Remote working
Purpose
Keep information secure when staff are working away from the organisation premises.
How to meet this control
In short: Implement security measures for staff working remotely.
- Step 01Publish a remote-working policy covering device encryption, VPN, MFA, home-network setup and acceptable physical conditions for handling information
- Step 02Enrol all remote endpoints in MDM such as Intune or Jamf to enforce disk encryption, screen lock, patching and remote wipe
- Step 03Require connection to corporate resources through a VPN or zero-trust access broker with MFA rather than direct exposure
- Step 04Issue managed equipment where possible and restrict use of personal devices, with separation of work and personal data for any BYOD
- Step 05Train remote workers on shoulder-surfing, secure storage, privacy screens and avoiding confidential calls in public spaces
- Step 06Cover the return or wipe of equipment when remote staff leave or change roles
Tip: Cover device encryption, VPN/MFA, and home-network guidance in a remote-work policy.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Issue a topic-specific remote working policy setting out conditions and restrictions
- ›Consider physical security of the remote location and add measures like lockable storage and clear desk
- ›Address communications security based on the sensitivity of the information accessed remotely
- ›Manage the risk of others, such as family or people in public, seeing or accessing information
- ›Set requirements for home and public network use and secure wireless configuration
- ›Use protective measures such as firewalls, anti-malware and strong (not single-factor) authentication
- ›Provide suitable equipment and storage, restrict personal device use, and train remote workers
- ›Require screen locks, inactivity timers, location tracking and remote wipe, and cover equipment return
Audit evidence to keep
- - The remote-working or work-from-home policy
- - MDM configuration showing enforced encryption, lock and remote-wipe settings
- - VPN and MFA enrolment records for remote staff
- - Signed acknowledgement of the remote-working policy by employees
- - Records of equipment issue and return for remote workers
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.6.7. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.