A field-team baseline
- Know which people and devices can reach customer, scheduling and payment systems.
- Protect accounts with MFA and define an offline-data rule before devices leave the office.
- Be able to revoke a lost device or departing contractor without relying on that person.
- Test one real field workflow on limited connectivity before rolling out a new tool.
Last updated: September 24, 2026
A mobile workforce includes technicians, salespeople, delivery staff and contractors who handle work from vehicles, customer sites and personal devices. The security question is not whether everyone uses a VPN. It is which systems and data can be reached from each device, and how quickly access can be removed. NIST's telework and BYOD guide covers the device, access path and resources together. The broader remote-work guide covers office-to-home access; this page concentrates on field operations.
Decide what a field device may hold
List the apps used away from the office: work orders, maps, photos, CRM, invoices and payment links. For each, decide whether information may be downloaded, cached for offline use or shared to a personal app. Set a retention and removal process for photos and customer documents. If a personal device cannot keep business data separate or be safely revoked, restrict it to low-risk browser access or provide a managed device.
| Field situation | Minimum decision | Test |
|---|---|---|
| Lost company phone | Who can revoke app sessions and locate or erase business data? | Run a controlled lost-device drill |
| Personal phone leaves the team | Which business accounts and cached files remain? | Sample offboarding, including connected apps |
| No signal at a customer site | What can be accessed offline and later synced? | Work through a real job with limited connectivity |
| Shared tablet or kiosk | Can one worker see another's customer records? | Test sign-out and role separation |
| Contractor access | Who sponsors it and when does it expire? | Verify expiry and removal |
Put identity and device rules in place
Require named accounts and MFA for field apps and administration. Configure supported-device updates, screen lock and disk encryption on company equipment. Keep recovery under business control so a lost phone does not lock out the only administrator. Review location and remote-wipe policy with staff before enrollment; the business should explain what it can see or remove. CISA's SMB MFA guidance covers email, file storage, remote access and privileged accounts.
Choose connectivity for the actual application
Cloud apps with strong identity and device controls may not need a company VPN. A private on-premises application may need scoped private access or a managed VPN; a remote desktop is a different use case again. A consumer VPN does not establish company identity policy or clean an infected device. Check what your existing identity and device subscriptions include, then use the business remote-access guide only for an unmet access requirement.
Roll out to one crew first
Pick a small pilot with one supervisor and one contractor or seasonal worker if relevant. Test sign-in, MFA recovery, limited connectivity, lost-device reporting, offboarding, and support hours. Capture what fails during a normal job, not just in the office. Expand only after the owner can repeat the setup and verify the controls. Put exceptions into the security checklist and include mobile devices in the 90-day roadmap.
First purchase question
Can your current plan manage access and remove business data from the devices you actually use? If yes, configure and test it. If no, document the missing capability, support burden and device count before comparing products.
Sources checked September 24, 2026: NIST SP 800-46r2, CISA SMB MFA guidance, and NIST SP 1300. This is source-based guidance, not a tested mobile deployment.