EvidenceSheet

6.7 Remote working

Requires security measures to be implemented when personnel work remotely, protecting information that is accessed, processed or stored outside the organisation's premises.

5
artefacts
1
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review

system holds itEvidence a system already holds

  • Technical measures evidence, such as device encryption, endpoint protection, secure remote access configuration and enforced patching for remote devices · Vulnerability scanner / patch tooling

periodic reviewEvidence produced at each review

  • Evidence of protection where personally owned devices are used, including separation of organisational information · Endpoint management (MDM / EDR)
  • Records of approval for remote working arrangements and of review of them · Document repository

governing documentDocuments that govern the control

  • The remote working rules, covering approval, permitted locations, equipment, network use and handling of physical material · Policy repository / GRC workspace
  • Guidance and evidence on the physical environment, covering screen visibility, secure storage of documents and use of public spaces · Policy repository / GRC workspace

First move

Mostly documents and reviews. Pull the 1 system-held artefact from your Vulnerability scanner / patch tooling on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Common gaps auditors find

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

6.6 Confidentiality or non-disclosure agreements · 6.8 Information security event reporting