6.7 Remote working
Requires security measures to be implemented when personnel work remotely, protecting information that is accessed, processed or stored outside the organisation's premises.
5
artefacts
1
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Technical measures evidence, such as device encryption, endpoint protection, secure remote access configuration and enforced patching for remote devices · Vulnerability scanner / patch tooling
periodic reviewEvidence produced at each review
- Evidence of protection where personally owned devices are used, including separation of organisational information · Endpoint management (MDM / EDR)
- Records of approval for remote working arrangements and of review of them · Document repository
governing documentDocuments that govern the control
- The remote working rules, covering approval, permitted locations, equipment, network use and handling of physical material · Policy repository / GRC workspace
- Guidance and evidence on the physical environment, covering screen visibility, secure storage of documents and use of public spaces · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Vulnerability scanner / patch tooling on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Rules assume the corporate laptop while personally owned devices access the same information under no measure
- Remote access secured while physical aspects such as printing at home and visibility of screens are unaddressed
- Devices that rarely connect to the corporate network drifting out of patch and configuration compliance unnoticed
- Working from other countries permitted informally with no assessment of the legal and data transfer consequences
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.6 Confidentiality or non-disclosure agreements · 6.8 Information security event reporting