Government Workers Allowed VPN Use Only With Approved Services

National CERT tells staff to rely solely on department-approved VPNs for remote access, stressing security risks of unapproved tools.

NationPulse Desk

Oct 15, 2026 · 5:15 PM 1 min read

Key takeaways

National CERT requires government employees to use only department-approved VPNs for remote access.

The National Cybersecurity Handbook 2026-27 states approved VPNs protect data from unauthorized access.

Workers must keep strong credentials, end sessions after tasks, and report unstable VPN connections.

Guidelines forbid using unauthorized VPNs, disabling security tools, leaving sessions unattended, or sharing logins.

Non-compliance could expose networks to brute-force attacks, ransomware and long-term espionage.

The National Cyber Emergency Response Team (National CERT) has instructed government staff to employ only VPNs that have been approved by their departments when accessing official systems from outside the office, cautioning that exposing those services directly to the internet could make them vulnerable to attacks.

The National Cybersecurity Handbook 2026-27 notes that government-provided VPNs establish protected links for remote employees, helping shield data from unauthorized access and interception.

According to the handbook, workers must rely on VPN services sanctioned by their agencies, keep strong login credentials, and end remote sessions as soon as official duties are finished. They are also directed to notify IT or cybersecurity teams if VPN connections become unstable or repeatedly drop.

Staff have been warned not to use any unauthorized VPNs or proxy apps for work purposes. The guidance also bans disabling antivirus programs, firewalls or other endpoint protection tools to boost VPN performance, leaving VPN sessions open on unlocked devices, or sharing login details.

The handbook cautions that ignoring secure remote-access procedures could open government networks to automated brute-force attacks, ransomware aimed at internal servers, and persistent backdoors that might allow long-term espionage.

These directives are part of wider cybersecurity strategies outlined for federal and provincial governments as well as public-sector bodies.

Questions and answers