# Remote Working Policy: [Organization name]

> Topic-specific policy for working outside the organization's premises:
> at home, while travelling, at client sites and in shared spaces. It
> supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A control A.6.7 (remote
> working), together with A.7.9 (assets used off-premises), A.8.1 (user
> endpoint devices) and A.6.8 (reporting security events). Control
> guidance is in ISO/IEC 27002:2022. Replace every `[bracketed]` value and
> every row marked *Example*. Where the policy touches employment terms or
> workplace monitoring, it is a documentation format, not legal advice.

<!--
Guidance: How to use this template
- When to use: you allow any work outside your offices, even occasional
  work from home. A.6.7 is applicable for almost every organization; if
  you exclude it, the SoA needs a reason an auditor can test.
- Fill first: section 3 (eligibility and work arrangements), section 4
  (permitted devices) and section 9 (monitoring transparency). These are
  the decisions HR, legal and IT must agree on before publication.
- Main pitfall: a policy that copies the office rules and ignores what is
  different at home and on the road: family members, shared networks,
  borders, public places and lost devices. Another pitfall is silent
  monitoring that staff only learn about after an incident.
- Related templates: `isms/endpoint-device-byod-policy`,
  `isms/clear-desk-clear-screen-policy`, `isms/information-transfer-policy`,
  `isms/information-labelling-handling-procedure`,
  `isms/access-control-policy`, `isms/security-event-reporting-procedure`,
  `isms/employee-security-handbook`, `compliance/acceptable-use-policy`,
  `isms/control-evidence-matrix`.
-->

## Document control

<!-- Guidance: This is a controlled policy. A change to eligibility, to permitted devices or to monitoring is a new version with a new approval and a communication to all staff. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-054 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@hr-lead], [@legal], [@it-operations-lead] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024, Annex A A.6.7 (with A.7.9, A.8.1, A.6.8); ISO/IEC 27002:2022 |
| Parent policy | DOC-ISMS-001 Information security policy |
| Applies to | [All employees, contractors and temporary staff with access to [Organization name] information] |
| Related documents | DOC-ISMS-058 Endpoint and BYOD policy, DOC-ISMS-056 Clear desk and clear screen policy, DOC-ISMS-043 Information transfer policy, DOC-ISMS-023 Security event reporting procedure |
| Next scheduled review | YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Policy owner | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| HR lead | [@hr-lead] | [Reviewed] | YYYY-MM-DD |
| Legal or employee relations | [@legal] | [Reviewed] | YYYY-MM-DD |
| Top management | [@ceo] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | First approved version |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Added section 7.3 on high-risk destinations after a lost-laptop incident (INC-2027-014) |

## Contents

<!-- Guidance: Sections 1 to 3 set scope and eligibility, sections 4 to 8 are the rules staff follow, sections 9 to 11 cover transparency, incidents and exceptions, sections 12 to 15 keep the policy operating and auditable. -->

1. Purpose and scope
2. Principles and roles
3. Eligibility and work arrangements
4. Devices and equipment
5. Network and connectivity
6. Physical environment at the remote location
7. Travel and working abroad
8. Information handling away from the office
9. Monitoring and transparency
10. Reporting incidents and lost devices
11. Exceptions and non-compliance
12. Size tiers
13. Records and evidence
14. Review, measurement and maintenance
15. References

## 1. Purpose and scope

<!-- Guidance: State what counts as remote working and who is covered. Questions to answer: does the policy cover contractors and suppliers' staff? Does it cover checking email on a phone? Pitfall: a scope that names "home working" only, so travel and client sites fall through the gap. -->

This policy sets the security rules that apply whenever people work on
[Organization name] information or systems outside premises controlled
by the organization. It protects the confidentiality, integrity and
availability of information when the physical and network controls of
the office are not present, and it makes the responsibilities of the
organization and of each person clear.

Remote working in this policy includes:

- regular or occasional work from a home or other private residence;
- work while travelling, including on public transport, in hotels,
  airports and cafes;
- work at customer, partner or supplier sites that the organization does
  not control;
- work from shared or co-working spaces;
- access to work email, chat or files from a mobile device outside the
  office, however short.

The policy applies to all employees, contractors, interns and temporary
staff who access [Organization name] information. Suppliers whose staff
work remotely on the organization's systems follow equivalent rules set
in their contracts (see `isms/supplier-security-agreement-27036`).

Out of scope: the security of office premises (covered by
`isms/physical-security-policy`) and the technical configuration of
remote access services (covered by `isms/network-security-standard` and
`isms/secure-configuration-baseline`), which this policy relies on.

