Remote Work Security Checklist for Small Businesses in Canada

Executive Summary

A Canadian remote work security checklist begins with the task, then the device, connection, surroundings, and response contact. A home office can support confidential work when the household network and physical space are controlled; a café is usually best limited to public or low sensitivity tasks; a coworking desk is conditional on the worker's controls and the venue's answers; a client site requires the client's access rules. This is an editorial decision framework, not a certification of any location. The Canadian Centre for Cyber Security recommends organization owned devices where possible, automatic updates, backups, and access limited to job needs. ^{[1] [2] [3] [4]}

Public Wi-Fi is a conditional risk, not a blanket claim that every session is unsafe. The US Federal Trade Commission notes that widespread website encryption improves safety for ordinary web browsing, while the Canadian Cyber Centre advises avoiding public Wi-Fi for business when possible. A cellular connection or known network can reduce exposure; a virtual private network (VPN) helps only with traffic routed through it and cannot stop a user from opening a malicious link. Check a venue's network name with staff, and keep confidential screens and calls out of open sight and hearing. ^{[5] [6] [7] [8] [9] [10]}

The minimum operating set is named accounts, multifactor authentication (MFA), supported and updated devices, full-disk encryption on portable devices, restorable backups, a short screen lock, least privilege, and a known route for reporting a lost device or suspicious message. NIST recommends full-disk encryption on portable laptops and tablets. ^[11] Get Cyber Safe addresses small businesses directly and recommends a plan covering personal devices; the RCMP's physical-security advice is written for Government of Canada personnel and is adapted here as practical guidance, not a private-sector legal duty. ^{[12] [13] [14] [15] [16]}

The quantitative evidence describes control uptake, not relative safety of venues. In Statistics Canada's 2023 survey of firms with 10 or more employees, 16% reported a cyber security incident; the final sample was 12,462 enterprises with a 71% response rate. Its scope excludes microbusinesses with fewer than ten employees. Neither that survey nor the venue guidance provides a defensible probability that a particular café, home, or coworking space is secure. Use the printable matrix below to approve a specific task and record the compensating control and owner. ^{[17] [18] [19]}

Introduction and Background

A freelancer drafting a public proposal in a café, a startup employee reviewing client records at home, and a consultant joining a private call at a client site face different exposures. The same laptop can be well configured in every setting yet show confidential material to a neighbour, leave papers on a printer, or join a lookalike hotspot. This report compares home, café, coworking, and client site work as operating environments. It answers whether a task should be done there and which conditions must be true first. The Cyber Centre identifies physical access and spoofed Wi-Fi among remote-work concerns, and the Australian Cyber Security Centre advises avoiding sensitive information in public locations. ^[20] (Source: www.cyber.gov.au)

For this guide, public means material approved for anyone to see; internal means ordinary non-public business work; confidential/client means data subject to a customer commitment or meaningful commercial harm if exposed; regulated/high sensitivity means work whose contractual or sector requirements deserve a qualified security and privacy review. These are editorial decision categories, not statutory classifications. A small business should record its own classification and any customer restrictions before picking a workspace. The Canadian Cyber Centre's baseline addresses organizations with fewer than 500 employees, but its advice does not replace a microbusiness's own judgment about higher-consequence information. ^[21]

The checklist separates worker controls, business controls, platform controls, and workspace-provider controls. A venue can supply a room and connectivity; it cannot decide which employee should access a client's file or whether a personal laptop may store it. Get Cyber Safe advises small businesses to set expectations for activity on personal devices, while the Cyber Centre advises limiting access to what each job needs. ^{[22] [4]} Where personal information is involved, obtain appropriate privacy or legal advice for the business and client context; eligible businesses can seek an advisory consultation from the Office of the Privacy Commissioner of Canada. ^[23]

Home Office

Capabilities

A home office usually gives a worker the most control over screen direction, doors, calls, and paper storage. It may be appropriate for confidential work if the business approves the device, the home network is maintained, and other household members cannot see or hear the material. A room with a door is a stronger physical control than merely moving a laptop to a quieter corner. The RCMP recommends positioning remote workspaces to limit outside viewing, and Australian government guidance favours a private location for confidential web meetings. Both sources are government guidance being adapted to a private workplace. ^[24] (Source: www.cyber.gov.au)

For a secure remote work setup, make the home network a deliberate choice. Confirm that the router is supported and configured for current security, that the work device does not share files with household devices, and that guests use a separate network if the equipment allows. The Cyber Centre explains that guest access should not expose the main network and advises separating guest and normal traffic. ^{[25] [26]} A personal hotspot may be preferable when the home network is uncertain, but it still leaves device, account, and physical controls to manage.

