ISO 27001 Annex A 6.7 Audit Checklist

In this ultimate how to audit guide to ISO 27001 Annex A 6.7 Remote Working, you will learn directly from an ISO 27001 Lead Auditor:

• 10 Key Audit Steps
• Verification Criteria
• Required Evidence
• The Pass / Fail Test

I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.

Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.

Auditing ISO 27001 Annex A 6.7 Remote Working is the technical evaluation of security controls applied to off-site operations. The Primary Implementation Requirement involves enforcing endpoint encryption and multi-factor authentication, ensuring the Business Benefit of maintaining information integrity and confidentiality regardless of the physical location of the personnel.

ISO 27001 Annex A 6.7 Remote Working Audit Checklist

This technical verification tool is designed for lead auditors to establish the security integrity of off-site operations. Use this checklist to validate compliance with ISO 27001 Annex A 6.7.

1. Remote Working Policy Formalisation Verified

Verification Criteria: A documented policy exists that defines the security requirements for working from remote locations, including physical security and technical access controls.

Required Evidence: Approved Remote Working Policy with explicit version control and senior management sign-off.

Pass/Fail Test: If the organisation cannot produce a formal policy specifically addressing remote work risks, mark as Non-Compliant.

2. Endpoint Encryption Enforcement Confirmed

Verification Criteria: All corporate devices used for remote work must have full-disk encryption (FDE) enabled to protect data in the event of theft or loss.

Required Evidence: MDM (Mobile Device Management) reports or configuration screenshots showing BitLocker, FileVault, or equivalent status as ‘Active’ for all remote endpoints.

Pass/Fail Test: If a sample of remote laptops shows that disk encryption is disabled or not managed centrally, mark as Non-Compliant.

3. Multi-Factor Authentication (MFA) Implementation Validated

Verification Criteria: Secure remote access to organisational systems must be protected by robust multi-factor authentication.

Required Evidence: IAM (Identity and Access Management) configuration logs showing mandatory MFA for VPN, SaaS applications, and VDI environments.

Pass/Fail Test: If remote access to the corporate network or primary cloud environment allows for single-factor (password-only) authentication, mark as Non-Compliant.

4. Physical Security Requirements for Remote Locations Verified

Verification Criteria: The organisation defines clear expectations for the physical protection of assets at remote sites, such as the use of privacy screens and secure storage.

Required Evidence: Remote Working Agreement or Employee Handbook sections detailing physical security mandates for the home/off-site office.

Pass/Fail Test: If the policy is silent on the physical protection of hardware and sensitive documents in a remote setting, mark as Non-Compliant.

5. Secure Communication Channel Usage Confirmed

Verification Criteria: Technical controls are in place to ensure that all data transmitted from remote locations is encrypted using secure tunnels.

Required Evidence: VPN configuration standards or evidence of ‘Always-on’ VPN/SD-WAN deployment on remote assets.

Pass/Fail Test: If remote users access internal file shares or databases over unencrypted public internet connections, mark as Non-Compliant.

6. Split Tunnelling and Web Filtering Controls Validated

Verification Criteria: Remote assets maintain the same level of web filtering and DNS protection as on-premise assets to prevent malware infection.

Required Evidence: Web Proxy or DNS filtering logs (e.g. Cisco Umbrella, Zscaler) showing active enforcement for off-network devices.

Pass/Fail Test: If remote devices bypass corporate web filtering and security policies when disconnected from the VPN, mark as Non-Compliant.

7. Personal Device (BYOD) Usage Restrictions Verified

Verification Criteria: The use of personal devices for work purposes is either prohibited or governed by strict technical controls (e.g. MAM – Mobile Application Management).

Required Evidence: BYOD Policy or MDM configuration showing containerisation of corporate data on personal assets.

Pass/Fail Test: If staff can download and store corporate data on unmanaged personal devices without technical restriction, mark as Non-Compliant.

8. Remote Incident Reporting Awareness Confirmed

Verification Criteria: Remote workers demonstrate clear knowledge of how to report a security incident (e.g. lost laptop, suspected phishing) from off-site.

Required Evidence: Staff interview records or internal ‘Security Awareness’ portal containing specific remote-reporting instructions.

Pass/Fail Test: If sampled remote employees cannot identify the 24/7 security reporting channel, mark as Non-Compliant.

9. Antivirus and Patch Compliance Monitoring Verified

Verification Criteria: Remote devices are subject to the same patching and antivirus update standards as on-premise hardware.

Required Evidence: Patch management dashboard showing ‘Compliant’ status for devices that have not connected to the local office in >30 days.

Pass/Fail Test: If remote endpoints consistently show outdated patches or signatures due to a lack of cloud-based update management, mark as Non-Compliant.

10. Secure Remote Support Protocols Validated

Verification Criteria: Procedures for providing remote IT support ensure that technicians are authenticated and remote control sessions are logged.

Required Evidence: Remote Support tool logs (e.g. TeamViewer, LogMeIn) showing session timestamps and technician IDs.

Pass/Fail Test: If remote support tools allow unattended access to endpoints without a secure, audited authorisation process, mark as Non-Compliant.

Control Requirement	The ‘Checkbox Compliance’ Trap	The Reality Check
Policy Access	Tool marks “Compliant” because a “Remote Work” file exists in the GRC library.	Verify the date. If the policy pre-dates the move to permanent remote work, it likely misses current cloud risks.
MFA Enforcement	GRC dashboard shows “MFA Enabled” for the primary SaaS tenant.	Check the exclusions. Auditors often find “privileged bypass” groups for senior staff that are never reported by the tool.
Device Hygiene	Tool pulls an API green light for “Antivirus Installed”.	Check the last seen date. A remote device can be “compliant” in the DB but have 6-month-old signatures if it hasn’t synced.
Data Residency	Assuming cloud storage is inherently safe for remote work.	Verify offline files. Check if sensitive data is cached locally on unencrypted SSDs or synced to personal OneDrive accounts.
Asset Tracking	Platform assumes all assets are in the office.	Demand the Physical Verification Log. How does the company know the laptop hasn’t been sold if it hasn’t connected for 90 days?
BYOD Risk	Tool records that a BYOD policy was “Read”.	Verify Endpoint Segregation. Does the company use MAM/MIP to prevent data ‘sharing’ between Outlook and personal TikTok/WhatsApp?
Network Security	Platform identifies “VPN Active” status.	Verify DNS Leakage. Check if remote devices use ISP DNS (unfiltered) or secure corporate DNS for non-VPN traffic.

About the author