How to Secure Remote Access for Field Staff Without Expensive Hardware

Caseworkers and outreach staff need secure access from homes, shelters and parking lots. Zero trust network access delivers it with MFA, device checks and app-level access, without buying or patching a VPN appliance.

Sean Crowley

President & Co-Founder

October 30, 2026 · 5 min read

Key takeaways

VPN appliances are frequent attack targets; CISA ordered federal agencies to disconnect exploited Ivanti VPN gateways in 2024.
Joint CISA and FBI guidance from June 2024 urges organizations of all sizes to move toward zero trust remote access.
Zero trust network access checks identity and device on each request and grants access to specific applications only.
Connectors such as Microsoft's private network connector run as software on an existing server and need no inbound firewall ports.
California's reasonable security statute covers nonprofits, and program rules such as WIC 10850 and VAWA add confidentiality duties.

What is the most affordable way to give nonprofit field staff secure remote access?

For most nonprofits, it is a cloud-delivered zero trust network access (ZTNA) service tied to the identity system you already use, with a small software connector inside your network instead of a VPN appliance. Each caseworker, outreach worker or site coordinator signs in with MFA from a known device and reaches only the applications their role needs.

That model fits how field staff actually work: from a client's home, a shelter, a school, a parking lot between visits, or a borrowed office with unknown Wi-Fi. It also fits how nonprofit IT is funded. There is no hardware refresh cycle to budget for and no appliance to patch on a weekend.

Why is a VPN appliance the expensive and risky option?

A VPN appliance is a box on the edge of your network that has to be bought, licensed, patched and eventually replaced, and VPN gateways have been a repeated target for attackers. In January 2024, CISA issued Emergency Directive 24-01 after widespread exploitation of Ivanti Connect Secure VPN gateways, and its supplemental direction ordered federal agencies to disconnect affected products. That directive binds federal agencies, but the same products sit in nonprofit server closets.

CISA, the FBI and international partners followed in June 2024 with joint guidance, Modern Approaches to Network Access Security, describing the weaknesses of traditional remote access and urging organizations of all sizes to move toward zero trust, Security Service Edge and Secure Access Service Edge models. The joint guidance is a recommendation rather than a mandate, and it shows where federal security agencies expect remote access to go.

A traditional VPN also tends to put a connected device on the whole internal network. If a field laptop is compromised, the attacker inherits that reach.

How does zero trust access work without new hardware?

It moves the decision about who gets in from the network edge to the identity and device check on every request. NIST SP 800-207 describes zero trust as granting no implicit trust based on network location, with the user and device authenticated and authorized before each session to a resource is established.

In practice, the pieces are:

An identity provider your staff already sign in to, such as Microsoft Entra ID or Google Workspace, enforcing MFA.
A small client app on each laptop or phone that sends access requests to the ZTNA service.
A connector inside your network that reaches out to the service, so internal applications are never exposed directly to the internet.

For example, Microsoft documents its private network connector as a lightweight agent installed on a Windows Server that only makes outbound connections, so no inbound firewall ports have to be opened. Microsoft recommends at least two connectors for availability. Those can run on servers or virtual machines you already have. Other ZTNA vendors use a similar design.

The cost shifts from hardware to per-user licensing. Whether that is cheaper depends on your headcount and what your current licenses already include, so price both options before you commit.

Which rules make field access a confidentiality issue?

Several, depending on the programs you run. California's Civil Code section 1798.81.5 requires a business that owns or maintains personal information about California residents to maintain reasonable security, and section 1798.80(a) defines business to include organizations not operated for profit.

Program rules can be stricter:

Agencies administering public social services handle records made confidential by Welfare and Institutions Code section 10850, which makes knowing and intentional unauthorized disclosure a misdemeanor.
Grantees under the Violence Against Women Act may not disclose victims' personally identifying information and must make reasonable efforts to prevent inadvertent release, as the Office on Violence Against Women explains in its VAWA confidentiality FAQ.
Programs that handle health information may have HIPAA obligations as well.

None of these rules names a remote access product. They do make it hard to defend a setup where a former volunteer's password still opens the case management system from any device on any network.

What should a field access checklist cover?

The CIS Controls give a practical baseline for account and access management that maps cleanly to field work:

MFA for every remote session and every externally exposed application (CIS Safeguards 6.3 and 6.4).
An inventory of every account, including volunteers and contractors, with start and stop dates, validated at least quarterly (Safeguard 5.1).
Dormant accounts disabled after 45 days of inactivity where the system supports it (Safeguard 5.3).
A documented process to grant and revoke access, ideally automated so a departure in HR or the volunteer roster closes access the same day (Safeguards 6.1 and 6.2).
Access by application and role. A caseworker reaches the case management system and the file share for their program, not the finance server.
A device check before access: organization-managed devices, or at minimum a current operating system, screen lock and disk encryption for any personal phone you allow.
A plan for lost devices: who reports it, how fast access is revoked, and how the device is wiped.

What to do this quarter

List every way staff and volunteers reach internal systems from outside the office today, including VPNs, remote desktop and shared passwords.
Confirm MFA is enforced on all of them, and close any that cannot support it. MFA is also first on our list of free cybersecurity wins for nonprofits.
Pilot zero trust access with one field team and one or two applications, using a connector on an existing server or virtual machine.
Reconcile your account list against HR and the volunteer roster, and disable anyone who has left.
Price the ZTNA licensing against your next VPN renewal or hardware replacement, and put the decision in front of your finance committee with both numbers.