Adoption

The practical home checklist is short enough for a sole operator to repeat: use an approved account, confirm MFA, allow system and application updates, verify backup status, close the door for a client call, and put papers away when the work ends. Get Cyber Safe recommends MFA where available; NIST recommends testing backups, not simply assuming that a backup exists. ^{[13] [14] [27]} If a shared household computer cannot meet the business's device and separation rules, use a managed device or move the task. The Cyber Centre prefers corporately owned devices because the organization can control their settings. ^[28]

Strengths and Limitations

Home's strength is control over the room. Its limits are uneven router maintenance, other people in the space, and the possibility that a lost or damaged device also holds the only local copy. The business should maintain a securely stored backup, ideally including an offline recovery copy for critical information, and should know how to reach its support contact. ^[29] A home office is therefore conditionally approved for confidential/client work when those controls are verified. High sensitivity work still needs an explicit client or specialist decision, rather than a generic home-work assumption.

Café and Public Space

Capabilities

A café is useful for work whose content can safely be seen or overheard. It is a poor default for client records, private financial information, sensitive calls, or printing. The Australian Cyber Security Centre specifically advises against accessing sensitive information in public locations. Get Cyber Safe warns about someone viewing a screen over the worker's shoulder. (Source: www.cyber.gov.au) ^[10] A privacy filter and careful seating reduce casual observation but do not make a live confidential conversation private.

Public Wi-Fi deserves a precise answer. The FTC says encryption on modern websites means public Wi-Fi is usually safe for ordinary web browsing, while the Cyber Centre recommends avoiding it for business where possible. These statements are compatible: transport encryption mitigates one network risk, but a business still has to assess spoofed networks, exposed devices, application security, and task sensitivity. ^{[5] [6]} A malicious hotspot can imitate a café's network name, so ask staff for the exact network name and turn off automatic joining of unknown networks. ^{[20] [10]}

Adoption

For public or low sensitivity work, use a supported device, MFA, a locked screen when stepping away, and a known encrypted service. If the business requires VPN access, connect it before using business resources and confirm it remains active. The Cyber Centre says VPN security depends on configuration and consistent use, and the UK National Cyber Security Centre notes that only traffic routed through the VPN gains its protection. ^[8] When uncertain about a hotspot, switch to cellular data or defer the task.

Keep the device with the worker or lock it away when it cannot be supervised. A cable lock can add friction but is not permission to leave client data unattended. University of British Columbia guidance suggests a cable lock in shared or public spaces, while UK guidance recommends carrying or locking away an unsupervised device. ^{[30] [31]} Avoid speakerphone calls, sensitive printouts, and visible notes. A public-space session should have a clear end: close the application, collect belongings, and confirm the device reconnects only to an intended network.

Strengths and Limitations

A café's strength is convenience for public or low sensitivity tasks. Its limitation is lack of control over neighbouring people, network administration, and confidential conversations. The rule is not approved for confidential/client or high sensitivity work unless a specific exception has been reviewed and compensating controls genuinely address every exposure. A VPN cannot stop phishing or shoulder surfing. ^[10] For most microbusinesses, deferring a sensitive task is cheaper and easier than trying to engineer a private room inside an open café.

Coworking Space

Capabilities

Coworking can offer desks, meeting rooms, and a support contact, but availability varies by site and membership. The security decision should distinguish an open desk from a bookable private room, and both from the business's own account and device controls. The RCMP's shared-space guidance recommends meeting or quiet rooms when a conversation needs privacy, separate Wi-Fi for visitors and shared-space users, and a central point of contact for security concerns. Its intended government setting should be disclosed when adapting those questions to a commercial venue. ^{[32] [33] [34]}

Ask a provider whether guest and member traffic are separated, whether devices on the same wireless network can communicate with one another, who handles network problems, and how a worker can report a physical concern. These are questions, not claims that a particular venue has those controls. The Cyber Centre recommends restricting guest devices from interacting with primary-network devices; that principle makes separation an appropriate provider question. Ask whether a private room is available for a confidential call and whether printing uses a release code or immediate pickup. Ontario's public-sector standard calls for prompt retrieval of printed documents, a useful practical control to adapt without presenting it as a duty for private coworking users. ^[35]