## 2. Principles and roles

<!-- Guidance: Keep principles few and testable. Then say who does what. An auditor will ask the owner of each rule how they know it is followed. -->

### 2.1 Principles

1. **Same protection, different place.** Information keeps its
   classification and handling rules wherever it is used
   (`isms/information-labelling-handling-procedure`).
2. **Managed access only.** Remote access to internal systems uses
   organization-approved devices or approved access methods with
   multi-factor authentication.
3. **Risk-based eligibility.** The more sensitive the role or
   information, the stricter the conditions for working remotely.
4. **Transparency.** People are told in advance what is monitored, why
   and how the data is used.
5. **Report early.** A lost device, an overheard call or a suspicious
   message is reported at once, without fear of blame for reporting.

### 2.2 Roles

| Role | Responsibilities |
|---|---|
| Top management | Approves the policy and the eligibility model; provides resources for secure remote working |
| ISMS manager (policy owner) | Maintains the policy, runs reviews, reports metrics to the ISMS steering committee |
| HR lead | Records remote working arrangements, includes the policy in onboarding and contracts, handles employee relations questions |
| IT operations lead | Provides and manages devices, remote access, MDM and remote wipe; maintains the device register |
| Line managers | Approve remote working requests, confirm the role risk level, check that staff completed training |
| Legal or privacy lead | Confirms the lawful basis and notices for monitoring; advises on working abroad |
| Every remote worker | Follows the rules in sections 4 to 10, protects equipment, reports events and losses |

## 3. Eligibility and work arrangements

<!-- Guidance: Define role risk levels and what each level may do remotely. Questions to answer: which roles cannot work remotely, or only from approved locations? Who approves? Pitfall: eligibility decided case by case with no record, so the auditor cannot see a consistent rule. -->

### 3.1 Role risk levels

Each role is assigned a remote working level by the line manager and HR,
using the classification of the information the role handles and the
privileges it holds.

| Level | Typical roles | Remote working allowed | Conditions |
|---|---|---|---|
| RW-1 Standard | Most roles handling Internal information | Home, travel, client sites, shared spaces | Managed device, MFA, training completed |
| RW-2 Elevated | Roles handling Confidential information or customer personal data in bulk | Home and client sites; travel with restrictions in section 7 | As RW-1, plus no work in public spaces on Confidential data, privacy screen filter |
| RW-3 Privileged | Administrators of production systems, security operations, finance approvers | Home or approved locations only | As RW-2, plus privileged access only through the privileged access workstation or bastion (`security/privileged-access-standard`), no privileged work from abroad without approval |
| RW-4 Restricted | Roles with access to Restricted information or OT control systems | Only where specifically approved | Written approval by the information owner and the ISMS manager per arrangement |

### 3.2 Request and approval

1. The person requests a remote working arrangement through [HR system],
   stating the type (regular, occasional, temporary abroad) and the
   location type.
2. The line manager confirms the role level and approves or refuses.
3. HR records the arrangement and the acknowledgement of this policy.
4. IT operations confirms that the person has a compliant device and
   remote access account.
5. Changes of role, location type or country trigger a new request.

### 3.3 Arrangement register *(Example rows)*

| Arrangement ID | Person or role | Level | Type | Locations | Approved by | Review date |
|---|---|---|---|---|---|---|
| RWA-001 *(Example)* | Data engineer | RW-2 | Regular, 3 days a week | Home | [@line-manager] | YYYY-MM-DD |
| RWA-002 *(Example)* | Cloud platform administrator | RW-3 | Regular, full remote | Home (approved address) | [@line-manager], [@isms-manager] | YYYY-MM-DD |
| RWA-003 *(Example)* | Account executive | RW-1 | Occasional, frequent travel | Home, travel, client sites | [@line-manager] | YYYY-MM-DD |

## 4. Devices and equipment

<!-- Guidance: State which devices may be used for which information, and what the organization does to manage them. Link the endpoint policy for technical settings rather than repeating them. Auditors check a sample of remote laptops against the MDM report. -->

### 4.1 Permitted devices

| Device type | Internal information | Confidential information | Restricted information | Privileged access |
|---|---|---|---|---|
| Organization-managed laptop | Yes | Yes | Only if approved | Yes, through approved path |
| Organization-managed phone or tablet | Yes | Email and chat only | No | No |
| Personal device enrolled under BYOD (app protection) | Email, chat and web apps only | No downloads; view only in managed apps | No | No |
| Personal device not enrolled | No | No | No | No |
| Shared or public computer (hotel, kiosk, library) | No | No | No | No |

The technical baseline for managed devices (full-disk encryption,
screen lock, endpoint protection, patching, MDM enrolment, remote wipe)
is set in `isms/endpoint-device-byod-policy` (DOC-ISMS-058) and
`isms/malware-protection-standard` (DOC-ISMS-059).

