Remote Working Policy Template (ISO/IEC 27001 A.6.7)

Remote Working Policy: [Organization name]

Topic-specific policy for working outside the organization's premises: at home, while travelling, at client sites and in shared spaces. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A control A.6.7 (remote working), together with A.7.9 (assets used off-premises), A.8.1 (user endpoint devices) and A.6.8 (reporting security events). Control guidance is in ISO/IEC 27002:2022. Replace every [bracketed] value and every row marked Example. Where the policy touches employment terms or workplace monitoring, it is a documentation format, not legal advice.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Principles and roles
3. Eligibility and work arrangements
4. Devices and equipment
5. Network and connectivity
6. Physical environment at the remote location
7. Travel and working abroad
8. Information handling away from the office
9. Monitoring and transparency
10. Reporting incidents and lost devices
11. Exceptions and non-compliance
12. Size tiers
13. Records and evidence
14. Review, measurement and maintenance
15. References

1. Purpose and scope

This policy sets the security rules that apply whenever people work on [Organization name] information or systems outside premises controlled by the organization. It protects the confidentiality, integrity and availability of information when the physical and network controls of the office are not present, and it makes the responsibilities of the organization and of each person clear.

Remote working in this policy includes:

• regular or occasional work from a home or other private residence;
• work while travelling, including on public transport, in hotels, airports and cafes;
• work at customer, partner or supplier sites that the organization does not control;
• work from shared or co-working spaces;
• access to work email, chat or files from a mobile device outside the office, however short.

The policy applies to all employees, contractors, interns and temporary staff who access [Organization name] information. Suppliers whose staff work remotely on the organization's systems follow equivalent rules set in their contracts (see isms/supplier-security-agreement-27036).

Out of scope: the security of office premises (covered by isms/physical-security-policy) and the technical configuration of remote access services (covered by isms/network-security-standard and isms/secure-configuration-baseline), which this policy relies on.

2. Principles and roles

2.1 Principles

1. Same protection, different place. Information keeps its classification and handling rules wherever it is used (isms/information-labelling-handling-procedure).
2. Managed access only. Remote access to internal systems uses organization-approved devices or approved access methods with multi-factor authentication.
3. Risk-based eligibility. The more sensitive the role or information, the stricter the conditions for working remotely.
4. Transparency. People are told in advance what is monitored, why and how the data is used.
5. Report early. A lost device, an overheard call or a suspicious message is reported at once, without fear of blame for reporting.

2.2 Roles

3. Eligibility and work arrangements

3.1 Role risk levels

Each role is assigned a remote working level by the line manager and HR, using the classification of the information the role handles and the privileges it holds.

3.2 Request and approval

1. The person requests a remote working arrangement through [HR system], stating the type (regular, occasional, temporary abroad) and the location type.
2. The line manager confirms the role level and approves or refuses.
3. HR records the arrangement and the acknowledgement of this policy.
4. IT operations confirms that the person has a compliant device and remote access account.
5. Changes of role, location type or country trigger a new request.

3.3 Arrangement register (Example rows)

4. Devices and equipment

4.1 Permitted devices

The technical baseline for managed devices (full-disk encryption, screen lock, endpoint protection, patching, MDM enrolment, remote wipe) is set in isms/endpoint-device-byod-policy (DOC-ISMS-058) and isms/malware-protection-standard (DOC-ISMS-059).

4.2 Rules for remote workers

1. Use only the devices permitted in 4.1 for the information concerned.
2. Do not disable or bypass encryption, endpoint protection, the VPN or zero-trust client, or MDM.
3. Install updates when prompted; do not postpone them beyond [3] days.
4. Do not let family members, friends or anyone else use a work device.
5. Lock the screen whenever you step away, including at home.
6. Keep peripherals simple: do not connect unknown USB storage; connect to public charging points or shared docking stations only through a data-blocking adapter.
7. Return equipment when you leave or change role, as set in isms/offboarding-security-checklist.

4.3 Equipment provided for home working

Where the organization provides additional equipment (monitors, keyboards, headsets, shredders, lockable storage), it is listed against the person in the asset inventory (compliance/asset-inventory). Printers at home are permitted only for information classified [Internal] or lower, unless the role level and the information owner allow otherwise.

5. Network and connectivity

All networks outside the organization's premises are treated as untrusted. Protection comes from the device and the access path, not from the local network.

6. Physical environment at the remote location

Remote workers choose a place where they can prevent others from seeing or hearing Confidential information and can protect equipment from theft and damage.

1. Position screens so that they cannot be read from windows, doors or by others in the room; use a privacy filter in public places and for role levels RW-2 and above.
2. Hold calls about Confidential matters where you cannot be overheard; switch off or move away from voice assistants and smart speakers during such calls.
3. Do not leave devices unattended in public places, vehicles or hotel rooms in plain view. Use a hotel safe or carry the device.
4. Keep paper to a minimum. Store work papers out of sight when not in use and destroy them with a cross-cut shredder or bring them to the office for secure disposal. The clear desk and clear screen rules in isms/clear-desk-clear-screen-policy apply at home.
5. Protect equipment from damage: liquids, heat, children and pets.
6. Health and safety and ergonomics follow the [HR remote working guidance]; they are outside this policy's scope.

