Remote working

What the requirement asks

Where personnel work remotely, security measures are to be applied to protect information that is accessed, processed or held away from the organization's premises. Purpose: keep information secure during remote working. Guidance: remote working means working from anywhere outside the premises with access to paper or electronic information, including teleworking, telecommuting, flexible workplaces, virtual environments and remote maintenance; local law may prevent some measures. Organizations allowing it issue a topic-specific remote working policy setting conditions and restrictions. Matters to weigh include: the physical security of the remote site and its surroundings, including the jurisdictions people are in; rules and mechanisms there such as lockable storage, secure transport between locations, and rules on remote access, clear desk, printing, disposal and event reporting (6.8); the physical environments expected; communications security given the systems reached, the sensitivity of information passed and of the systems and applications; remote access methods such as virtual desktops that allow work on privately owned equipment; the risk of access by others at the site, such as family and friends, or by people in public places; use of home and public networks and rules on wireless configuration; firewalls and anti-malware; secure remote deployment and initialization of systems; and secure authentication and privilege enablement, bearing in mind the weakness of single-factor authentication for network access. Measures include: providing equipment and storage furniture where private equipment is not allowed; defining the permitted work, the classification of information that may be held and the systems the worker may use; training for remote workers and their support staff on working securely; suitable communication equipment with secured remote access, screen locks, inactivity timeouts, location tracking and remote wipe; physical security; rules on what household members and visitors may see or touch; hardware and software support and maintenance; insurance; backup and continuity procedures; audit and security monitoring; and withdrawing authority and access and recovering equipment when remote working ends. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Remote working moves the perimeter. The guidance asks for the rules, the equipment, the network, the physical setting and the support route.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible and one live sample together.

Evidence an assessor asks for

• Remote working policyThe topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
• Remote working policyRemote access configuration showing multi-factor authentication, secure channels or virtual desktops
• Remote working policyEndpoint configuration for remote devices: screen lock, inactivity timeout, firewall, anti-malware, encryption, location tracking and remote wipe
• Remote working policyTraining records for remote workers and support staff on secure remote working
• Remote working policyRules for home and public network use, printing, disposal and family or visitor access
• Remote working policyRecords of revoking access and recovering equipment when remote working arrangements end

The question an assessor will ask

An assessor will ask for the topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible, then trace it to the system it protects. For A.6.7 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Remote access relies on a password alone
• Personally owned devices are used with no control over what information they store
• Remote workers print and dispose of sensitive documents at home without any rules
• Monitoring and backup do not extend to remote endpoints

Before the next audit

Before the next audit, check one live sample for this gap: remote access relies on a password alone.