Telework Guidance and Resources

CISA brings our partners in industry and the federal government together to improve American cyber and infrastructure security. Click on the icons below to find resources designed to help organizations and teleworkers remain secure while working remotely.

Where to start?

• With its personalized modules for executive leaders, IT professionals, and individual teleworkers, the NEW Telework Essentials Toolkit is a great place to begin.
• Watch this video, Telework Essentials to Secure the Hybrid Workplace, featuring experts from CISA, the Cyber Readiness Institute (CRI) and the Global Cyber Alliance (GCA) discuss the best practices to protect workplace solutions during a time of increased telework. 

Telework Reference Materials for the Federal Government

Best practices for agency cybersecurity managers, system administrators, and other technical staff to enhance their Federal Government department and agency's security posture during remote working conditions.

Telework Reference Materials for Non-Federal Organizations

Best practices for system administrators and other technical staff to enhance Critical Infrastructure, industry, schools, as well as State, Local, Tribal, and Territorial (SLTT) government organizational security posture during remote working conditions.

Telework Reference Materials for the At-home Worker

Tips and consideration, as well as cybersecurity best practices, to help employees and non-technical users in a telework environments.

Additional Telework Resources

• CISA released a guide for parents, teachers and school administrators that provides information to prevent or mitigate malicious cyber actors from targeting kindergarten through twelfth grade (K-12) educational institutions, leading to ransomware attacks, theft of data, and the disruption of learning services. Additionally, the FBI (with help from CISA) recently produced a Public Service Announcement, Transition to Distance Learning Creates Opportunities for Cyber Actors to Disrupt Instruction and Steal Data, which also addresses this threat.
• CISA’s newly redesigned ransomware information page will better connect you with helpful resources and tools you and your organization need to guard against the ransomware threat during these times of increased telework. 
• The National Security Agency (NSA) has released two cybersecurity information sheets (CSIs) with best practices to help National Security System (NSS) and Department of Defense (DoD) teleworkers and their systems administrators secure their networks and handle potential compromises. The first focuses on Compromised Personal Network Indicators and Mitigations and the second CSI looks at Performing Out-of-Band Network Management. 
• The Office of Personnel Management should be the government's first stop for telework guidance.
• The National Institute of Standards and Technology’s (NIST) blog, “Preventing Eavesdropping and Protecting Privacy on Virtual Meetings,” addresses security concerns with virtual meetings. 
• The Cyber Readiness Institute has developed a quick guide, “Securing a Remote Workforce” for businesses.
• The National Cyber Security Alliance has launched a COVID-19 Security Resource Library featuring free and updated information on current scams, cyber threats, remote working, disaster relief, and more.
• The Global Cyber Alliance offers three simple tips for working from home.
• NIST has guidelines on telework and remote access to help organizations mitigate security risks associated with the enterprise technologies used for teleworking.
• Cyber.org, whose mission is to bolster K-12 cyber education, in cooperation with CISA's Cybersecurity Defense Education and Training (CDET), has launched a new Cyber Safety Video Series with tips for staying safe online. The first two videos in the series are the on Video Call Safety and Phishing. 

Telework FAQs

Do you have a specific question related to teleworking?  Not sure where to look?  Start here.

What is multi-factor authentication?

“Authentication” is a means for a user to supply information that “authenticates” them to the computer. Passwords are one example of an authentication mechanism. Other examples are fingerprints, retinal scans, and USB tokens. Multi-factor authentication is the practice of requiring more than one authentication mechanism to gain access to a system or device. A CISA Alert on Microsoft Office 365 Security Recommendations allows you to discover other ways to secure your remote office.  

What is Ransomware?

Ransomware is a type of malware threat actors use to infect computers and encrypt computer files until a ransom is paid. A CISA Insights publication on a Ransomware Outbreak and two CISA Security Tips, Protecting Against Ransomware, and Protecting Against Malicious Code, provide detailed analysis of the threat as well as actions you can take to prepare for or recover from a ransomware attack on your system or network. All of these products and many more can be found on CISA’s newly redesigned ransomware information page.

What are High Value Assets (HVAs)?

