Auditing ISO 27001 Annex A 6.7 Remote Working is the technical evaluation of security controls applied to off-site operations. The Primary Implementation Requirement involves enforcing endpoint encryption and multi-factor authentication, ensuring the Business Benefit of maintaining information integrity and confidentiality regardless of the physical location of the personnel.
ISO 27001 Annex A 6.7 Remote Working Audit Checklist
This technical verification tool is designed for lead auditors to establish the security integrity of off-site operations. Use this checklist to validate compliance with ISO 27001 Annex A 6.7.
1. Remote Working Policy Formalisation Verified
Verification Criteria: A documented policy exists that defines the security requirements for working from remote locations, including physical security and technical access controls.
Required Evidence: Approved Remote Working Policy with explicit version control and senior management sign-off.
Pass/Fail Test: If the organisation cannot produce a formal policy specifically addressing remote work risks, mark as Non-Compliant.
2. Endpoint Encryption Enforcement Confirmed
Verification Criteria: All corporate devices used for remote work must have full-disk encryption (FDE) enabled to protect data in the event of theft or loss.
Required Evidence: MDM (Mobile Device Management) reports or configuration screenshots showing BitLocker, FileVault, or equivalent status as ‘Active’ for all remote endpoints.
Pass/Fail Test: If a sample of remote laptops shows that disk encryption is disabled or not managed centrally, mark as Non-Compliant.
3. Multi-Factor Authentication (MFA) Implementation Validated
Verification Criteria: Secure remote access to organisational systems must be protected by robust multi-factor authentication.
Required Evidence: IAM (Identity and Access Management) configuration logs showing mandatory MFA for VPN, SaaS applications, and VDI environments.
Pass/Fail Test: If remote access to the corporate network or primary cloud environment allows for single-factor (password-only) authentication, mark as Non-Compliant.
4. Physical Security Requirements for Remote Locations Verified
Verification Criteria: The organisation defines clear expectations for the physical protection of assets at remote sites, such as the use of privacy screens and secure storage.
Required Evidence: Remote Working Agreement or Employee Handbook sections detailing physical security mandates for the home/off-site office.
Pass/Fail Test: If the policy is silent on the physical protection of hardware and sensitive documents in a remote setting, mark as Non-Compliant.
5. Secure Communication Channel Usage Confirmed
Verification Criteria: Technical controls are in place to ensure that all data transmitted from remote locations is encrypted using secure tunnels.
Required Evidence: VPN configuration standards or evidence of ‘Always-on’ VPN/SD-WAN deployment on remote assets.
Pass/Fail Test: If remote users access internal file shares or databases over unencrypted public internet connections, mark as Non-Compliant.
6. Split Tunnelling and Web Filtering Controls Validated
Verification Criteria: Remote assets maintain the same level of web filtering and DNS protection as on-premise assets to prevent malware infection.
Required Evidence: Web Proxy or DNS filtering logs (e.g. Cisco Umbrella, Zscaler) showing active enforcement for off-network devices.
Pass/Fail Test: If remote devices bypass corporate web filtering and security policies when disconnected from the VPN, mark as Non-Compliant.
7. Personal Device (BYOD) Usage Restrictions Verified
Verification Criteria: The use of personal devices for work purposes is either prohibited or governed by strict technical controls (e.g. MAM – Mobile Application Management).
Required Evidence: BYOD Policy or MDM configuration showing containerisation of corporate data on personal assets.
Pass/Fail Test: If staff can download and store corporate data on unmanaged personal devices without technical restriction, mark as Non-Compliant.
8. Remote Incident Reporting Awareness Confirmed
Verification Criteria: Remote workers demonstrate clear knowledge of how to report a security incident (e.g. lost laptop, suspected phishing) from off-site.
Required Evidence: Staff interview records or internal ‘Security Awareness’ portal containing specific remote-reporting instructions.
Pass/Fail Test: If sampled remote employees cannot identify the 24/7 security reporting channel, mark as Non-Compliant.
9. Antivirus and Patch Compliance Monitoring Verified
Verification Criteria: Remote devices are subject to the same patching and antivirus update standards as on-premise hardware.
Required Evidence: Patch management dashboard showing ‘Compliant’ status for devices that have not connected to the local office in >30 days.
Pass/Fail Test: If remote endpoints consistently show outdated patches or signatures due to a lack of cloud-based update management, mark as Non-Compliant.
10. Secure Remote Support Protocols Validated
Verification Criteria: Procedures for providing remote IT support ensure that technicians are authenticated and remote control sessions are logged.
Required Evidence: Remote Support tool logs (e.g. TeamViewer, LogMeIn) showing session timestamps and technician IDs.
Pass/Fail Test: If remote support tools allow unattended access to endpoints without a secure, audited authorisation process, mark as Non-Compliant.
| Control Requirement | The ‘Checkbox Compliance’ Trap | The Reality Check |
|---|---|---|
| Policy Access | Tool marks “Compliant” because a “Remote Work” file exists in the GRC library. | Verify the date. If the policy pre-dates the move to permanent remote work, it likely misses current cloud risks. |
| MFA Enforcement | GRC dashboard shows “MFA Enabled” for the primary SaaS tenant. | Check the exclusions. Auditors often find “privileged bypass” groups for senior staff that are never reported by the tool. |
| Device Hygiene | Tool pulls an API green light for “Antivirus Installed”. | Check the last seen date. A remote device can be “compliant” in the DB but have 6-month-old signatures if it hasn’t synced. |
| Data Residency | Assuming cloud storage is inherently safe for remote work. | Verify offline files. Check if sensitive data is cached locally on unencrypted SSDs or synced to personal OneDrive accounts. |
| Asset Tracking | Platform assumes all assets are in the office. | Demand the Physical Verification Log. How does the company know the laptop hasn’t been sold if it hasn’t connected for 90 days? |
| BYOD Risk | Tool records that a BYOD policy was “Read”. | Verify Endpoint Segregation. Does the company use MAM/MIP to prevent data ‘sharing’ between Outlook and personal TikTok/WhatsApp? |
| Network Security | Platform identifies “VPN Active” status. | Verify DNS Leakage. Check if remote devices use ISP DNS (unfiltered) or secure corporate DNS for non-VPN traffic. |
About the author
