VPN for Remote Work: When It’s Required and What It Protects
Alison Green draws on extensive experience discussing workplace situations, management, and professional relationships. Her practical knowledge focuses on communication, common challenges at work, and the choices people face throughout their careers.
Quick answer
A VPN is required when your employer says you must use one to reach internal systems. It is also a smart choice when you handle sensitive data on a home or public network. A VPN encrypts your connection, which means it scrambles your data so others cannot read it. Whether you need one depends on your employer's rules, your job role, and the device you use.
When a VPN Is Required for Remote Work
The clearest answer is this: if your employer’s IT policy says you must connect through a VPN to reach internal tools, file servers, or corporate applications, then yes, a VPN is required. That is not a personal choice. It is a condition of access.
Many organizations rely on remote access tools so employees, contractors, partners, and vendors can work from outside the office. NIST Special Publication 800-46 Rev. 2 covers this topic in detail. That guide says all parts of those remote access tools should be secured against expected threats. In practice, a VPN is one of the main tools organizations use to meet that requirement.
If your company has not told you whether a VPN is required, that is itself a signal to ask your IT department before you start handling work data from home.
What a VPN Actually Does
A VPN, or virtual private network, creates an encrypted tunnel between your device and a server your employer controls. Traffic passing through that tunnel is protected from being read by anyone on the same network as you, such as other users on a shared home router or a public Wi-Fi hotspot.
What a VPN does not do is protect you from threats already on your device, such as malware, or from weak passwords on the accounts you access once the tunnel is open. It also does not replace other security layers like strong account passwords or a structured home office routine that keeps work and personal activity separate.
Company-Managed Device vs. Your Own Device
Your device type changes the VPN picture. NIST SP 800-46 Rev. 2 covers both organization-issued devices and bring-your-own-device (BYOD) setups. BYOD means using your personal phone or laptop for work. The security requirements are different depending on which type of device you use.
- Company-managed device (MDM enrolled): Your employer’s IT team likely pre-configures the VPN client, certificates, and connection settings. You connect as instructed. You typically have little choice in the matter, and that is by design.
- BYOD (your personal laptop or phone): Your employer may still require you to install and use a specific VPN client. However, the VPN on a personal device generally covers only work traffic, not everything you do on that machine. Check your employer’s BYOD policy for what is and is not monitored.
If you are an independent contractor, your client may still require VPN access to their systems as a contract condition. An independent contractor is self-employed, not a direct employee. That said, your client generally cannot tell you how to secure the rest of your personal device. Check the specific terms in your contract or statement of work.
Security Policy Drives the Decision
NIST SP 800-46 Rev. 2 advises organizations to create security policies that cover remote work and remote access. That means the answer to “do I need a VPN?” is mostly set by your employer’s written policy. There is no single universal rule that applies to everyone.
Common situations where employer policy typically requires a VPN:
- Accessing internal file shares, intranets, or on-premises databases
- Working in regulated industries such as healthcare, finance, or government contracting
- Connecting from a network your employer does not control, including home broadband
Common situations where a VPN may be optional or not provided:
- Your work lives entirely in cloud-based tools (email, project management, video calls) that use their own HTTPS encryption
- Your employer uses a zero-trust access model. This means each application checks your identity on its own, instead of sending all your traffic through one tunnel.
Even in the second scenario, using a VPN on an untrusted network adds a layer of protection. The decision is a risk judgment your employer’s security team should make, not something to guess at. For more on how distributed teams handle access and communication decisions, see how asynchronous work structures affect team security practices.
Illustrative Example: Two Remote Workers, Different Answers
Consider two workers at the same company (this is an illustrative scenario, not a real case):
- Worker A is a W-2 employee who accesses an on-premises HR system and internal project files. IT has enrolled her laptop in MDM and pre-installed the corporate VPN. She must connect to the VPN before any internal resource loads. VPN is required, no decision needed.
- Worker B is an independent contractor who uses only cloud-based tools: a shared project board, a video call platform, and a client-provided email alias. The client has not issued a VPN. Worker B’s traffic to those tools is encrypted by HTTPS at the application layer. A VPN is not required by the client, but Worker B may choose to use a personal VPN when working from a coffee shop to protect other traffic on that network.
The difference is not about how sensitive the work is in general. It is about where the data lives and what the employer’s security policy says.
When to Stop Deciding on Your Own
Stop self-deciding and contact your company’s IT or security team if any of the following apply:
- You cannot find a written VPN policy in your employee handbook or IT documentation
- You need to access internal systems and have not been given VPN credentials
- You are using a personal device and are unsure what your employer can see through the VPN client they asked you to install
- You work in a regulated industry (healthcare, finance, defense contracting) where data handling rules may go beyond general employer policy
For contractors, the right contact is your client’s IT or security point of contact, or the terms spelled out in your contract. Do not assume cloud-only work means no security requirements apply. Your client’s policy governs what they require of you, regardless of your employment classification.
Frequently asked questions
Does using HTTPS mean I don't need a VPN for remote work?
HTTPS encrypts traffic between your browser and a specific website, but it does not protect all traffic on your device or hide your activity from others on the same network. A VPN adds a separate encrypted layer covering your connection to your employer's systems. If your employer requires a VPN, HTTPS alone does not satisfy that requirement.
Can my employer see what I do on a VPN they provide?
Yes. When you connect through a company-provided VPN, your employer's IT team can see the traffic that passes through their network, including sites you visit and data you send. This is true for company-managed devices. On a personal BYOD device, visibility depends on how the VPN client is configured. Check your employer's acceptable-use policy for specifics.
Do I need a VPN if I only use cloud tools like Google Workspace or Microsoft 365?
Not necessarily from a technical standpoint, since those platforms use their own HTTPS encryption. However, your employer's security policy may still require a VPN even for cloud-only work. Check your IT policy first. If no policy exists, ask your IT or security team before assuming you are covered.
What should I do if my employer hasn't given me VPN access but I need to reach internal systems?
Contact your IT helpdesk before attempting to access internal systems another way. Accessing internal resources without the required VPN may violate your employer's security policy. IT can provision credentials, walk you through client installation, or confirm whether an alternative access method is approved for your role.
Is a personal VPN service the same as a corporate VPN?
No. A personal VPN routes your traffic through a commercial provider's servers. This can protect your privacy on public networks, but it does not connect you to your employer's internal systems. A corporate VPN is set up by your employer to give you access to internal resources. They serve different purposes and are not interchangeable.
Sources
- SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security | CSRC · csrc.nist.gov
- About · Office of the Director of National Intelligence (ncsc.gov)
- About · Office of the Director of National Intelligence (ncsc.gov)
Prepared from these references and checked against them. References retrieved October 11, 2026.
Spotted an error? Tell us what needs correcting.