How s90 helps

s90 designs and runs Zero Trust Network Access for nonprofits and social service agencies, using the identity system and servers you already have wherever possible. We set up app-level access for each role, tie offboarding to your HR and volunteer processes, and give your board a plain summary of who can reach what. If your VPN renewal is coming up, talk with us about a field-team pilot first.

Applies to

Industry

Non-Profit

Compliance

CIS Controls NIST CSF 2.0

Regulation reference

CISA Emergency Directive 24-01, Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities (January 19, 2024), with Supplemental Direction V1 (January 31, 2024)
Directed federal civilian agencies to mitigate CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure and Policy Secure after widespread, active exploitation. Supplemental Direction V1 required agencies to disconnect affected products by February 2, 2024. Binds federal agencies only; cited here as evidence of VPN appliance risk.
www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities
CISA, FBI, GCSB, CERT-NZ and CCCS, Modern Approaches to Network Access Security (June 18, 2024)
Joint guidance describing vulnerabilities, threats and practices associated with traditional remote access and VPN deployments, and urging organizations of all sizes to move toward zero trust, Security Service Edge and Secure Access Service Edge for better visibility into network activity. Guidance, not a mandate.
www.cisa.gov/resources-tools/resources/modern-approaches-network-access-security
NIST SP 800-207, Zero Trust Architecture (August 2020)
Defines zero trust architecture: no implicit trust granted to assets or user accounts based solely on physical or network location, with subject and device authentication and authorization performed as discrete functions before a session to an enterprise resource is established. Reference architecture, not a mandate for private firms.
csrc.nist.gov/pubs/sp/800/207/final
Microsoft Learn, Understand the Microsoft Entra private network connector
Vendor documentation, not a rule. The connector is a lightweight agent installed on Windows Server that makes only outbound connections to Private Access and application proxy services, so no inbound firewall ports are required. Microsoft recommends at least two connectors per group for availability.
learn.microsoft.com/en-us/entra/global-secure-access/concept-connectors
Cal. Civ. Code § 1798.81.5
Requires a business that owns, licenses or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information (b), and to require by contract that a nonaffiliated third party it discloses that information to do the same (c). The statute does not define reasonable security. Personal information means a name combined with an unencrypted or unredacted SSN; driver's license, state ID, tax ID, passport, military ID or other government ID number; account or card number with a required security code, access code or password; medical information; health insurance information; unique biometric data; or genetic data; or a username or email with a password or security question and answer (d). Does not apply to providers regulated by the Confidentiality of Medical Information Act, financial institutions subject to the California Financial Information Privacy Act, HIPAA covered entities, certain Vehicle Code data recipients, or businesses regulated by a law giving greater protection, where compliance with that law is deemed compliance (e). Text confirmed against the statute on 2026-10-27.
leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.81.5
Cal. Civ. Code § 1798.80(a)
Defines business for California's customer records title (including the reasonable security requirement in section 1798.81.5 and the disposal requirement in section 1798.81) as a sole proprietorship, partnership, corporation, association or other group, however organized and whether or not organized to operate at a profit, including financial institutions and entities that dispose of records. Section 1798.80(c) defines customer as an individual who provides personal information to a business to purchase or lease a product or obtain a service, and 1798.80(e) defines personal information broadly as any information that identifies, relates to, describes or is capable of being associated with a particular individual, excluding publicly available government records. Text confirmed against the statute on 2026-10-27.
leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.80.
Cal. Welf. & Inst. Code § 10850
Applications and records concerning any individual made or kept by a public officer or agency in connection with the administration of public social services are confidential and not open to examination for any purpose not directly connected with administration of the program; knowing and intentional unauthorized disclosure is a misdemeanor.
leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=WIC&sectionNum=10850
U.S. Department of Justice, Office on Violence Against Women, Frequently Asked Questions on the VAWA Confidentiality Provision (34 U.S.C. 12291(b)(2)) (October 2017)
Covered grantees and subgrantees may not disclose, reveal or release personally identifying information about victims, even if encoded, encrypted, hashed or otherwise protected, and must make reasonable efforts to prevent inadvertent releases, including when using third-party storage.
www.justice.gov/ovw/page/file/1006896/download
CIS Critical Security Controls v8.1, Safeguards 5.1, 5.3, 6.1, 6.2, 6.3 and 6.4
Maintain an inventory of all accounts with name, username, start and stop dates and department, validated at least quarterly (5.1); disable dormant accounts after 45 days of inactivity where supported (5.3); follow documented, preferably automated processes to grant and revoke access (6.1, 6.2); require MFA for externally exposed applications (6.3) and remote network access (6.4).
cas.docs.cisecurity.org/en/latest/source/Controls6/

Related insights

All insights

Six identical closed Dell laptops stacked neatly on a pale wood table.

CIS Controls

How to Write an AI Acceptable Use Policy Your Tools Can Enforce

An AI acceptable use policy that nothing enforces documents a control that does not exist. Here is how to write each rule against a CIS safeguard you can configure, so the policy produces its own evidence.

October 30, 20266 min read

A staff member works at a computer behind the reception counter of a small community services office.

Non-ProfitCIS Controls

How to Use AI for Donor Communications Without Breaking Privacy Promises

Your privacy policy and donation pages already promise donors how their data is handled. Here is how to use AI for donor letters and appeals without sending donor records somewhere those promises do not cover.

October 30, 20265 min read

A person in a work jacket leans over printed drawings at a plan table in a job site trailer, a building under construction outside.

AECCIS Controls

How to Use AI Proposal Writing Without Leaking Pricing or Past Bids

AI proposal writing saves AEC teams real time, and pricing and past bids are the files a firm can least afford to lose. Here is how to separate narrative from numbers, pick an approved tool and enforce the rule with controls.