VPN remote work is the setup where the person at home reaches the office's systems through an encrypted tunnel, and for the owner or office manager who has been handed security it is usually bought before anyone has written down who may work remotely, from which devices, on which networks. The VPN protects the traffic between the laptop and the office; it does not protect the laptop, the home wifi's other devices or the sign-in that opened the tunnel. The phone number used for MFA is the second factor most small organisations start with, and its weak point is that a phone number can be moved to another phone by someone persuasive. This page is about the two and the policy that decides them, and the free policy sheet on this site sizes the written set the remote-work policy belongs to, with no account.
What the VPN protects
The traffic: nobody on the coffee shop's wifi reads what passes through the tunnel. What it does not protect: a laptop with no protection agent, a personal device the organisation cannot wipe, a password typed into a phishing page, and everything the person can reach once the tunnel is open. CISA's small-business guidance covers the controls around the VPN, not just the VPN.
The phone number used for MFA and its weak point
A code texted to a phone number is better than a password alone and worse than an app or a hardware key, because the number can be transferred by someone who talks the carrier into it. The sign-in policy says which factor the organisation requires and for which accounts; the answer for the email account and the accounting package is not a phone number.
The remote-work policy decides both
Who may work remotely, from which devices, on which networks, through what tunnel, with which second factor, and what happens when the device is lost. The policy sheet on this site adds the remote-work policy when anyone works away: 12 people, 8 systems with their own login, remote work, card payments and personal devices is a set of nine policies, 27 hours to draft, 13.5 hours a year to keep reviewed and $1,822.50 in the first year at $45 an hour on the worked example. Hardenvo Pro writes it from the organisation's facts and keeps it current at one flat price.
Questions people ask about vpn remote work
What does a VPN protect for remote work?
The traffic between the laptop and the office; not the laptop, the home network or the sign-in that opened the tunnel.
Is a phone as the second factor good enough?
Better than a password alone, weaker than an app or a hardware key, because the number can be moved; the sign-in policy says which factor for which account.
Where do the remote-work rules live?
In the remote-work policy, added to the set when anyone works away; the free policy sheet sizes it and Hardenvo Pro writes it.