Router Security for Working From Home
Your home router now guards work data too. Here is what the NSA, CISA and NIST tell remote workers to do.
To work from home securely, lock down your router first: change default passwords, use WPA3 or WPA2, keep firmware updated and turn off outside administration. Then keep work devices apart from guests and smart devices, and connect to work through your employer’s VPN or another secure channel. That is the core of NSA, CISA and NIST telework guidance.
Why does your home router matter to your employer?
The NSA says your home network’s security affects not only your personal information but also your work information and networks when you telework.
NIST adds the reverse risk: if your telework device is compromised, anything else on your home network could be at risk too.
From the team behind this checker
Want a router that takes this seriously by default?
- SecureRooms. Smart devices live apart from your computers.
- You approve every new device before it joins.
- Rio VPN built in. First year included.
- Set up in about 10 minutes from the app.
$199.99 · 1 year of VPN included, then $7.99/mo · 30-day returns · 1-year warranty. Rio builds this site and grades its own router by the same method.
What router settings do agencies recommend?
- Change default passwords. CISA’s telework toolkit says so, and NIST notes lists of default passwords are widely available online.
- Use WPA2 or WPA3. CISA says to use at least WPA2 and disable WEP and WPA. NIST says to use a hard-to-guess Wi-Fi password.
- Pick a neutral network name. CISA says it should not identify your location or router make and model.
- Block outside administration. NIST and the NSA both say the router should only be managed from inside your home.
- Update regularly. NIST says to apply updates automatically or at least monthly.
- Turn off UPnP and reboot weekly, as the NSA recommends.
- Use a protective DNS service, as CISA recommends. See how to use secure DNS.
Should work devices be on a separate network?
Keep them apart from less trusted devices. The NSA says home Wi-Fi should be split into at least primary, guest and IoT networks.
Keep your work laptop on the primary network, and move visitors and smart devices off it. See our guides to guest networks and smart home networks.
The NSA also warns against moving files between home and work systems by email or removable media. Ideally, it says, use equipment and accounts your organization provides.
Do you need a VPN for remote work?
Use your employer’s if it has one. NIST says to use your organization’s VPN on your telework device. The NSA says to always use a VPN or other secure channel to reach corporate networks.
A work VPN protects the connection to your employer. It does not secure your router. Our VPN guide explains the difference.
Working away from home? The NSA says to use a cellular connection or personal hotspot instead of public Wi-Fi when possible, and a trusted VPN if you must use public Wi-Fi.
What should you ask your IT team?
- Is there a telework policy? NIST says to find it, read it and follow it.
- Which VPN or remote desktop should I use? The NSA suggests a remote desktop inside the corporate network over copying files.
- Can I use a personal device? If yes, the NSA says to use the security products your employer requires.
- Who do I call about something odd? NIST says to report suspicious activity to your help desk or security team.
Is your router still supported?
The NSA says to replace routers that reach end of life. Work through our 10-minute checklist, then check your router’s grade to see if yours still gets updates.
Frequently Asked Questions
It can be, if it is secured. NIST says home Wi-Fi should use WPA2 or WPA3 with a hard-to-guess password. CISA adds changing default passwords and disabling WEP and WPA.
Yes, if it has one. NIST says to use your organization’s VPN on your telework device, and the NSA says to always use a VPN or other secure channel to reach corporate networks.
Follow your employer’s policy. The NSA says it is best to use organization-provided equipment. If you use a personal device, use the security products your employer requires.
CISA’s telework toolkit recommends a protective DNS service, which blocks lookups of known malicious domains. If your employer sets DNS on your work device, leave it as is.
Not if yours still gets security updates and supports WPA2 or WPA3. The NSA says to replace routers when they reach end of life, so check your model’s support status.
Sources
Dates show when each source was published or when we checked it.
- NSA Cybersecurity Information Sheet: Best Practices for Securing Your Home Network (February 22, 2023)
- CISA Telework Essentials Toolkit (2020, checked October 8, 2026)
- NIST Cybersecurity Insights blog: Telework Security Basics (March 19, 2020)
- NIST SP 800-114 Rev. 1: User’s Guide to Telework and Bring Your Own Device (BYOD) Security (July 2016)
- CISA: Encrypted Domain Name System (DNS) Implementation Guidance (April 2024)
Check your router
See how your router scores
Get its FCC status, CVEs, grade and an action plan.
Check a Router → Top 10 Safe Routers