Clean Desk 2.0: How to Secure Your Home Office

Home office security involves more than putting papers away. A secure home office also means locking screens, protecting work devices, replacing unsupported technology and controlling what AI tools can do.

For many businesses, working from home is now normal. But when work moves home, business data moves with it.

That changes what a clean desk really means.

In a traditional office, a clean desk policy was simple:

• Shred sensitive documents such as invoices, quotes and customer records.
• Lock private material in a secure cabinet.
• Never leave passwords where someone can see them.
• Clear sensitive information away when you finish work.

Those habits still matter.

However, today’s desk is also a gateway to email, cloud applications, customer records, financial systems and AI tools.

Clean Desk 2.0 protects both the physical desk and the digital systems connected to it.
Someone who can access your unlocked laptop may not need advanced hacking skills. A few minutes with an active session could give them access to important business systems.

Clean Desk 2.0 at a glance

To improve home office security:

• Lock your screen whenever you step away.
• Keep business devices separate from shared family devices.
• Replace unsupported hardware and software.
• Protect your home router and network.
• Control which systems AI tools can access.
• Store printed business information securely.
• Remove unused devices, accounts and cloud resources.

How can an unlocked screen cause a data breach?

An unlocked work computer can expose business information because the user may already be signed in. Multi-factor authentication protects the sign-in process, but it does not replace good screen-lock habits after access has been granted.

Multi-factor authentication, or MFA, is one of the most important security measures a business can use.

Think of it as an extra lock on the front door.

But what happens after you open that door?

When you sign in to a web application, the browser normally creates an authenticated session. This lets you continue working without entering a password or completing an MFA check after every click.

A session identifier may be held in a browser cookie. This identifier helps the application recognise that you have already signed in.

That convenience also explains why an unattended workstation creates risk.

If somebody uses your unlocked computer while you are still signed in, they may be able to interact with the applications your account can already access.

These could include:

• Microsoft 365
• business email
• CRM systems
• cloud storage
• accounting software
• customer information
• internal business systems
• AI assistants and automated workflows

In some cyberattacks, criminals steal session tokens or cookies and use them to impersonate an authenticated user. This is often called session hijacking or cookie hijacking.

Direct physical access to an unlocked device is different, but the basic lesson is the same: an active session must be protected.

Make screen locking automatic

A secure home-working policy should make screen locking part of everyday behaviour.

• Set an appropriate automatic screen-lock timer.
• Lock your device every time you leave your desk.
• Require a password, PIN or biometric check when you return.
• Never leave an active business session open for another person to use.
• Avoid using shared family computers for business work.
• Report any suspected unauthorised access quickly.

On a Windows computer, press Windows key + L to lock the screen.

On a Mac, press Control + Command + Q.

Treat an unlocked workstation like a set of business keys left in the door.

Is old home-office technology still safe?

A device that still works is not always a device that is still safe. Unsupported routers, laptops, operating systems and applications can create security risks because they may no longer receive security updates.

Old technology often stays in a home office for years.

You may have:
an old router
an unused laptop kept as a backup
software that is no longer supported
older network equipment
forgotten devices that still connect to the network
personal devices that are sometimes used for work

The main problem starts when the manufacturer ends security support.

When a device or application reaches its end-of-support date, the vendor may stop releasing security fixes. New weaknesses can then remain uncorrected.

A device should not pass a security check simply because it still turns on.

Audit your home-office devices

Ask four questions about every device or important application.

1. What do we have?

Create a list of work devices, operating systems, applications, network equipment and important cloud services.

2. Is it still supported?

Check whether the manufacturer still supplies security updates. Look for an official product lifecycle or end-of-support page.

3. Who owns it?

Assign responsibility for maintaining each important device, service or system.

4. Do we still need it?

Remove or securely retire equipment, software and accounts that no longer serve a business purpose.

If unsupported technology must remain in use for a short period, record the risk, restrict its access and create a replacement plan. Treat this as a temporary measure, not a permanent fix.

Secure your router and home-office network

Your home router is an important part of your working environment. It connects local devices to the internet and may sit between your work computer and cloud services.

At a minimum:

• Change the router’s default administrator password.
• Use a long, unique password for the administrator account.
• Install firmware and security updates.
• Use modern Wi-Fi security settings where the router supports them.
• Disable features you do not use.
• Remove unknown or unwanted devices from the network.
• Replace the router when the manufacturer ends support.
• Keep work devices updated and protected, even on a trusted home network.

The goal is simple:

know what connects your home office to business systems and keep those components supported.

Employees should not need to become network engineers. The business or its IT provider should define a clear standard and help workers check whether their setup meets it.