### 4.2 Rules for remote workers

1. Use only the devices permitted in 4.1 for the information concerned.
2. Do not disable or bypass encryption, endpoint protection, the VPN or
   zero-trust client, or MDM.
3. Install updates when prompted; do not postpone them beyond [3] days.
4. Do not let family members, friends or anyone else use a work device.
5. Lock the screen whenever you step away, including at home.
6. Keep peripherals simple: do not connect unknown USB storage; connect
   to public charging points or shared docking stations only through a
   data-blocking adapter.
7. Return equipment when you leave or change role, as set in
   `isms/offboarding-security-checklist`.

### 4.3 Equipment provided for home working

Where the organization provides additional equipment (monitors,
keyboards, headsets, shredders, lockable storage), it is listed against
the person in the asset inventory (`compliance/asset-inventory`). Printers
at home are permitted only for information classified [Internal] or
lower, unless the role level and the information owner allow otherwise.

## 5. Network and connectivity

<!-- Guidance: Say what networks are acceptable and how access to internal systems is protected. Avoid demanding home router settings that staff cannot verify. Pitfall: relying on the home network being "trusted"; treat every remote network as untrusted. -->

All networks outside the organization's premises are treated as
untrusted. Protection comes from the device and the access path, not
from the local network.

| Topic | Rule |
|---|---|
| Access to internal services | Through [VPN / zero-trust access client / identity-aware proxy] with MFA; direct exposure of internal services to the internet is not permitted |
| Home Wi-Fi | Use WPA2 or WPA3 with a password that is not the factory default; change the router administrator password from its default. These are recommendations the organization supports with guidance, not checks it performs |
| Public Wi-Fi | Allowed for RW-1 and RW-2 only through the access client; captive portals are acceptable; avoid networks with no password where a mobile hotspot is available |
| Mobile hotspot | Preferred alternative to public Wi-Fi; use the work phone or a personal phone hotspot with a strong password |
| Split tunnelling | [Disabled / Enabled only for named collaboration services], as set in `isms/network-security-standard` |
| Video calls | Use the approved collaboration platform; use waiting rooms or lobby for external meetings; do not record without telling participants |
| Cloud services | Use only approved services listed in the cloud register (`isms/cloud-services-security-policy`); personal file sharing or personal email for work files is prohibited |

## 6. Physical environment at the remote location

<!-- Guidance: Describe what a suitable workspace looks like in practical terms. Questions to answer: what about shared homes and public places? What about paper? Pitfall: rules that need a home inspection, which most organizations cannot do lawfully or practically. -->

Remote workers choose a place where they can prevent others from seeing
or hearing Confidential information and can protect equipment from
theft and damage.

1. Position screens so that they cannot be read from windows, doors or
   by others in the room; use a privacy filter in public places and for
   role levels RW-2 and above.
2. Hold calls about Confidential matters where you cannot be overheard;
   switch off or move away from voice assistants and smart speakers
   during such calls.
3. Do not leave devices unattended in public places, vehicles or hotel
   rooms in plain view. Use a hotel safe or carry the device.
4. Keep paper to a minimum. Store work papers out of sight when not in
   use and destroy them with a cross-cut shredder or bring them to the
   office for secure disposal. The clear desk and clear screen rules in
   `isms/clear-desk-clear-screen-policy` apply at home.
5. Protect equipment from damage: liquids, heat, children and pets.
6. Health and safety and ergonomics follow the [HR remote working
   guidance]; they are outside this policy's scope.

## 7. Travel and working abroad

<!-- Guidance: Travel raises three risks: device loss, border inspection and local law. Set clear rules for each and for high-risk destinations. Pitfall: staff working abroad for weeks without anyone knowing, which creates legal, tax and data transfer issues the security team cannot fix later. -->

### 7.1 Domestic and international travel

1. Carry devices in hand luggage; never check them in.
2. Power devices off (not sleep) when crossing borders and before
   leaving them unattended, so full-disk encryption protects the data.
3. Use only charging points you trust, or a data-blocking adapter.
4. Report loss or theft at once (section 10), before reporting to local
   police.

### 7.2 Working abroad

Working from another country for more than [10] working days a year
requires prior approval through HR, because it can affect employment
law, tax, export control and personal data transfer obligations. The
legal or privacy lead checks whether the destination raises data
transfer questions (for example under the GDPR for personal data of
people in the EU) before approval.

