What evidence do auditors commonly ask for on 6.7 Remote working?

The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible; Remote access configuration showing multi-factor authentication, secure channels or virtual desktops; Endpoint configuration for remote devices: screen lock, inactivity timeout, firewall, anti-malware, encryption, location tracking and remote wipe; Training records for remote workers and support staff on secure remote working; Rules for home and public network use, printing, disposal and family or visitor access; Records of revoking access and recovering equipment when remote working arrangements end.

What is the most common gap auditors find on 6.7?

Remote access relies on a password alone

ISO/IEC 27002:2022 · People controls

`6.7` Remote working

Where personnel work remotely, security measures are to be applied to protect information that is accessed, processed or held away from the organization's premises. Purpose: keep information secure during remote working. Guidance: remote working means working from anywhere outside the premises with access to paper or electronic information, including teleworking, telecommuting, flexible workplaces, virtual environments and remote maintenance; local law may prevent some measures. Organizations allowing it issue a topic-specific remote working policy setting conditions and restrictions. Matters to weigh include: the physical security of the remote site and its surroundings, including the jurisdictions people are in; rules and mechanisms there such as lockable storage, secure transport between locations, and rules on remote access, clear desk, printing, disposal and event reporting (6.8); the physical environments expected; communications security given the systems reached, the sensitivity of information passed and of the systems and applications; remote access methods such as virtual desktops that allow work on privately owned equipment; the risk of access by others at the site, such as family and friends, or by people in public places; use of home and public networks and rules on wireless configuration; firewalls and anti-malware; secure remote deployment and initialization of systems; and secure authentication and privilege enablement, bearing in mind the weakness of single-factor authentication for network access. Measures include: providing equipment and storage furniture where private equipment is not allowed; defining the permitted work, the classification levels of information allowed to be held and the systems the worker may use; training for remote workers and their support staff on working securely; suitable communication equipment with secured remote access, screen locks, inactivity timeouts, location tracking and remote wipe; physical security; rules on what household members and visitors may see or touch; hardware and software support and maintenance; insurance; backup and continuity procedures; audit and security monitoring; and withdrawing authority and access and recovering equipment when remote working ends.

Source: ISO/IEC 27002:2022, 6.7. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.

artefacts

held by a system

at each review

easy

to go live

Identity provider / directory

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Remote access configuration showing multi-factor authentication, secure channels or virtual desktops · Identity provider / directory
Endpoint configuration for remote devices: screen lock, inactivity timeout, firewall, anti-malware, encryption, location tracking and remote wipe · Endpoint management (MDM / EDR)
Rules for home and public network use, printing, disposal and family or visitor access · Physical access / facilities

periodic reviewEvidence produced at each review

Training records for remote workers and support staff on secure remote working · HR system / LMS
Records of revoking access and recovering equipment when remote working arrangements end · Policy repository / GRC workspace

governing documentDocuments that govern the control

The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible · Policy repository / GRC workspace

First move

Automate the pull from your Identity provider / directory. Scheduled export of users, roles and MFA state from the directory; access-review completion pulled from the IdP, not a spreadsheet.

Common gaps auditors find

Remote access relies on a password alone
Personally owned devices are used with no control over what information they store
Remote workers print and dispose of sensitive documents at home without any rules
Monitoring and backup do not extend to remote endpoints

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

6.6 Confidentiality or non-disclosure agreements · 6.8 Information security event reporting