Anyone starting their first job after studies or training often works from home at the kitchen table, on their own laptop and on the same Wi-Fi as the streaming box. That is where many security gaps appear. This checklist sorts the main points and shows where you have to act yourself. The basics of exclusions and policy duties are covered in more depth in our article on cyber insurance exclusions.
Short answer: In a home office, protect devices, logins and data separately, and clarify what the employer provides and regulates. Whether private cyber insurance makes sense depends on how you use your devices and on the policy terms. If you use a privately insured device for work, this can count as an increase in risk under section 23 VVG. Last updated: November 2026.
The most important points at a glance
- Keep a work device and a private device apart, where your employer requires it.
- Protect every account with its own strong password and, wherever possible, a second confirmation step.
- Clarify early which software, storage locations and networks are permitted for work.
- Report a suspicious incident to the responsible IT team at once, rather than trying to fix it yourself.
- Check whether your existing insurance covers home working before you take out anything new.
Which devices belong in a home office?
The first question is which device you work on. A company device usually follows the IT department’s rules, while a private device carries your own settings and apps. If the two mix, the line between business data and private files blurs. Some employers only allow private devices with specific protective measures. Read the rules before you open work documents on a private computer.
The home router is part of your security too. Change the default password, keep the firmware up to date and, if your router offers it, separate guest and smart-home devices from the work network.
Which logins need the most protection?
Email, cloud and work portal accounts are the biggest target. An attacker who takes over your mailbox can fake invoices or reset other passwords. That is why each service should have its own password, kept for example in a password manager. Where your employer requires two-step sign-in, set it up straight away and store the recovery codes safely.
What does the employer regulate, and what stays with you?
Which equipment the employer provides, and who is responsible for which tools, is usually set out in the employment contract or a workplace policy. Ask there before you spend money privately on protection that your employer may already provide. It is often unclear who pays for restoring systems after an incident at home. A general guide cannot answer that question. Your employer can.
| Area | What to check | Responsible |
|---|---|---|
| Devices | Work or private device, use rules confirmed in writing | You and the employer |
| Logins | Separate password for each service, two-step sign-in active | You |
| Network | Router password changed, firmware current, guest network separate | You |
| Data | Storage location for work files defined, backup set up | You and the employer |
| Incident | Report to IT or your manager within a short time | You |
| Insurance | Existing policies checked for professional use | You and the insurer |
Do you need private cyber insurance for the home office?
Private cyber insurance does not replace the rules set by your employer. It mainly covers your own risks, such as private accounts and devices. Whether it is worth it depends on your daily routine and on what the terms exclude. If you take out cover, state professional use honestly in the application. Otherwise the insurer may ask about it under section 19 VVG, and a change of use counts as an increase in risk under section 23 VVG.
How do you document your security measures?
After a loss you often have to show which precautions you took. A short list with dates and measures is usually enough as a reminder. The duties a policy requires are governed by section 28 VVG. Under that provision, a breach can have consequences depending on the degree of fault, for example a reduction of the payment in cases of gross negligence. Keep evidence such as screenshots of settings or confirmations from your employer.
Where do the risks lie in a normal working day?
The biggest risks rarely come from elaborate attacks. More often, an email is answered too quickly in the middle of a busy day, or an attachment looks urgent. Your phone counts as well if you read work mail on it. So walk through a typical day in your head. In the morning the laptop starts, at lunch you work on the canteen Wi-Fi, and in the evening the phone lies on the sofa with the same accounts logged in. Each of these situations needs a simple rule, such as locking the screen when you leave your desk or not opening work files over unsecured networks.
A routine like this takes little time and stops mistakes from becoming habits. Whether your employer has already written down such rules, you can see in the IT policy or the internal wiki. If there are none, ask the responsible team before you invent your own rules, which may not match the official requirements in an emergency.
Frequently asked questions
Does household contents insurance cover cyber losses in a home office?
That cannot be answered in general. Contents and liability policies have different focuses. Check the terms for passages on data damage, fraud or online payments. If you find nothing, do not assume that cover exists.
Do I have to tell my employer that I use a private device?
That depends on your employment contract and the internal rules. If you use a private device for work data, clarify beforehand whether this is allowed. A question costs nothing and prevents misunderstandings.
What if I want to fix an incident myself first?
For work data, inform IT first. Unauthorised changes can destroy traces that matter for clarifying what happened. For your insurance, too, it counts that you report in time and do not alter evidence.
Which insurance suits a new graduate working from home?
There is no general recommendation for individual providers here. Compare the benefits using the same points from the checklist. The article on exclusions in the fine print explains how to find exclusions and reporting deadlines.
What to do now
- Agree with your employer which devices, programmes and storage locations are permitted.
- Set up passwords and two-step sign-in for all work accounts.
- Update your router and devices, and separate guest and smart-home devices from the work network.
- Check your insurance policies for professional use and amend the application if needed.
- Keep a short, dated list of the measures you have taken.
Related guides
- Insurance for students: an overview (in German), as a starting point for the group
- Cyber insurance for private individuals: is it worth it for students?
- Cyber insurance: exclusions and pitfalls in the fine print
- Insurance during studies: liability, contents and accident cover (in German)
If you want to go through your policies with a specialist, you can arrange a personal consultation with Academycon. The process is described on the page How we work (in German).
Sources: Section 28 VVG, breach of a contractual duty (in German) (accessed November 2026); Section 19 VVG, duty to disclose (in German) (accessed November 2026); Section 23 VVG, increase in risk (in German) (accessed November 2026).
Last updated: November 2026. This guide is general information, not individual advice.
