Remote Access

It depends on what that method actually is. If your IT provider is using a consumer-grade screen-sharing tool or a generic VPN with a shared password, that's worth questioning. A proper managed remote access arrangement means your provider connects through a defined, authenticated channel that's logged at your end too, not just theirs. You should be able to see a record of every session, and access should be scoped to what they actually need rather than giving them broad admin rights by default. If you're not sure what your provider uses or how it works, that's a reasonable question to ask them.

A strong password helps, but it's not enough on its own. Passwords can be stolen through phishing, exposed in data breaches at other services you use the same password for, or guessed through repeated automated attempts. For anything that gives someone access into your systems, a second factor to confirm the login is the baseline expectation now. Beyond that, there's also the question of what happens after the session starts: whether access is limited to what's needed, whether the session gets closed properly, and whether there's any record of what was done. A strong password addresses one part of the problem; secure remote access addresses the whole thing.

A few straightforward questions will tell you a lot. Does every remote connection require more than just a password to get in? Is there a log you can check that shows who connected, from where, and when? Is remote access switched off or inaccessible when nobody is actively using it, rather than running in the background? Can you revoke access quickly if someone leaves the business or if something looks wrong? If the answer to any of those is no, or you're not sure, there's probably something worth tightening up.

Yes, in a couple of ways. Cyber Essentials requires that your boundary controls prevent unauthorised access, and it requires that only authorised users can access your systems and data. Remote access tools that aren't properly secured can fail both of those requirements. If your IT support provider connects in through a tool that doesn't enforce multi-factor authentication, or if remote access software is running on devices without proper controls, that's likely to come up during an assessment. Getting remote access right is often one of the more practical things businesses can do to prepare, and it has real security value regardless of whether certification is the goal.

Both. Secure remote access covers any situation where someone needs to connect into a business system from outside the office, whether that's an employee accessing a work desktop from home, a manager connecting to an internal server while travelling, or an IT provider fixing a problem remotely. The controls that matter are the same in each case: proper authentication, logged sessions, and access that's scoped to what that person actually needs. A well-designed setup handles both staff and support access through the same kind of controlled, auditable process.