7. Travel and working abroad

7.1 Domestic and international travel

1. Carry devices in hand luggage; never check them in.
2. Power devices off (not sleep) when crossing borders and before leaving them unattended, so full-disk encryption protects the data.
3. Use only charging points you trust, or a data-blocking adapter.
4. Report loss or theft at once (section 10), before reporting to local police.

7.2 Working abroad

Working from another country for more than [10] working days a year requires prior approval through HR, because it can affect employment law, tax, export control and personal data transfer obligations. The legal or privacy lead checks whether the destination raises data transfer questions (for example under the GDPR for personal data of people in the EU) before approval.

7.3 High-risk destinations

The ISMS manager keeps a list of destinations where border device inspection, surveillance or theft risk is high, based on threat intelligence (isms/threat-intelligence-procedure). For these destinations:

8. Information handling away from the office

9. Monitoring and transparency

[Organization name] monitors devices, accounts and network access to protect information and to detect and respond to security incidents. Monitoring is limited to what is necessary and proportionate for these purposes, is described here before it starts, and is subject to the privacy notice for staff and to applicable law, including data protection law (for example the GDPR where it applies) and any agreements with employee representatives.

The organization does not use remote working arrangements to activate webcams or microphones, capture screenshots or keystrokes, or track location outside sign-in events, unless a specific, documented and lawful investigation requires it and the legal lead approves it. Monitoring data is never used to measure productivity under this policy. Questions about monitoring go to [privacy contact].

10. Reporting incidents and lost devices

Report immediately, and in any case within [1 hour] of noticing:

• loss or theft of a device, token, badge or work papers;
• a device seen or handled by others without your permission, including at a border;
• suspicious messages, calls or pop-ups, or a click on a suspicious link;
• anyone overhearing or seeing Confidential information;
• unexpected MFA prompts you did not start.

Report through the channels in isms/security-event-reporting-procedure (DOC-ISMS-023): [report button in email client], [service desk portal], [24/7 phone number]. The service desk triggers a remote lock or wipe for lost devices and passes the report to security operations, which handles it under compliance/incident-response-plan (DOC-ISMS-020).

People who report promptly are not disciplined for the loss itself. Disciplinary action is considered only for deliberate or repeated disregard of this policy (section 11).

11. Exceptions and non-compliance

Exceptions (for example a temporary use of an unmanaged device during a supply shortage) are requested through the security exception process (security/security-exception-request, DOC-ISMS-122), assessed against the risk criteria (isms/isms-risk-appetite-criteria) and approved at the authority the risk methodology (DOC-ISMS-010 section 2.4) sets for the residual risk: the risk owner for Low; the risk owner and department head for Medium (top management if the risk category is Averse, DOC-ISMS-015 section 9 rule 1); top management with a treatment decision for High, recorded in the risk acceptance record (DOC-ISMS-019). Critical residual risk is not approvable as an exception: treat it or stop the activity. Maximum duration is 12 months for Low or Medium and 6 months for High; at expiry the exception is reassessed, and a renewal is a new decision (DOC-ISMS-122 section 7). The exception register is reviewed monthly by the ISMS manager.

Breaches of this policy are handled proportionately under the disciplinary process for security breaches (isms/security-disciplinary-process, DOC-ISMS-052). Remote working arrangements may be suspended while a serious breach is investigated.

12. Size tiers

13. Records and evidence

Map these records to A.6.7, A.7.9 and A.8.1 in isms/control-evidence-matrix (DOC-ISMS-033). Retention periods follow data/data-retention-deletion-standard.

14. Review, measurement and maintenance

The policy is reviewed at least annually and also after: a significant incident involving remote work, a change of remote access technology, a new country of operation, or a change in law affecting workplace monitoring. Review results go to the ISMS steering committee (isms/isms-steering-committee-charter).

15. References

• ISO/IEC 27001:2022 Information security management systems, requirements, https://www.iso.org/standard/82875.html, with Amendment 1:2024, https://www.iso.org/standard/88435.html (Annex A A.6.7, A.7.9, A.8.1, A.6.8 cited by number only)
• ISO/IEC 27002:2022 Information security controls, https://www.iso.org/standard/75652.html (guidance on remote working, cited only)
• NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security, July 2016, https://csrc.nist.gov/pubs/sp/800/46/r2/final (an initial preliminary draft of Rev. 3 was released in September 2020; Rev. 2 remains the final version, check for a newer one)
• Regulation (EU) 2016/679 (GDPR), as an example of data protection law that applies to workplace monitoring and to personal data transfers
• Related templates: isms/endpoint-device-byod-policy, isms/clear-desk-clear-screen-policy, isms/information-transfer-policy, isms/access-control-policy, isms/security-event-reporting-procedure, compliance/acceptable-use-policy, security/privileged-access-standard, isms/control-evidence-matrix

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 Annex A control A.6.7 and the related controls A.7.9, A.8.1 and A.6.8, with practical content informed by NIST SP 800-46 Rev. 2 (a US Government work in the public domain). The text of this template is original. No ISO/IEC text is reproduced; control numbers and short descriptive labels only are used, and you need the official standards to read the requirements and guidance. Check the current editions before use. Parts on monitoring and working abroad are a documentation format, not legal advice. Template licence: MIT.