The right remote-work setup depends on the work, information, users, locations, devices, applications, support, privacy, and continuity requirements. These seven questions provide a durable decision structure without prescribing one universal product stack.
Publication boundary: This article provides general educational and operational guidance. Publishing it does not mean ITECS or any specialist approved a reader’s organization-specific implementation, measured its results, made a legal or compliance determination, or verified a vendor’s configured capability.
Current as of 2026-08-15
NIST SP 800-46 Rev. 2 covers telework, remote access, and BYOD security. NIST SP 800-207 focuses access decisions on users, assets, and resources rather than implicit trust from network location.
Decision summary
- Define remote workflows before selecting tools.
- Prefer supported devices, strong identity, and resource-focused access.
- Make collaboration, support, privacy, and accessibility usable.
- Test outages, recovery, and the complete work outcome.
Questions one and two: work and devices
What work must happen remotely? Map roles, transactions, handoffs, applications, information, meetings, telephony, printing, peripherals, travel, offline needs, accessibility, and critical periods. Which devices fit? Prefer managed, supported devices; define limited BYOD boundaries for information, support, privacy, and removal.
Questions three and four: identity and access
How should users authenticate? Use strong authentication, account lifecycle, separate administration, recovery, and emergency access. How should resources be reached? Compare direct SaaS, secure remote access, virtual desktops, published applications, and restricted administrative patterns by workload and risk.
Questions five and six: collaboration and support
Which collaboration pattern is authoritative? Define storage, sharing, retention, meetings, approvals, versioning, external guests, and records. How will support work? Set intake, severity, user verification, consent, remote-session privilege, sensitive-information handling, escalation, and vendor responsibility.
Question seven: what happens when something fails?
Test lost devices, identity outage, internet loss, cloud outage, power failure, unavailable staff, compromised credentials, ransomware, and provider disruption. Provide alternate communications and work. Verify containment, protected backups, restoration, reconciliation, and accountable business acceptance.
Next step for your environment
Answer all seven questions for one remote role and test the resulting workflow with representative users, data, support, accessibility, and failure.
Record the accountable owner, baseline, source date, decision, exceptions, acceptance evidence, and review trigger. Test consequential changes in a bounded environment, maintain a rollback path, and verify the real result before closing the work. Product names, availability, pricing, legal requirements, and security guidance can change; recheck the primary sources whenever the decision is renewed or the environment changes.
If you need an independent baseline before changing production systems, start with an ITECS technology and security assessment and keep the resulting evidence with the decision record.
Sources and update trigger
- NIST — SP 800-46 Rev. 2 Telework and Remote Access
- NIST — SP 800-207 Zero Trust Architecture
- NIST — Cybersecurity Framework 2.0
Review trigger: Review after role, workflow, device, identity, application, provider, privacy, accessibility, support, or outage changes.
continue reading
More ITECS blog articles
About ITECS Team
The ITECS team consists of experienced IT professionals dedicated to delivering enterprise-grade technology solutions and insights to businesses in Dallas and beyond.
View full profile and articles