Information or information system that is so critical to an organization that the loss or corruption of this information or loss of access to the system would have serious impact to the organization’s ability to perform its mission or conduct business. For more information on HVAs, see the CISA Insights publication, Secure High Value Assets. 

What should I do if I cannot patch a vulnerability right away?

Where patching is not possible due to certain limitations, network segregation is highly recommended to limit exposure of the vulnerable system or host. For more information on the threat, recommended actions, and lessons learned, see the CISA Insights publication, Remediate Vulnerabilities for Internet Accessible Systems.  

What is Phishing?

Phishing is the practice of sending emails that purport to be from reputable companies to individuals with the intention of tricking them into revealing personal information, such as social security numbers and credit card information. The CISA Insights publication, Enhance Email & Web Security, provides additional details on the threats and outlines near-term recommended actions to take to mitigate phishing attacks and enhance your web security posture.

What is the ICT Supply Chain?

ICT stands for Information and Communications Technology. The ICT Supply Chain are those systems that enable the provisioning of National Critical Functions (NCFs), and also provide remote access into work environments, e-Learning capabilities, and mobile computing. For more information about how you can help secure the ICT Supply Chain, see the Building Collective Resilience for the ICT Supply Chain blog post, which outlines the steps needed to implement an effective ICT supply chain risk management program.

What is APT?

APT stands for Advanced Persistent Threat. This refers to a stealthy threat actor which gains access to a victim’s network and remains undetected, usually performing reconnaissance stealing data, or installing malware, for an extended period of time. During COVID-19, there has been increased APT activity – especially against healthcare and essential services – due, in part, to the increase in the number of teleworkers. For more information on the COVID-19 related malicious cyber activity threat and how to think about it and defend against it, see the joint publication, COVID-19 Cyber Threat Exploitation, from CISA and our U.K. partners at the National Cyber Security Centre.

What is password spraying?

Password spraying is a style of brute force attack in which the attacker tries a single and commonly used password against many accounts before moving on to try a second password, and so on. For more information on defending yourself against Password Spraying, see the joint publication, COVID-19 Cyber Threat Exploitation, from CISA and our U.K. partners at the National Cyber Security Centre.

What are best practices for creating passwords?

Use long passphrases (at least 8 characters) that you can remember but that would be hard for someone else to guess. You can also substitute special characters or numbers for letters. For example: “H0rs3UsesBlu3Barr3ls." For more tips, download the Creating a Password Tip Card.

Should I use my personal equipment for work?

Review your company’s telework policies to find out if you are permitted to use your personal equipment for work tasks. For more information on how to telework securely –whether using company-provided equipment or your personal equipment – see the latest Telework Best Practices guidance from CISA and our partners at the NSA.   

Is it safe to use public Wi-Fi?

Public Wi-Fi in airports, coffee shops, libraries, restaurants, malls, hotels and other public gathering spaces are not always secure. Before connecting to any public Wi-Fi, be sure to verify with the staff that the network name you are selecting is the legitimate network provided by the business, and that the communications over that hotspot are encrypted. For more tips, download the Best Practices for Using Public Wi-Fi Tip Card.

What is the safest web browser to use?

Regardless of which web browser you use, ensure you enable security settings and disable any unnecessary functionality. Security Tip, Evaluating Your Web Browser's Security Setting, provides addition information on evaluating your web browser’s security posture.

Am I permitted to record my videoconferences?

Before you press the “record” button, make sure all participants are aware that you intend to record the meeting. Also, ensure that the meeting owner knows how to access and secure the recording. Consult with your organizational or in-house counsel regarding laws applicable to recording video conferences. For more security-related tips about videoconferencing, see CISA’s publication, Tips for Video Conferencing.

Is my home router secure “out of the box”?

The short answer: Probably not. At minimum, change the default password to one only you know. For other ways to secure your home network, see the CISA Security Tip on Home Network Security.

What are Firewalls?

Firewalls provide protection against outside cyber attackers by shielding your computer or network from malicious or unnecessary network traffic. Firewalls can also prevent malicious software from accessing a computer or network via the internet. For more information on protecting your home office with a firewall, download the CISA Security Tip, Understanding Firewalls for Home and Small Office Use.