Adoption

A member should verify the intended network name, apply the company's device and MFA rules, position the screen, and decide where papers will go at the end of the session. The worker, not the venue, decides whether a file may be downloaded to a personal device. The Cyber Centre recommends defining which data classes can be accessed or stored on bring-your-own-device (BYOD) equipment. ^[36] Before a sensitive meeting, use a room whose door and audio conditions have actually been checked. Do not assume that a phone booth, shared room, or alarm system controls network traffic.

Strengths and Limitations

A coworking space can be conditionally approved for internal work and, after specific verification, confidential work. The extra value is a possible private room and a place to ask operational questions; neither makes the venue automatically secure. For example, 2727 Coworking advertises hot desks, dedicated desks, private offices, and gigabit internet in Montreal, with a hot desk listed from $300 per month as of October 2026. Its published pages do not establish network segmentation, device isolation, or an incident contact for a customer's data; a user should ask the operator directly before approving confidential work. ^{[37] [38] [39]} The business still owns access permissions, backup, and incident response. ^[40]

Client Site

Capabilities

At a client's premises, the client controls some physical and network conditions, but the visiting business remains responsible for its own device, accounts, and handling of its copies of information. A client may supply a desk, guest network, printer, or meeting room. Treat each as unverified until the client explains permitted use. The Cyber Centre's baseline says visitor Wi-Fi should be separate from internal resources, and the RCMP's shared-space advice supports a clear reporting contact and private conversation space. ^{[34] [32]}

The initial question is which party's rules govern the task. A visiting consultant should get the client's approved connection method and confirm whether local downloading, personal devices, or printing is permitted. The Cyber Centre's BYOD guidance recommends specifying what data may be accessed, developed, or stored on personal devices. ^[36] If the client provides a workstation, do not assume it can be used for the visitor's other customers. Use distinct accounts and only the permissions required for the assignment, consistent with NIST's account guidance. ^[41]

Adoption

Before beginning, confirm the host contact, authorized network, meeting room, file transfer method, and paper disposal route. Keep devices and documents in sight during travel; RCMP guidance says sensitive information or assets should not be left unattended in transit. ^[42] For video calls, share the needed application rather than the entire desktop when possible, as the Australian Cyber Security Centre advises. (Source: www.cyber.gov.au) At departure, collect printed pages and notes, sign out of a borrowed station, and record any unresolved access or document issue.

Strengths and Limitations

The client's site may be the only approved environment for some regulated or high sensitivity work, but being on site does not automatically authorize every workflow. The client may forbid a personal laptop, require its own isolated environment, or restrict what can leave the premises. The business should seek explicit project instructions and qualified security review when the information category is high consequence. A visiting worker should never infer a legal permission from the presence of a network port or printer. The practical decision is conditional on client authorization and documented controls.

Feature Comparison

Table 1 is a printable task-to-location matrix. “Conditional” means the listed control must be checked for the specific task; it is not a risk score. Each row assumes an approved account, MFA, a supported device, backup, and a reporting contact. The assessments are this report's operational synthesis of Canadian cyber guidance, physical-security guidance, and the public-Wi-Fi distinction above. ^{[13] [16] [5]}

The matrix should be filled in for a specific task, not used as a one-time badge for a venue. A confidential call may be acceptable in a private coworking room while the same information should not appear on an open desk. The table's “not approved” designation is a conservative editorial default for microbusinesses, not a statement that a provider's facility has failed a test. If the client imposes tighter instructions, those instructions govern the work.

Table 2 allocates control ownership. A venue's physical amenities cannot replace decisions about account permissions, backups, or data classification. Get Cyber Safe calls for a business cyber plan, and the Cyber Centre says employees should know whom to contact when a device is lost. ^[12]

The business owns the final approval decision because it understands the data and customer obligations. The platform controls only the service it supplies, and the workspace provider controls only its facilities and network. A sole proprietor may fill both worker and business columns, but should still make each decision explicitly.

