schedule updates for a time you're not working rather than dismissing the prompt indefinitely. Dismissing it for three weeks is how machines end up badly out of date.
Back Up Your Own Data Separately
Your employer backs up company data. Nobody backs up yours.
Follow the basic principle: keep more than one copy, on more than one type of storage, with at least one copy somewhere other than your home. In practice that usually means an external drive plus a cloud backup service — using your personal cloud account, not a work one.
Test that you can actually restore a file occasionally. An untested backup is a guess.
Recognising Phishing Attempts
Remote workers are targeted deliberately, because you can't lean over and ask a colleague whether an email is real.
Warning signs worth internalising:
- Urgency combined with a request for credentials or payment
- A sender address that's subtly wrong on close inspection
- Links whose destination doesn't match the text (hover before clicking)
- Requests to move the conversation to personal email or messaging
- Anything asking you to bypass normal process because it's urgent and confidential
The rule that actually works: verify through a channel you already trust. If an email claims to be from your manager asking for something unusual, message them on your company chat platform or call them. Never verify using contact details supplied in the suspicious message itself.
Know What Happens When You Leave
Before you're in the middle of resigning, understand:
- Which company data lives on your machine and how to return or remove it
- Whether device management software will be removed, and how
- Whether anything of yours is stored in company accounts that you'll lose access to
Keeping work strictly inside the work user account makes this straightforward. Mixing everything together makes it a genuinely painful afternoon.
Setup Checklist
- Confirm your employer's BYOD policy in writing
- Create a dedicated work user account
- Enable full disk encryption
- Set up a password manager (separate work and personal vaults)
- Enable MFA everywhere, email first
- Turn on automatic updates
- Set up your own independent backup
- Keep work files inside the work account only
This is general guidance. Always follow your employer's IT policies, which take precedence, and consult your IT team before installing or removing management software.