In this guide you will learn how to implement ISO 27001 Annex A 6.7 and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.
Remote working is a work arrangement where employees perform their duties from a location other than a traditional office. This could be their home, a coffee shop, a co-working space, or any other location with a suitable internet connection. In ISO 27001 this is known as ISO27001:2022 Annex A 6.7 Remote Working. It is one of the 93 ISO 27001 Annex A controls.
Table of contents
- FREE ISO 27001 Annex A 6.7 Training Video
- Implementation Guide
- General Guidance
- ISO 27001 Remote Working Policy
- Information security implications of remote working
- Mitigating the security risks associated with remote working
- Physical security
- Communication security
- Remote access technology
- Unique unauthorised access
- Training
- Backup and business continuity
- Insurance
- Audit and security monitoring
- How to implement ISO 27001 Annex A 6.7
- How to pass the audit
- What the auditor will check
- Top 3 mistakes and how to avoid them
- ISO 27001 Annex A 6.7 FAQ
- Related ISO 27001 Controls
- ISO 27001 Annex A 6.7 Attributes Table
FREE ISO 27001 Annex A 6.7 Training Video
In this free training video you will learn How to implement ISO 27001 Remote Working (Annex A 6.7) and Pass Your Audit.
Implementation Guide
General Guidance
You are going to have to:
- implement a topic specific policy for remote working
- ensure that the information security for workers that are operating remotely is in place
- show that what you implement complies with local laws
- demonstrate that what you implement complies with local regulations
- ensure that it meets the needs of the organisation
- show that it addresses the organisational risks
This is whenever people work from a location outside of your organisations premises. This includes the old fashioned terms of teleworking and telecommuting as well as flexible workplace, fully remote, virtual work environment. They all relate, in essence, to the same thing. You will check local laws and regulations as not all recommendations and guidance can be applied every where. It is after all, general guidance.
ISO 27001 Remote Working Policy
You will need to implement a topic specific policy for remote working. The topic specific ISO 27001 Remote Working Policy Template is ready to go and fast track your implementation jam packed with everything you need.
Information security implications of remote working
The security risks associated with remote working include:
- Data breaches
- Cyberattacks
- Fraud
- Employee productivity loss
- Employee burnout
Mitigating the security risks associated with remote working
Organisations can mitigate the security risks associated with remote working by taking a number of steps, including:
- Implementing a remote working policy
- Implementing a remote working procedure
- Providing secure devices and applications to remote workers
- Ensuring that remote workers use strong passwords and authentication methods
- Educating remote workers about information security risks
- Monitoring and auditing remote working activities
Physical security
There are physical security considerations for remote working that include rules and associated mechanisms: such as lockable storage, filing cabinets, shredders, printers, transportation of physical media, clear desk, and disposal of media.
Consider the person and what they are doing, doing a mini risk assessment to understand the risks they are posed and then work to implement controls to mitigate those risks.
Good examples include remote printing. Not everyone will need to remote print but for those that do you can consider providing a company printer as well as a shredder.
Will the person have access to printed information, or letters and correspondence such as bank statements or contracts. Perhaps they will have to keep physical media. In this scenario we would consider providing lockable storage.
It may be the case, but not always, that people will have a home office. We can think about if having a lock is advisable based on what they do and access.
Be sensible and be practical.
Communication security
Based on the need for remote access to organisation systems and the classification of information to be processed, stored and / or transmitted you will consider the communications security requirements. This will be driven by and in conjunction with your IT and technical teams.
Remote access technology
Consider how the remote access will be implemented such as the use of VPN or virtual desktops. How the protection technology will be implemented such as firewalls and protection against malware. How deploying and initialising, managing and patching of devices will be performed. Technology requirements can be satisfied by engaging with your IT teams.
Unique unauthorised access
Unique to remote working is the threat posed by unauthorised access by friends and family members or from people / persons in public places. There may or may not be measures you need to put in place for this. People consider things like privacy screens or providing guidance on how best to position yourself and work in a public space. Guidance on taking and making calls can be provided that include not having confidential conversations in public places where people can be easily overheard. We have all been on a train when someone reads out their bank details or slags off a colleague on the phone. Don’t be that person.
Training
You will provide training on the ISO 27001 remote working policy and procedures. This will include guidance on how to work securely in a remote environment.
Backup and business continuity
Your backup and business continuity plans and processes will take into account remote working and the associated challenges. Consider things like mobile devices and if you do in fact back them up, or not.
Insurance
Often overlooked, you will ensure that you have appropriate insurance arrangements in place to cover remote working and the risks that it poses.
