When staff work remotely, the IT security of a Swiss small or medium-sized enterprise (SME) rests on clear rules for devices, access, accounts and data. The Federal Office for Cybersecurity (FOCS) lists securing remote access among its six basic technical measures. It adds organisational measures, such as multi-factor authentication and staff awareness.
These rules build on the cybersecurity basics for SMEs, which also apply in the office. This page deals only with remote work.
The need is real. According to the SME Cybersecurity Study 2026, published on 22 October 2026, 6% of Swiss SMEs suffered a serious cyberattack in three years.
Key figures
- 6% of Swiss SMEs suffered a serious cyberattack in three years, and up to 16% of those with at least ten employees.
- Phishing, password theft, malware and attacks on networks and servers each play a role in about a third of incidents.
- More than 80% of SMEs install updates, and nine out of ten make backups.
- Only a quarter of SMEs regularly test restoring their backups.
- Only about a third regularly train their staff or keep an inventory of their IT systems.
Why does remote work change IT security?
According to the FOCS, cyberattacks come through staff, but also often through insufficiently protected IT systems.
The attacks experienced by Swiss SMEs are varied. In the 2026 study, phishing, password theft, malware and attacks on networks and servers each play a role in about a third of incidents.
Our analysis: remote work affects all four of these routes at once. Employees read their emails alone, connect from another network and use a device that the company no longer sees every day.
What rules for devices used remotely?
The first rule is to know which devices leave the company. The FOCS puts taking stock of the information and communication technology (ICT) environment at the top of its technical measures. This means knowing which devices, software and services the company uses.
Next come three steps that the office also lists among its technical measures:
- install security updates;
- use antivirus software and firewalls;
- back up data.
More than 80% install updates, according to the 2026 study. But only about a third keep an inventory of their IT systems.
A dated example: on 21 October 2026, the FOCS called for the immediate installation of patches for two critical vulnerabilities in PHP, a programming language for the web. It recommended also checking applications and devices that incorporate PHP. Our analysis: without an inventory, an SME does not know which remote workstations and tools to check.
How to secure remote access and the network?
The FOCS cites two measures that directly concern remote work: securing remote access and segmenting networks. Segmentation aims to prevent an intrusion from spreading to the whole system.
Nicolas Mayencourt, founder of the Bern-based company Dreamlab Technologies, recommends two-factor authentication for sensitive systems. In his view, these basic precautions prevent attackers from moving freely through the network.
Our analysis: for an SME, the rule boils down to this. A computer hacked at home should only open the systems its user needs. The FOCS basic protection page does not detail the technique to use to achieve this.
What rules for accounts and passwords?
Accounts are the most exposed point when the team connects from outside. Among its organisational measures, the FOCS lists the use of secure passwords and multi-factor authentication.
On 19 October 2026, the FOCS published "Five steps to secure authentication". In it, the office reviews the password, the passkey and the smart card. It proposes ranking authentication methods according to the security they offer.
Multi-factor authentication is already common in Swiss SMEs, according to the 2026 study. Our analysis: the useful rule is to require it for every remote access, starting with email and sensitive systems.
Access rights matter as much as passwords. In our article on fake IT worker networks, we highlighted a good practice: give a new remote employee only the rights they need.
How to protect data outside the office?
The FOCS calls for rules on handling sensitive information and data. In remote work, this rule covers files taken away, online tools and artificial intelligence (AI) services.
On 16 October 2026, the FOCS pointed to a specific risk. Carelessly entering personal, confidential or business information into an AI can lead to excessive data sharing.
Backups complete this set-up. Nine out of ten SMEs make them, but only a quarter regularly test restoring them, according to the 2026 study. Nicolas Mayencourt recommends regular backups kept offline.
The FOCS also calls for clear responsibilities for the cloud and outsourced IT. Our analysis: when the team works remotely, the company must know which provider holds which data.
How to prepare a remote team for phishing?
Staff play a decisive day-to-day role in information security, the FOCS stresses. The office recommends raising their awareness and encouraging a culture of reporting. It also advises caution with emails and protecting e-banking.
Scams change fast. On 20 October 2026, the FOCS described a new phishing variant linked to fake hotel bookings. The fraudsters sought to take control of TWINT and e-banking accounts.
This area remains the weakest in SMEs. Only about a third regularly train their staff, according to the 2026 study. Our analysis: at a distance, a culture of reporting requires a contact known to everyone, who can be reached quickly in the event of a suspicious message.
Hiring remotely: what security risks?
Remote work also opens up a risk at the hiring stage. A dated example: in October 2026, the US justice system announced the indictment of 14 people in networks of North Korean IT workers employed remotely.
According to prosecutors, these fake employees used stolen identities and virtual private networks (VPNs) to appear to be based in the United States. More than 70 employers are affected. The charges have yet to be proven in court.
No Swiss company is among the employers named. Our analysis, drawn from this case, identifies a few warning signs for an SME hiring remotely:
- an IP address does not prove where the user lives;
- identity should be verified beyond the documents sent, for example through a video interview;
- a delivery address for equipment that differs from the declared home address deserves a question;
- a remote control tool or a KVM switch, which controls several machines remotely, should be examined;
- a salary paid into a third party's account should raise the alarm.
What rules to write into a remote work policy?
A remote work policy can adopt the FOCS measures, area by area. The table brings them together.
| Area | Rule to set | Reference measure |
|---|---|---|
| Devices | Inventory each workstation, keep it up to date, equip it with antivirus software and a firewall | FOCS technical measures |
| Network | Secure remote access and segment the company network | FOCS technical measures |
| Access and accounts | Secure passwords, multi-factor authentication, rights limited to what is necessary | FOCS organisational measures |
| Data | Set rules for handling sensitive data, back up and test restoration | FOCS measures and 2026 study |
| Staff | Train on phishing and designate who to report an incident to | FOCS organisational measures |
Who should set these rules in the SME?
Management, says the FOCS. For the office, cybersecurity is not simply a task for the IT department, but a core responsibility of management.
When a measure is expensive or requires a lot of staff, the FOCS recommends weighing up the interests. This compares the cost of the measure with the risk of changing nothing. The 2026 study also notes that more SMEs are appointing someone responsible for cybersecurity.
Several tools help gauge your starting point. The free SME cybersecurity test, the Cybersecurity-Check, takes a few minutes. The Confederation's ICT minimum standard serves as a checklist. The Cyber Safe label adds verification by an auditor. Other pages can be found in our section on protecting your business.
What we don't know yet
The share of Swiss SMEs that have set written rules for remote work is not known. Nor is it known whether the attacks recorded by the 2026 study more often targeted remote employees.
The FOCS basic protection does not provide a separate rule for working from home. Nor does it settle the case of personal devices used for work.
