Philippines staffing guide
Set a Remote Workstation Baseline Before Day One
Device state, patching, screen privacy, and account separation are part of the job design, not an afterthought.
The short answer
A remote workstation baseline is a set of testable conditions, not a policy paragraph. Check the device, the account, and the room.
Define the minimum device state
Write the conditions a device must meet before it touches company work: supported operating system, current security patches, disk encryption, screen lock, endpoint protection, and a separate work account. Decide whether the device is company-issued or personally owned, and what the company can inspect. A personally owned device needs a clear boundary between work and personal data.
Test the conditions on a real device rather than assuming the policy was followed. Record the date and the result.
Separate accounts and privileges
The worker should not use a shared admin account for daily work. Give a standard account for routine tasks and a separate, time-bound path for elevated actions. Use a password manager and multifactor authentication.
Do not send passwords through chat or store them in a spreadsheet. If the role handles protected data, restrict local downloads and define where files may be saved. The goal is to reduce the blast radius of a lost device or a mistaken click.
Make the physical workspace part of the check
Remote work introduces risks that a login screen cannot see. Ask about a private space for calls, a locked screen when stepping away, and a plan for confidential documents. For roles that discuss customer or employee data by phone, use a headset and avoid speakerphone in public places.
If the home has unreliable power or internet, plan a backup. These are not perks. They are conditions for handling certain types of work.
Set the evidence and the review
Keep a simple attestation with the device state, the date, and the worker's confirmation. Spot-check a sample each quarter, especially after an operating system upgrade or a role change. Review access at the same time.
A device that passes in January may fail in July if patching stopped. If a check fails, define the safe interim state: no protected data, no live customer channel, or no elevated access until the issue is fixed.
Handle loss and departure
Write the steps for a lost or stolen device: report, revoke sessions, rotate credentials, check recent activity, and document the timeline. For departure, combine the device return with account removal and a review of local files. Do not rely on the worker to delete everything.
Verify the important steps from the company side. A baseline that only covers onboarding is half a control.
Questions to copy for the sales call
- "What device state is required before access is granted?"
- "Which work uses a separate account or elevated path?"
- "Where will confidential calls and documents be handled?"
- "What happens when a device is lost or a worker leaves?"
Sources
- NIST Cybersecurity Framework 2.0: Governance, identity, and risk outcomes. Checked October 22, 2026.
- CISA Cybersecurity Performance Goals: Practical access, logging, and recovery goals. Checked October 22, 2026.
- National Privacy Commission, Philippines: Philippine data privacy regulator. Checked October 22, 2026.
Common questions
Can a personal laptop be used for support work?
Only if the role and the data allow it. Define the minimum device state, separate the work account, and state what the company may inspect.
Is a password manager enough?
No. Use it with multifactor authentication, least privilege, and a review of shared credentials. A manager alone does not fix a shared admin account.
How often should the baseline be checked?
At onboarding, after a material device or role change, and on a periodic sample. Quarterly is a practical starting point for many teams.