Key takeaways
- Put security measures in place for people working outside the office.
- Remote work moves information out of controlled offices.
- Start here: write a remote working policy covering devices, networks and physical privacy.
Purpose
Put security measures in place for people working outside the office.
Requirement
Requirement summarySecurity measures shall be implemented when personnel are working remotely to protect information accessed, processed or stored outside the organization’s premises.
Why it matters
Remote work moves information out of controlled offices. Controls must follow the person.
How to implement
- Write a remote working policy covering devices, networks and physical privacy.
- Require managed, encrypted devices and secure connections.
- Explain how to handle printed material and conversations at home.
- Check compliance through device management.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 6.7. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your remote working policy: rules for working from home or other locations.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.6.7 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of devices showing they meet the rules (encrypted, auto-locking, up to date).
- Proof staff have accepted the remote working rules.
- Settings showing remote access uses secure connections and multi-factor login.
Things you should be able to show or explain
- Remote staff should be able to explain how they keep information safe at home and in public.
How much to show: A handful of remote workers and their devices.
Common mistakes
- Personal, unmanaged devices used for confidential work.
- No guidance for working in public places.
- Allowing unmanaged personal devices without controls.
- Policy silent on working in public places.
- Tip: Publish a remote working policy covering devices, Wi-Fi and screens.
Policies & documents to have
- Access Control Policy
- Information Security Policy
FAQ
Is A.6.7 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.6.7?
Be ready to explain how the control works in your organisation and to provide things like: Your remote working policy: rules for working from home or other locations…