May a work laptop be used on public wifi?

Only as the organisation's instructions allow, and usually only through a protected connection. A public network is shared with strangers and its operator is unknown; a VPN or similar encrypted connection makes the traffic unreadable to others on the network. A phone's own hotspot is usually safer than a café's open network. What matters is not the network but that the laptop is updated and encrypted and the connection is protected.

What do I do if a work device is lost or stolen?

You report it at once to whoever is responsible for security or to IT support, even in the evening or at the weekend. The device can be locked and wiped remotely and the credentials closed, but only if the report comes in. A lost device holding personal data may be a personal data breach whose assessment starts with the report; an encrypted disk is often what decides whether the authority must be notified.

What do I do if I suspect a ransomware infection?

You disconnect the device from the network immediately: network cable out, wifi off. You do not shut the device down unless instructed, because its memory may hold information needed for the investigation. You do not pay, negotiate or try to clean the machine yourself. You report to whoever is responsible for security at once and say what you did just before the symptoms: which attachment you opened, which link you clicked. The rest is the organisation's incident process.

Remote work security: devices, networks and what to do when ransomware strikes

Q: Does the law require these things?

Within the scope of the Finnish Cybersecurity Act, yes. Section 9 lists the risk management measures an entity must keep up to date, and among them are asset management, access control and authentication procedures, incident detection and handling, backups and recovery planning, and basic information security practices for hardware and software security. Article 21 of the NIS2 Directive says the same. For other organisations the same list is a good checklist.

The Cybersecurity Act requires devices, access control and incident handling to be in order. What an employee does at home, in a café and in the first minutes of an infection.

In brief

Remote work moved the edge of the organisation's network to every employee's kitchen table. The laptop, the phone and the home network are now part of the whole whose security the Finnish Cybersecurity Act requires an entity to look after, and ransomware, which locks an organisation's data and demands payment, most often starts from one device and one click. The employee's share is small and precise: use only permitted devices and networks, keep the device updated, report a lost device at once and act correctly in the first minutes of an infection. The organisation's share is that these are instructed and practised, and that backups exist.

What the law requires

The Finnish Cybersecurity Act (124/2025) brought the NIS2 Directive into Finnish law. Section 9 obliges an entity to implement the technical, operational and organisational control measures of its risk management model, and lists what the model must at least cover and keep up to date. For remote work and devices the key items are asset management and identification of security-critical functions, access control and authentication procedures, incident detection and handling, backups, recovery planning and crisis management, and basic information security practices for hardware, software and data security. Article 21(2) of the NIS2 Directive names the same things: incident handling, business continuity including backups, human resources security, access control and asset management, and multi-factor authentication where appropriate.

The law does not say which VPN to buy or how often to install updates. It says the measures are proportionate to the risks and kept up to date. Who the act applies to is explained in Does NIS2 and the Cybersecurity Act apply to your organisation?.

Device and network: what the employee does

Our skills catalogue describes level 2 of endpoint and remote work security like this: works safely remotely, keeps their device updated and knows how to act in a suspected infection. It breaks down into a few everyday habits.

Situation	What to do	Why
Work is done on the employer's device	A personal computer or phone is not used for work unless the organisation has expressly allowed and managed it	Asset management: the organisation can protect, update and wipe only a device it knows
Updates	Installed when the device asks, not postponed for weeks	Most malware uses a hole for which a fix has already been published
Public or someone else's network	Protected connection on before starting work, or the phone's hotspot	On an open network the traffic is readable by others
Home network	Router default password changed, firmware updated	The home router is part of the work environment
Device in a public place	Screen locked whenever the device is left alone; a privacy screen on the train	Physical access bypasses many protections
Lost or stolen device	Report at once, also in the evening and at the weekend	Remote lock and closing credentials work only if the report comes in

A lost device is also a data protection matter. If it holds personal data, the loss may be a personal data breach, and Article 34(3) of the GDPR shows why disk encryption matters so much: if the data was protected so that it is unintelligible to outsiders, the data subjects need not be informed. That is covered in Personal data breach.

Ransomware: the first minutes

Ransomware is malware that encrypts the files on a device and often across the whole network, and demands payment for restoring them. It spreads from device to device over the network, which is why the first minutes decide whether one machine or the whole organisation is affected.

The employee's instruction is short. Disconnect the device from the network immediately: network cable out, wifi off. Do not shut the device down unless the organisation's instruction says so, because its memory may hold information needed for the investigation. Do not pay, do not negotiate and do not try to clean the machine yourself. Report to whoever is responsible for security at once and say what you did just before the symptoms: which attachment you opened, which link you clicked, where you logged in. That information is where the investigation starts, and telling it honestly is worth more than anything else an employee can do in the situation.

How an infection usually begins is covered in Phishing and AI-assisted scams. What the organisation must report, and by when, once an incident is significant is covered in What must be reported about a security incident, and when?.

The backup is what saves you

There is no technical antidote to ransomware that always works. Only two things make surviving an attack possible: fast isolation, and backups kept apart from the production network so that the same malware cannot encrypt them too. Section 9 of the Cybersecurity Act names backups, recovery planning and crisis management as parts of risk management, and point (c) of Article 21(2) of NIS2 says the same.

A backup that has never been restored is an assumption, not a protection. That is why at level 4 of our skills catalogue the information security officer's task is to define the requirements for device management and malware protection and the preparedness for a ransomware situation, and that includes rehearsing recovery. The information security officer's competence as a whole is described in What must an information security officer know.

What this does not mean

Remote work security does not mean the employee is responsible for the organisation's protection. Device management, update distribution, encryption, multi-factor authentication and backups are the organisation's tasks, and the employee's share is to act so as not to bypass them. Nor does it mean getting less done at home: a protected connection and an updated device do not slow work down when they are set up right. And it requires no technical skill. It requires that a few habits are learned well enough to hold in a hurry.

How staff cyber hygiene competence is verified by an exam and shown to a regulator is covered in What does the Cybersecurity Act require for staff training?.