The National Cyber Emergency Response Team (National CERT) has directed government employees to use only department-approved virtual private networks (VPNs) when accessing official systems remotely.

According to the National Cybersecurity Handbook 2026–27, approved VPNs create secure connections that help protect government data from unauthorized access and interception.

The guidelines require employees to use strong passwords, end remote sessions after completing official work and contact their IT or cybersecurity teams if VPN connections repeatedly fail or become unstable.

Staff have also been told not to use unauthorized VPNs or proxy applications for official tasks. They must not disable antivirus software, firewalls or other security tools to improve VPN performance, leave active sessions unattended on unlocked devices or share their login details.

National CERT warned that exposing government services directly to the internet could increase the risk of cyberattacks. Weak remote-access security could leave government networks vulnerable to password-guessing attacks, ransomware and unauthorized access that allows attackers to remain inside systems undetected.

The handbook sets out cybersecurity measures for federal and provincial government departments and other public-sector organizations, including safeguards for employees accessing official systems outside their workplaces.