Table 3 is a provider-question sheet. Record the answer, date, and name of the person who gave it before relying on the venue for sensitive work. The questions follow the Cyber Centre's guest-network guidance and the RCMP's shared-space recommendations, adapted to a commercial workspace. ^{[33] [34]}

A yes is meaningful only if the answer addresses the actual workflow. “We have Wi-Fi” does not explain network separation; “we have meeting rooms” does not confirm that a room is available for a particular call. Record uncertainty as a reason to use a simpler task or a different location.

Performance and Benchmarks

There is no credible, comparable public benchmark in the fetched sources that assigns a probability of compromise to a home office, café, coworking desk, or client site. The available guidance identifies controls and exposures, so this report uses decision gates, not a fabricated location score. A VPN can protect traffic routed through it, but the Cyber Centre says it does not protect against clicking malicious links. ^[8] A private office improves the audio and screen situation only if the worker actually uses it, while a properly isolated network addresses a different pathway. ^[32]

The nearest measurable benchmarks concern program readiness. The Cyber Centre prioritizes four starting areas for small and medium organizations: incident response planning, patching, strong authentication, and backup with encryption. ^[44] The federal CyberSecure Canada information sheet describes a voluntary program based on 13 controls. ^[45] Neither measure certifies that a particular café or coworking venue is suitable for client records. A small team can use the categories as a checklist and then test its own operational capability: can a device be locked or recovered, can a backup be restored, and can an account be disabled promptly? NIST expressly recommends testing backups. ^[14]

This distinction matters when comparing home versus coworking security. A home office may offer better control over bystanders but weaker provider support; a coworking site may offer a private room yet require extra checks about shared network and printing. The answer changes with the task and the controls in place. The report's matrix therefore records approval, compensating control, and owner, rather than a universal winner.

Data Analysis and Evidence

The available Canadian data describe business cyber practices, not venue safety. Statistics Canada's 2023 Canadian Survey of Cyber Security and Cybercrime covered enterprises with 10 or more employees, so it does not directly measure freelancers or the smallest Montreal startups. Its final sample was 12,462 with a 71% response rate. About 16% of surveyed businesses reported being impacted by a cyber security incident; 26% reported written cyber policies, and 22% reported formal training for non-IT employees. These figures are useful context for why a short documented plan matters, but they cannot rank a café against a home office. ^{[19] [18] [17] [46] [47]}

CIRA's 2022 cybersecurity survey gathered 500 online responses from Canadian cyber decision makers. 55% characterized their organization as more vulnerable because employees worked remotely. That is a perception among respondents, not a measured venue-specific incident rate. CIRA's 2025 survey, also based on 500 decision makers, reported 98% of respondents' organizations providing cyber training. The CIRA series and Statistics Canada survey use different populations and question wording, so their training figures are not a trend line or a contradiction. ^{[48] [49] [50]}

A 2024 Business Development Bank of Canada poll reported that 11% of responding small businesses had a formal cyber incident response plan, while others described an informal plan or none. The poll is a directional indicator, not a probability for any one firm. ^[51] The Office of the Privacy Commissioner of Canada's 2025 to 2026 business survey reported 65% using MFA and 55% using encryption for customer personal information. These survey measures show uneven reported control adoption, but the populations and methods differ. They support asking whether a specific organization has implemented a control rather than assuming it has. ^[52]

For an individual microbusiness, the most actionable quantitative measure is completion of the local checklist, not a borrowed national percentage. Record whether each required control is present, when it was last checked, and who owns the gap. If a high sensitivity task fails even one required gate, move it or seek specialist review. The Cyber Centre's backup guidance describes multiple copies, including an offline copy, and NIST recommends a restore test. These are concrete checks a small business can perform without inventing a risk score. ^{[29] [14]}

Implications and Future Directions

A ten-minute pre-work check

The following is a yes/no checklist for a session. A “no” means resolve the item, lower the task sensitivity, or change location. Ten minutes is a practical target for reviewing a prepared setup, not a claim that a new security program can be installed in ten minutes.