Audit and security monitoring
As part of your internal audit programme you will be performing remote audits for remote workers to check that they are operating in line with policy and process. This usually involves a remote interview over camera to view the working practices.
How to implement ISO 27001 Annex A 6.7
Implementing ISO 27001 Annex A 6.7 (Remote Working) requires a robust blend of organisational policy, technical hardening, and physical security awareness.
1. Formalise the Remote Working Policy
Develop and approve a comprehensive policy that defines the specific conditions and security requirements under which remote work is authorised.
- Define authorised devices, including company-issued hardware and Bring Your Own Device (BYOD) standards.
- Document the responsibilities of the remote worker regarding the protection of sensitive information.
- Establish clear rules for the use of public Wi-Fi and the requirement for encrypted connections.
- Specify the types of information that are permitted or prohibited for remote access based on data classification.
2. Conduct a Remote Working Risk Assessment
Perform a targeted risk assessment to identify vulnerabilities associated with remote environments and determine necessary mitigations.
- Identify threats such as physical theft of hardware, visual eavesdropping, and insecure network interception.
- Evaluate the security posture of home office environments and public workspaces.
- Assess the impact of potential data breaches originating from remote endpoints.
- Determine appropriate technical and physical controls to reduce identified risks to an acceptable level.
3. Provision Managed Endpoint Protection and MFA
Technical hardening of remote devices ensures that the endpoint remains resilient against malware and unauthorised access attempts.
- Deploy Mobile Device Management (MDM) or Enterprise Mobility Management (EMM) to enforce security configurations.
- Implement Multi-Factor Authentication (MFA) for all remote access points to corporate systems.
- Provision Full Disk Encryption (FDE) to protect data at rest in the event of hardware loss or theft.
- Ensure all endpoints have active Endpoint Detection and Response (EDR) software with automated update cycles.
4. Deploy Encrypted Communication Channels
Secure the transit of information between the remote worker and the corporate network using industry-standard encryption protocols.
- Mandate the use of a Virtual Private Network (VPN) with AES-256 encryption for all internal resource access.
- Configure split-tunnelling carefully to ensure sensitive traffic is always routed through the secure gateway.
- Utilise secure, encrypted messaging and video conferencing tools approved by the IT security team.
- Implement Identity and Access Management (IAM) roles to restrict remote access based on the principle of least privilege.
5. Establish Physical Security and Visual Privacy Protocols
Set mandatory physical standards for the remote workspace to prevent opportunistic theft or accidental data exposure.
- Require the use of privacy screen filters for personnel working in high-traffic or public areas.
- Mandate “Clear Screen” and “Clear Desk” habits, ensuring sessions are locked when the user is away from the device.
- Provision lockable storage or cabinets for any sensitive physical documents that must be handled remotely.
- Enforce a strict prohibition on leaving company hardware unattended in vehicles or public spaces.
6. Execute Periodic Compliance Audits and Awareness Training
Verification of adherence ensures the long-term effectiveness of the remote working controls and identifies areas for improvement.
- Deliver mandatory security awareness training focused specifically on remote working risks and social engineering.
- Review VPN and authentication logs regularly to identify anomalous login patterns or suspicious activity.
- Conduct periodic checks of MDM compliance reports to ensure encryption and patching levels remain active.
- Revoke remote access rights immediately upon termination of employment or a change in organisational role.
How to pass the audit
To comply with ISO 27001 Annex A 6.7 Remote Working you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:
- Write, sign off, implement and communicate your topic specific policy on remote working
- Write, sign off, implement and communicate your remote working procedures
- Consider the risks of physical security and provide assets that can mitigate the risk such as screen protectors, lockable cupboards, home shredders
- Implement communications technology that allows people to connect, use and communicate in the work environment
- Provide on going training and awareness of the risks and mitigations associated with remote working
- Consider the level to which remote working backup will or will not be implemented
- Ensure that appropriate insurance is in place
- Ensure that work environments meet all health and safety laws as well as local laws and regulations
- Implement a process of internal audit that checks that the appropriate controls are in place and effective and where they are not follow the continual improvement process to address the risks
To pass an audit of ISO 27001 Annex A 6.7 you are going to make sure that you have followed the steps above in how to comply.
What the auditor will check
The audit is going to check a number of areas for compliance with ISO 27001 Annex A 6.7. Lets go through them
1. That you have conducted audits of remote working
Remote working provides a unique challenge as it allows working in uncontrolled environments. As part of your risk assessment you will have selected the controls that you need based on risk. As part of your governance you will audit those controls based on the risk and at least annually to ensure that they are effective and operating as intended. You will keep records or audit as well as audit report and evidence that the audit reports were communicated to the right people. Where controls were seen to be in effective you will have evidence of continual improvement and risk management to show how you manage the nonconformity.