AI agents make clean desk security more important

AI agents can increase the impact of an unattended workstation because they may connect to email, customer records, documents and business workflows. Businesses should therefore limit access and require human approval for sensitive actions.

AI is becoming part of everyday work.

An AI-enabled workflow might:

• draft customer emails
• update CRM records
• prepare documents
• schedule appointments
• organise business information
• summarise meetings
• start an automated process

These tools can save time. They can also change what an unlocked workstation represents.

If an AI tool can take actions through your account, someone sitting at an unlocked computer could change an instruction, approve a request or interfere with a running process.

The answer is not to avoid AI.

The answer is to use AI within clear security and governance boundaries.

Questions to ask before giving an AI agent access

What can it access?

Give the agent access only to the information and systems it needs.

What can it change?

Separate low-risk tasks from actions that could affect customers, business records or money.

What requires human approval?

Require clear approval for sensitive, external, financial or hard-to-reverse actions.

What limits are in place?

Set suitable spending, access and operational limits. Do not give an agent wider permissions simply because it may need them later.

What happens when something goes wrong?

Your team should know how to pause a workflow, withdraw access and report an incident.

Who owns the process?

Every important automated workflow should have a named human owner.
Secure AI principle: Give an AI agent the least access it needs, create approval points for sensitive actions and keep a human accountable for the outcome.

Keep business and personal technology separate

A home office may sit in a shared space. Family members, visitors and personal devices can all be nearby.

That makes separation important.

Where possible:

• Use an approved business device for work.
• Do not allow other people to use your work account.
• Do not share your business password or PIN.
• Keep business documents out of sight.
• Lock laptops, tablets and mobile phones when unattended.
• Store printed information in a secure place.
• Follow company rules for printing, storing and disposing of information.
• Avoid sending business files through personal email or messaging accounts.
• Use approved storage and collaboration services.

The aim is not to turn every home into a high-security office.

It is to make sure that normal activity at home does not expose business information.

Handle printed documents securely

A digital clean desk policy must not ignore paper.

Printed documents can contain:

• customer names and contact details
• financial information
• account details
• employee information
• quotes and invoices
• meeting notes
• handwritten passwords
• commercially sensitive information

Store sensitive papers in a locked drawer or cabinet when you are not using them.

Do not place business documents in ordinary household waste if they contain confidential or personal information.

Use an approved shredder or follow your organisation’s secure disposal process.

Check the desk, printer and nearby surfaces before ending the working day.

Clean up digital clutter too

Clean Desk 2.0 goes beyond physical security.

Businesses often pay for cloud environments, test systems, licences, storage and accounts that nobody actively uses.

That costs money and adds more systems for the team to manage.

A good digital clean-up starts with three questions:

1.What are we using?

2.Who owns it?

3.Do we still need it?

Remove services that no longer have a purpose. Review cloud resources regularly. Shut down suitable non-production systems when they are not required.

Also review:

• inactive user accounts
• unused software licences
• old shared mailboxes
• forgotten cloud storage
• unnecessary administrator access
• duplicate applications
• unused AI tools and integrations
• test systems left connected to live data

Less clutter means fewer systems to secure, update and monitor.

Home office security checklist

Use this checklist before leaving your home workspace.

Lock: Lock your screen whenever you step away.
Clear: Remove sensitive papers and information from view.
Separate: Keep business accounts and devices away from personal use.
Update: Keep laptops, routers, phones and applications supported and patched.
Protect: Store work equipment and documents securely.
Remove: Retire technology, accounts and services you no longer need.
Control: Limit AI agents to the systems and actions they require.
Approve: Require human approval for sensitive AI actions.
Review: Check devices, access rights and cloud services regularly.
Report: Tell the appropriate person quickly if you suspect unauthorised access.

Build a stronger foundation for secure home working

A secure home office combines physical security, device security, access control and sensible working habits.
Home working is no longer a temporary arrangement for many organisations. Businesses should protect home workspaces with the same discipline they apply to the rest of their IT environment.

Clean Desk 2.0 means making a few important habits normal:
Lock the screen. Protect the device. Maintain supported technology. Control access. Use AI safely. Remove what you no longer need.
These steps make everyday mistakes less likely to become serious business security incidents.

Make secure home working the default

A checklist is useful, but lasting protection requires consistent controls across users, devices, identities and cloud services.

IQ in IT can help you review your home-working security, strengthen Microsoft 365 access, manage endpoints and create suitable boundaries for AI-enabled workflows.

Book a security review with IQ in IT to build a practical home-working standard your whole team can follow.

Frequently Asked Questions