Use your employer-approved cloud service or managed-device backup workflow if one is provided, and confirm how work files can be restored before buying another device. Consider encrypted removable storage only for a specifically authorised process. Company-issued equipment still needs a defined backup workflow, while a security key protects sign-in rather than backing up files.
If you use work files at home and in the office, the starting point is whether each account, device and storage location is approved. The Information Commissioner's Office warns that personally owned USB sticks and external drives can move data to insecure storage; an encrypted retail drive is not automatically an authorised route.
If your employer provides a cloud workspace or managed laptop, focus on access to the right files and the organisation's recovery process rather than creating a personal copy. Microsoft documents that version-history and retention settings in OneDrive and SharePoint can be administered at different levels.
If your employer permits removable media for a defined task, check the approved device type, encryption and who can recover access. The National Cyber Security Centre advises organisations to assess the risks of connected peripherals, so a compatible plug alone does not establish permission to use a drive.
Confirm approved accounts, supplied equipment and the recovery process before choosing storage. A permitted offline drive serves a different purpose from a security key, which helps with sign-in but does not hold a backup.
| Concern | What to check | Who this matters to |
|---|---|---|
| Permission and separation | Confirm approved accounts and devices, including whether issued or allow-listed removable media may be used. | When I switch workplaces, I need company files to stay within approved accounts and devices; around 36% of consumers would put permission and separation first. |
| Managed recovery | Check which files the approved workflow covers, who restores them and which version-history or retention settings apply. | If an earlier file version disappears, I need an employer-supported way to restore it; roughly 29% of consumers would prioritise managed recovery. |
| Authorised offline access | Check the permitted device and interface, required encryption and who controls recovery access. | I may need a work file without connectivity, but only through a permitted offline process; around 21% of consumers would put authorised offline access first. |
| Secure account access | Confirm whether the employer supports FIDO2 keys, the required connection method and the replacement process. | Rather than carry another file copy, I need access to the approved account from each location; approximately 14% of consumers would prioritise secure sign-in. |
The Information Commissioner's Office identifies personally owned USB sticks and external hard drives as potential routes to insecure storage. The National Cyber Security Centre also notes that organisations may restrict peripheral access.
Ask the policy owner whether the task permits removable media and, if so, whether the device must be issued or allow-listed and how recovery is managed.
A drive bought for this task may be unusable if the employer does not permit it.
Encryption can protect data stored on a device, but it does not settle who may copy files, which data may be stored or how the organisation will recover them. A manufacturer's stated encryption feature is not an employer approval decision.
Compare encryption specifications only within a device class the employer has authorised, then check its access, recovery and data-handling requirements separately.
Microsoft documents administrative controls for OneDrive and SharePoint version history and retention. The settings that apply to your work files depend on the organisation's configuration.
Ask the service owner which folders are covered, who can restore files and what happens when a version is deleted before relying on sync as your recovery route.
A FIDO2 security key authenticates access to a supported account; it does not create a recoverable copy of work files.
Use an employer-approved key where the sign-in system supports it, and keep file recovery within the employer's approved backup workflow.
Relevant where an employer uses Microsoft 365, OneDrive, SharePoint or managed Windows devices for work files.
Relevant when an employer explicitly authorises a portable encrypted SSD for a defined work process.
Relevant when a PIN-authenticated USB drive is specifically permitted for work files.
No. Encryption can protect stored data if a drive is lost, but it does not provide employer approval, file-version recovery or an organisation-managed restoration process. Confirm those requirements before using removable media for work files.
Confirm the approved account, covered folders and who can restore files. For Microsoft OneDrive and SharePoint, Microsoft documents version-history limits at several administrative levels and retention through policies or labels, so ask which settings apply to your work files rather than assuming sync alone provides the recovery you need.
A BitLocker-encrypted drive that cannot unlock automatically needs its recovery key, according to Microsoft Support. For a managed work device, confirm with IT who holds that key and how recovery is authorised before relying on the drive for work files.
No. A FIDO2 security key helps authenticate sign-in to a supported service or device; it does not store a backup of your files. Use it only where your employer supports it, alongside the approved file-backup workflow.