• Task: Is the information classified as public, internal, confidential/client, or high sensitivity, and is this location allowed?
• Client rule: Have any contract or project instructions about device, network, room, or printing been checked?
• Account: Is the worker using an individual approved account with MFA where available? ^[53]
• Permissions: Is access limited to the files needed for this task?
• Device: Is the device approved, supported, updated, set for full-disk encryption, and set to lock when unattended? ^{[28] [11]}
• BYOD: If it is personal, are the allowed data classes and removal method written down? ^{[36] [54]}
• Network: Is the actual network name verified, and is a cellular or other approved fallback available? ^[10]
• VPN: If required, is it active for the intended traffic, with its limitations understood? ^[8]
• Screen: Can someone nearby see the display, whiteboard, notes, or notifications? ^[10]
• Audio: Is a private room available for a confidential call? (Source: www.cyber.gov.au)
• Paper: Will printouts be collected immediately and stored or disposed of properly? ^[35]
• Storage: Is the approved file location available, with a recent recoverable backup? ^[14]
• Response: Does the worker know whom to contact about loss, phishing, or a venue problem? ^[34]

Lost device or suspected phishing response card

Keep this card with the work instructions, separate from the device. It assigns immediate actions, not a complete forensic procedure.

• Lost device: Report the loss to the business contact immediately; give the last known location, device identity, and whether it held local client files. UK guidance calls for immediate helpdesk contact. ^[55]
• Protect access: Ask the account administrator to revoke sessions, rotate relevant credentials, and consider a preconfigured remote wipe or business-data container. The Privacy Commissioner describes a container that an organization can erase after a personal device is lost or stolen; it does not promise wiping will work while a device is offline. ^[54]
• Suspicious request: Do not follow the message's call-back details. Verify with a known number or previously trusted channel. ^[56]
• Possible click or credential entry: Contact the business lead; change compromised passwords and isolate a device suspected of malware according to the business procedure. ^[57]
• Preserve context: Keep the suspicious email or text and relevant timestamps for the responder; the Canadian Anti-Fraud Centre advises preserving message copies and offers online reporting for fraud or cybercrime. ^{[58] [59]}

A small business should rehearse who receives the call and who can disable accounts. The Cyber Centre's remote-work guidance explicitly says workers should know whom to contact after a security issue or device loss. If personal information may be involved, seek appropriate privacy or legal advice for the facts and jurisdiction; the Privacy Commissioner has an advisory service for eligible businesses. ^[23]

Frequently Asked Questions (FAQs)

Is it safe to work from a café on public Wi-Fi?

For public or low sensitivity browsing, often yes when the website connection is encrypted and the device is maintained; the FTC specifically cautions against treating all public Wi-Fi as automatically unsafe. For confidential business work, the Cyber Centre advises avoiding public Wi-Fi where possible, and the open room adds screen and audio exposure. Verify the hotspot name, use a business-approved connection, and move sensitive calls and records to a private setting. ^{[5] [10]} (Source: www.cyber.gov.au)

What should a Canadian microbusiness put in its remote work cybersecurity checklist?

At minimum: task classification; approved account and MFA; supported and updated device; clear BYOD rules; known network; private screen and calls; controlled paper; restorable backup; limited permissions; and a reporting contact. This sequence combines Get Cyber Safe's small-business planning advice with the Cyber Centre's technical and response controls. ^{[12] [13]}

Is a coworking space more secure than a home office?

Neither setting wins automatically. The home worker may control the room and household network, while a coworking provider may offer a private room and a support contact. Ask about the actual network separation and room conditions, then approve the specific task in the matrix. RCMP shared-space guidance makes network separation and privacy rooms sensible questions; it is government guidance adapted to this commercial decision. ^{[33] [32] [16]}

Can a VPN make client work safe anywhere?

No. A VPN covers only traffic routed through it and does not stop a malicious link, someone viewing a screen, or an audible conversation. Use it when the business requires it, alongside MFA, device security, and a suitable room. ^[8] (Source: www.cyber.gov.au)

Conclusion

The useful unit of approval is a task at a particular location under verified controls. Home can support confidential work when the room, network, device, backup, and response route are controlled. A café usually suits public or low sensitivity work. Coworking can be suitable for more sensitive tasks after questions about network separation, private rooms, paper handling, and support receive usable answers. A client site requires the client's own authorization and workflow rules.

For a small Canadian business, the starting point is an approved device, individual account, MFA, updates, least privilege, backup that can be restored, and a named response contact. The worker then checks network identity and physical exposure before each session. A venue supplies part of the setting; the business supplies the decision about information and access. Use the matrix and yes/no card as living operating documents, and escalate high sensitivity or personal-information questions for qualified review. The aim is a repeatable approval process that a freelancer or small team can actually carry out.