Because Small and Medium Businesses have different security needs and attitudes, the checklist includes suggested recommendations for two common scenarios.

• The normal scenario is designed for a typical business that wants to enable secure remote work and balance ease of use with security.
• The high risk scenario is more appropriate for a business that wants to maximize security protections and has higher concern for risk (for example, to adhere to regulatory requirements such as HIPAA or GLBA). This business is also willing to put more effort into maintaining security and control of the work from home environment.

Both sets of defaults are intended to provide a starting point for a serious discussion around the security and compliance options available, rather than prescriptive guidance. One of the first and most important things that IT leaders and business leaders can do is talk through the possibilities.