The ultimate audit guide to ISO 27001 Annex A 6.7 Remote working – new
Table of contents
- 1. Remote Working Policy Formalisation Verified
- 2. Endpoint Encryption Enforcement Confirmed
- 3. Multi-Factor Authentication (MFA) Implementation Validated
- 4. Physical Security Requirements for Remote Locations Verified
- 5. Secure Communication Channel Usage Confirmed
- 6. Split Tunnelling and Web Filtering Controls Validated
- 7. Personal Device (BYOD) Usage Restrictions Verified
- 8. Remote Incident Reporting Awareness Confirmed
- 9. Antivirus and Patch Compliance Monitoring Verified
- 10. Secure Remote Support Protocols Validated
1. Remote Working Policy Formalisation Verified
Verification Criteria: A documented policy exists that defines the security requirements for working from remote locations, including physical security and technical access controls.
Required Evidence: Approved Remote Working Policy with explicit version control and senior management sign-off.
Pass/Fail Test: If the organisation cannot produce a formal policy specifically addressing remote work risks, mark as Non-Compliant.
2. Endpoint Encryption Enforcement Confirmed
Verification Criteria: All corporate devices used for remote work must have full-disk encryption (FDE) enabled to protect data in the event of theft or loss.
Required Evidence: MDM (Mobile Device Management) reports or configuration screenshots showing BitLocker, FileVault, or equivalent status as ‘Active’ for all remote endpoints.
Pass/Fail Test: If a sample of remote laptops shows that disk encryption is disabled or not managed centrally, mark as Non-Compliant.
3. Multi-Factor Authentication (MFA) Implementation Validated
Verification Criteria: Secure remote access to organisational systems must be protected by robust multi-factor authentication.
Required Evidence: IAM (Identity and Access Management) configuration logs showing mandatory MFA for VPN, SaaS applications, and VDI environments.
Pass/Fail Test: If remote access to the corporate network or primary cloud environment allows for single-factor (password-only) authentication, mark as Non-Compliant.
4. Physical Security Requirements for Remote Locations Verified
Verification Criteria: The organisation defines clear expectations for the physical protection of assets at remote sites, such as the use of privacy screens and secure storage.
Required Evidence: Remote Working Agreement or Employee Handbook sections detailing physical security mandates for the home/off-site office.
Pass/Fail Test: If the policy is silent on the physical protection of hardware and sensitive documents in a remote setting, mark as Non-Compliant.
5. Secure Communication Channel Usage Confirmed
Verification Criteria: Technical controls are in place to ensure that all data transmitted from remote locations is encrypted using secure tunnels.
Required Evidence: VPN configuration standards or evidence of ‘Always-on’ VPN/SD-WAN deployment on remote assets.
Pass/Fail Test: If remote users access internal file shares or databases over unencrypted public internet connections, mark as Non-Compliant.
6. Split Tunnelling and Web Filtering Controls Validated
Verification Criteria: Remote assets maintain the same level of web filtering and DNS protection as on-premise assets to prevent malware infection.
Required Evidence: Web Proxy or DNS filtering logs (e.g. Cisco Umbrella, Zscaler) showing active enforcement for off-network devices.
Pass/Fail Test: If remote devices bypass corporate web filtering and security policies when disconnected from the VPN, mark as Non-Compliant.
7. Personal Device (BYOD) Usage Restrictions Verified
Verification Criteria: The use of personal devices for work purposes is either prohibited or governed by strict technical controls (e.g. MAM – Mobile Application Management).
Required Evidence: BYOD Policy or MDM configuration showing containerisation of corporate data on personal assets.
Pass/Fail Test: If staff can download and store corporate data on unmanaged personal devices without technical restriction, mark as Non-Compliant.
8. Remote Incident Reporting Awareness Confirmed
Verification Criteria: Remote workers demonstrate clear knowledge of how to report a security incident (e.g. lost laptop, suspected phishing) from off-site.
Required Evidence: Staff interview records or internal ‘Security Awareness’ portal containing specific remote-reporting instructions.
Pass/Fail Test: If sampled remote employees cannot identify the 24/7 security reporting channel, mark as Non-Compliant.
9. Antivirus and Patch Compliance Monitoring Verified
Verification Criteria: Remote devices are subject to the same patching and antivirus update standards as on-premise hardware.
Required Evidence: Patch management dashboard showing ‘Compliant’ status for devices that have not connected to the local office in >30 days.
Pass/Fail Test: If remote endpoints consistently show outdated patches or signatures due to a lack of cloud-based update management, mark as Non-Compliant.
10. Secure Remote Support Protocols Validated
Verification Criteria: Procedures for providing remote IT support ensure that technicians are authenticated and remote control sessions are logged.
Required Evidence: Remote Support tool logs (e.g. TeamViewer, LogMeIn) showing session timestamps and technician IDs.
Pass/Fail Test: If remote support tools allow unattended access to endpoints without a secure, audited authorisation process, mark as Non-Compliant.
About the author
