In early 2020, companies across Turkey found themselves sending employees home within days — sometimes hours. Order management, accounting closures, customer communications — all of it suddenly running through home broadband connections, personal laptops, and Wi-Fi networks shared with family members. The security architecture that took years to build in the office — firewalls, network segmentation, physical access controls — evaporated overnight. This is not a temporary gap to be patched with a quick memo. It is a structural exposure that requires a properly designed remote work security policy, written to cover the reality of home environments as a permanent operating condition rather than an exception.
A remote work security policy that actually works rests on four layers: device, network, identity, and data. Each layer requires a defined minimum standard. Without that definition, any document called a ‘remote work guideline’ remains exactly that — a document. In Turkish SMEs, where the IT function is often a single person or outsourced entirely, the primary design criterion must be practicality, not theoretical completeness. A policy that managers can understand, employees can follow, and IT can audit is the only policy worth writing. Layered security architecture is conceptually sound; what matters is whether each layer has a realistic counterpart in the Turkish SME context.
The device layer is the most concrete and auditable part of the policy. The core rule is straightforward: corporate data should only be accessed from devices that the company manages or explicitly approves. In practice, this means personal computers should not connect directly to corporate systems without controls in place. For smaller companies that cannot enforce this immediately, the minimum standard can be defined as: the operating system must be a supported version with current patches applied; antivirus software must be active and updated; full-disk encryption must be enabled. On Windows 10 devices, BitLocker handles this without additional cost. On macOS, FileVault does the same. If the company cannot verify the device, it should at minimum obtain a written commitment from the employee confirming these three conditions, with periodic checks. A case from a mid-sized Istanbul textile exporter illustrates the risk: an employee’s personal laptop running an outdated operating system left a corporate ERP session open, and customer order data was written into the browser cache on that device. A device policy would have prevented this scenario before it started.
The network layer remains the weakest point in the home environment. The employee’s home router is almost certainly running factory-default credentials, has not received a firmware update in years, and carries multiple personal devices on the same network. Connecting to corporate systems directly from this environment is equivalent to leaving an unlocked door in front of the office firewall. The answer is VPN — but not all VPN solutions are equivalent. A VPN hosted on the company’s own infrastructure or with a reputable cloud provider, with split tunneling configured carefully, neutralises most of the risk posed by an untrusted home network. Many Turkish SMEs turned to free or low-cost VPN services during this period; some of these services have documented histories of logging user traffic and sharing data with third parties. The policy must make this distinction explicit and provide employees with an approved VPN list. Additionally, the employee’s home router should have WPA2 encryption active and the default router password changed. Neither step requires technical expertise; the policy document can describe both in plain language.
The identity layer became the most critical security component the moment employees left the office. Physical presence in the building was itself an authentication factor — that factor no longer exists. The only reliable substitute is multi-factor authentication (MFA). Username and password alone are not sufficient; the evidence for this is extensive. Microsoft Authenticator and Google Authenticator are free, work on any smartphone, and are accessible even for the smallest organisations. Password policy is part of this layer as well: a minimum of twelve characters, combining uppercase, lowercase, numbers and special characters, with mandatory rotation every ninety days. These may sound like standard requirements, but the majority of credential breaches affecting Turkish companies still trace back to weak or reused passwords. The policy should also define session timeout rules: automatic logout after thirty minutes of inactivity in corporate applications adds a meaningful protection layer in home environments where physical screen privacy cannot be guaranteed.
The data layer is the most frequently neglected section of any remote work policy. Which data can be stored where, which files cannot be copied to a local drive, which documents cannot be sent as email attachments — without clear answers to these questions, each employee makes their own judgement call every time. In Turkey, personal data covered under KVKK (the Personal Data Protection Law) carries particular weight here: customer records, employee files, and order data processed in a home environment do not become exempt from KVKK obligations — if anything, the audit risk increases. The policy must state clearly that files containing customer data are stored only in encrypted corporate storage systems and are not downloaded to local drives. For cloud storage, an explicit approved and prohibited services list is necessary. Uploading a corporate document to a personal Dropbox or Google Drive account is technically easy but constitutes a policy violation — and under KVKK, that violation can expose the company to regulatory liability.
Writing the policy is not enough. The company must document that each employee has read, understood, and accepted it. A digitally signed acknowledgement is legally valid and provides protection in the event of a data breach investigation. The policy should be reviewed at least once a year; new threats, new tools, and regulatory changes make this necessary. For a Turkish SME with limited IT capacity, building all four layers at once may not be realistic. In that case, the priority sequence is: identity first — MFA and password policy; then network — approved VPN; then device — minimum standards and written commitment; finally data — storage and sharing rules. This sequence delivers the highest protection in the shortest time. Remote work is no longer an exceptional arrangement, and a security policy that still treats it as one is already out of date.
This article was originally written in Turkish by Gökhan MERCANOĞLU on March 2, 2020 and has been automatically translated into English and other languages using machine translation.