2. That you have appropriate technical controls in place
Due to the risks associated with remote working you will have evidenced that you have considered and chosen appropriate technologies to mitigate the risks. The audit will check the controls, that they appropriate, proportionate and in control. Evidence of reports, monitors and measures will be examined.
3. That people are aware of their responsibilities
The audit is going to check for documented processes, documented topic specific policy and these have been communicated and people have been trained on what is required of them.
Top 3 mistakes and how to avoid them
In my experience, the top 3 mistakes people make for ISO 27001 Annex A 6.7 Remote Working are
1. You have no evidence that anything actually happened
You need to keep records and minutes of everything. You need a paper trail to show it was done. Make sure you have updated communication plans and training plans on remote working. For the controls that you have implemented be able to sure the management monitors, reports and metrics. If it isn’t written down it didn’t happen.
2. One or more members of your team haven’t done what they should have done
Prior to the audit check that all members of the team have done what they should have. Do they know where the process documents are in relation to remote working? Do a pre audit as close to the audit as you can that checks the remote workers that will be involved. Assuming they are doing the right thing is a recipe for disaster. Check!
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Annex A 6.7 FAQ
Yes, Annex A 6.7 explicitly requires a documented policy that outlines the conditions, technical requirements, and responsibilities for remote work.
The policy must define authorised hardware and software for remote use.
It should specify the physical security standards for home environments.
Guidelines for handling sensitive physical documents must be included.
All remote workers must provide formal acknowledgement of these rules.
Technical controls for remote work must ensure secure communication and data protection through a combination of encryption and robust authentication.
VPN: Use an encrypted Virtual Private Network for all connections to corporate systems.
MFA: Implement Multi-Factor Authentication for all remote access points.
Encryption: Enforce full-disk encryption on all mobile devices and laptops.
Anti-malware: Maintain up-to-date endpoint protection and managed firewalls.
Physical security for remote work involves establishing a “Secure Zone” within the home or remote location to prevent unauthorised viewing or theft of data.
Encourage the use of privacy screens in public or shared spaces.
Require that laptops are never left unattended in vehicles or public areas.
Mandate the use of lockable cabinets for sensitive physical documents.
Implement “Clear Screen” habits to prevent visual eavesdropping by household members.
Yes, personal devices can be used, provided they are managed under a formal Bring Your Own Device (BYOD) policy and meet corporate security standards.
Utilise Mobile Device Management (MDM) to containerise corporate data.
Ensure personal devices meet minimum OS version and patching requirements.
Implement a remote-wipe capability for corporate data only.
Restrict the storage of sensitive company data directly on personal hard drives.
The primary risks associated with remote work include insecure network connections, physical theft of devices, and unauthorised visual access to sensitive data.
Increased exposure to Man-in-the-Middle (MitM) attacks on public Wi-Fi.
Higher probability of device loss or theft outside of controlled perimeters.
Lack of direct supervision over information handling and document disposal.
Potential for “shoulder surfing” in high-traffic remote locations.
Auditing remote work involves reviewing technical logs and conducting regular awareness checks to verify that security policies are being followed off-site.
Review VPN and MFA logs to identify anomalous login patterns.
Check MDM dashboards to ensure all remote devices remain encrypted and patched.
Conduct security awareness surveys or quizzes specifically focused on remote work.
Include remote working procedures in the annual internal ISMS audit.
Related ISO 27001 Controls
- ISO 27001 Clause 9.1 Monitoring, Measurement, Analysis, Evaluation
- ISO 27001 Clause 9.2 Internal Audit
- ISO 27001 Annex A 5.14 Information Transfer
- ISO 27001 Annex A 7.3 Securing Offices, Rooms And Facilities
- ISO 27001 Annex A 7.7 Clear Desk And Clear Screen
- ISO 27001 Annex A 8.1 User Endpoint Devices
- ISO 27001 Annex A 8.7 Protection Against Malware
- ISO 27001 Annex A 8.12 Data Leakage Prevention
- ISO 27001 Annex A 8.15 Logging
- ISO 27001 Annex A 8.16 Monitoring Activities
- ISO 27001 Annex A 8.20 Network SecurityISO 27001 Annex A 8.20 Network Security
ISO 27001 Annex A 6.7 Attributes Table
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
| Preventive | Availability Confidentiality Integrity | Protect | Asset Management Information protection Physical security System and Network security | Protection |
Stuart Barker
I am the ISO 27001 Ninja.
I help tech companies, start-ups, and small businesses implement information security management systems without the corporate bloat or massive consultant fees.
If you want to pass your audit the first time, book a call.
