Phones, computers & home
Setting up a new laptop for work: a security checklist
A new laptop is the easiest moment to get security right, because nothing’s been installed yet. An hour spent on the setup below makes the next few years safer and saves headaches later, whether you’re a sole trader or setting up a machine for a new staff member.
The short version
The first hour
- Install every available update.
- Use a standard account day to day, not an administrator.
- Turn on disk encryption, a screen lock and Find My device.
- Set up backups and a password manager before you start working.
Before you begin
If your business uses device management (such as Microsoft Intune, Apple Business Manager or Google endpoint management), set the laptop up through that so policies, apps and security settings are applied automatically. The checklist below is still a useful way to confirm everything is in place.
The checklist
Update everything
Connect to the internet and install all updates before anything else. On Windows, use Settings then Windows Update, and restart as many times as it asks. On a Mac, use System Settings, General, Software Update. Turn on automatic updates while you’re there.
Sign in with the right account
For a business, use the work account (Microsoft Entra ID or Google Workspace) so the device is linked to the organisation. For a sole trader, use your own Microsoft or Apple account with two-step verification turned on.
Use a standard account for daily work
Keep one administrator account for installing software and changing settings, and use a standard account day to day. Malware and scams are far less damaging when the account they run in can’t change the system. Restricting admin rights is part of the ASD’s Essential Eight.
Turn on disk encryption
If the laptop is lost or stolen, encryption keeps your data unreadable. On Windows, turn on Device encryption or BitLocker. On a Mac, turn on FileVault. Save the recovery key somewhere safe, such as your password manager or your organisation’s admin portal, not on the laptop itself.
Set a screen lock
Use a PIN, password, fingerprint or face sign-in, and set the screen to lock after a few minutes of inactivity. Get into the habit of locking it when you step away (Windows key + L or Control + Command + Q).
Turn on Find My device
On Windows, it’s Find my device in Settings. On a Mac, it’s Find My. This lets you locate, lock or wipe the laptop if it’s lost.
Check the security software is on
Windows includes Microsoft Defender, and macOS includes built-in protections. Make sure Defender is active and up to date. Businesses may use an endpoint protection product managed centrally.
Set up backups
Before any real work goes on the laptop, decide how it’s backed up. For many people that’s OneDrive, Google Drive or iCloud for documents, plus a separate backup for anything stored only on the laptop. See our backup guide.
Install a password manager
Install your password manager and its browser extension, so you never need to save passwords in the browser or a document.
Remove what you don’t need
Uninstall trial software, games and apps you won’t use. Less software means fewer things to update and fewer ways in.
Install software from official sources only
Download apps from the Microsoft Store, Mac App Store or the vendor’s official website. Avoid “free download” sites, which often bundle unwanted extras.
Don’t mix work and family use
If the laptop holds client or business data, it shouldn’t double as the family computer. Separate devices, or at least separate user accounts, keep work data out of reach of games, downloads and curious kids.
Quick reference
| Setting | Windows | Mac |
|---|---|---|
| Updates | Settings, Windows Update | System Settings, General, Software Update |
| Encryption | Device encryption or BitLocker | FileVault |
| Find my device | Settings, Privacy & security | Apple ID, Find My |
| Firewall | Windows Security, Firewall | System Settings, Network, Firewall |
| Account type | Settings, Accounts, Other users | System Settings, Users & Groups |
For businesses
- Record each laptop’s serial number, user and purchase date in an asset list.
- Enrol devices in a management tool so updates, encryption and lost-device wipes can be handled centrally.
- Make sure a new staff member’s laptop is set up before their first day, as part of a proper onboarding process.
Common questions
Do I need to buy antivirus for a new Windows laptop?
For most home users and small businesses, Microsoft Defender, kept up to date, is a solid baseline. Businesses may want centrally managed protection with reporting.
Should I transfer everything from my old laptop?
Transfer your files, but reinstall apps fresh rather than copying everything across. It’s a chance to leave old, unused software behind.
What do I do with the old laptop?
Back it up, then wipe it properly before selling, donating or recycling it.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.