A.6.7
Remote working
People controlsCheckpoints 6Evidence 7Cases 6
Control objective
This control ensures that information accessed, processed, or stored by personnel working outside the organization's physical boundary (home, in transit, client sites, shared offices) is protected to the same level as on-premises work. Remote environments carry greater exposure than the office because of uncontrolled networks, spaces shared with family or others, and devices prone to loss or theft, so the organization must define in advance the conditions under which remote working is permitted and the technical, physical, and procedural safeguards to be applied. The aim is to preserve the confidentiality, integrity, and availability of information and to keep access controlled regardless of where work is performed.
Key checkpoints
- Is there a policy/procedure defining the conditions, scope, and approval process for remote working and the security requirements to be met?
- When accessing internal systems/data from remote locations, are secure connections (such as VPN) and strengthened authentication (such as multi-factor) enforced?
- Are security requirements (encryption, anti-malware, screen lock, patching) defined and checked for devices used in remote work, whether company-issued or personally owned (BYOD)?
- Are physical safeguards in place for the environment (screen exposure in shared spaces, handling of printouts/storage media, response to loss/theft)?
- Are remote workers' rights and logs managed/monitored, and are rights and assets no longer needed reclaimed when remote working ends or duties change?
- Are remote workers trained on the relevant policy and incident reporting procedures, and is compliance checked?
Implementation guidance
- Establish a policy that specifies who/where/under what conditions remote working is permitted, the approval and exception process, and the permitted devices and services, and obtain management approval.
- Enforce encrypted communication channels such as VPN and multi-factor authentication for access to internal resources from remote locations, and restrict target/time/network where needed.
- Apply device-appropriate baselines for encryption, malware protection, screen locking, and patching. For remote wipe, check device support, connectivity, and authorized scope, and prepare alternatives such as access blocking when wiping cannot be performed.
- For BYOD, define work/personal separation, access scope, local storage conditions, and monitoring/deletion authority, with required consent/authorization. Prevent collection or deletion of personal information and content beyond the approved scope.
- Advise on physical and network practices such as preventing shoulder-surfing in shared/public spaces (privacy filters, seating), controlling printouts/removable media, and limiting use of public Wi-Fi.
- Provide immediate reporting procedures and contacts for loss, theft, or disclosure. Revoke sessions/tokens and block access, and perform remote locking/wiping according to device support and authorized scope, verifying results.
- Reassess business needs when remote working ends or duties change; revoke unnecessary remote access and identify assets and work data for return/deletion. Retain still-needed work privileges and required records within approved scope.
Evidence
- Remote working policy/procedure and management approval document
- Remote working application/approval records and list of approved personnel
- VPN/multi-factor authentication configuration and remote access logs
- Remote device security baselines and check results (encryption, anti-malware, patch status)
- BYOD conditions, user consent forms, and access-scope configuration
- Security training materials for remote workers and completion records
- Access-rights reclamation and asset-return records at end of remote working
Nonconformity examples
- Remote working is widely practiced, but there is no governing policy or approval process, so no control basis can be confirmed.
- Remote access lacks required encryption or strengthened authentication, exposing internal information to unauthorized access.
- Remote devices have no disk encryption or screen lock, so information leakage is not controlled if a device is lost or stolen.
- Personally owned devices (BYOD) are used for work without separate conditions or consent, and data is stored/retained on personal devices.
- Access logs of remote workers are not collected or monitored, so anomalous access cannot be detected.
- Unneeded rights remain after remote working ends, or assets and work data designated for return/deletion are not recovered.