### 7.3 High-risk destinations

The ISMS manager keeps a list of destinations where border device
inspection, surveillance or theft risk is high, based on threat
intelligence (`isms/threat-intelligence-procedure`). For these
destinations:

| Rule ID | Rule |
|---|---|
| TRV-01 *(Example)* | Travel with a loaner laptop and phone that hold only the information needed for the trip |
| TRV-02 *(Example)* | Access Confidential systems only through the browser-based access path; do not sync file stores |
| TRV-03 *(Example)* | On return, hand loaner devices to IT for reimaging before reconnecting to the network |
| TRV-04 *(Example)* | If a border official takes a device out of sight, report it as a security event on arrival and change passwords from a clean device |

## 8. Information handling away from the office

<!-- Guidance: Map the labelling and transfer rules to remote situations. Pitfall: staff emailing files to personal accounts to print at home, which is a data leak with no malicious intent. -->

| Situation | Rule |
|---|---|
| Storing files | Store work files only in approved organization storage; do not save to personal cloud drives or unmanaged USB storage |
| Downloading | RW-1 may download Internal files to a managed device; Confidential files stay in approved storage unless offline work is needed and approved |
| Printing | Only on approved printers; collect at once; shred or return papers; no printing of Restricted information outside premises |
| Sharing with others | Follow `isms/information-transfer-policy`; never forward work email to personal accounts |
| Conversations | Do not discuss Confidential matters in public places, on public transport or on speakerphone where others can hear |
| Removable media | Only encrypted, organization-issued media, and only where the role requires it (`isms/endpoint-device-byod-policy`) |
| AI tools | Use only approved AI tools under `ai-data/ai-usage-policy`; do not paste Confidential information into consumer AI services |
| Customer sites | Follow the customer's site rules as well as this policy; if they conflict, apply the stricter rule and tell your manager |

## 9. Monitoring and transparency

<!-- Guidance: Remote working often increases monitoring. List every monitoring measure, its purpose, the data collected and the retention period, and get legal review per jurisdiction. Pitfall: productivity tracking presented as security monitoring. This is a documentation format, not legal advice. -->

[Organization name] monitors devices, accounts and network access to
protect information and to detect and respond to security incidents.
Monitoring is limited to what is necessary and proportionate for these
purposes, is described here before it starts, and is subject to the
privacy notice for staff and to applicable law, including data
protection law (for example the GDPR where it applies) and any
agreements with employee representatives.

| Measure | Purpose | Data collected | Who can access | Retention |
|---|---|---|---|---|
| MDM device compliance *(Example)* | Confirm encryption, patch level, screen lock | Device model, OS version, compliance state, installed managed apps | IT operations | Life of device plus [90] days |
| Endpoint detection and response *(Example)* | Detect malware and attacks | Process, file and network events on managed devices | Security operations | [90] days |
| Sign-in and access logs *(Example)* | Detect account compromise | Time, IP address, approximate location, device, result | Security operations | [12] months, per `security/security-logging-standard` |
| Data loss prevention *(Example)* | Detect transfer of Confidential data to unapproved destinations | Policy matches, file names, destination | Security operations, privacy lead for review | [6] months |

The organization does **not** use remote working arrangements to
activate webcams or microphones, capture screenshots or keystrokes, or
track location outside sign-in events, unless a specific, documented
and lawful investigation requires it and the legal lead approves it.
Monitoring data is never used to measure productivity under this
policy. Questions about monitoring go to [privacy contact].

## 10. Reporting incidents and lost devices

<!-- Guidance: Remote workers must know exactly what to do in the first hour. Link the reporting procedure and give the channels. Auditors test this by asking a remote employee how they would report a lost laptop. -->

Report immediately, and in any case within [1 hour] of noticing:

- loss or theft of a device, token, badge or work papers;
- a device seen or handled by others without your permission, including
  at a border;
- suspicious messages, calls or pop-ups, or a click on a suspicious link;
- anyone overhearing or seeing Confidential information;
- unexpected MFA prompts you did not start.

Report through the channels in `isms/security-event-reporting-procedure`
(DOC-ISMS-023): [report button in email client], [service desk portal],
[24/7 phone number]. The service desk triggers a remote lock or wipe for
lost devices and passes the report to security operations, which
handles it under `compliance/incident-response-plan` (DOC-ISMS-020).

```mermaid
flowchart TD
  L["Device lost or stolen"] --> R["Report via service desk or 24/7 phone"]
  R --> W["IT locks device and revokes sessions"]
  W --> E{"Encrypted and powered off?"}
  E -- "Yes" --> C["Record as security event, low impact"]
  E -- "No or unknown" --> I["Security operations assesses as possible incident"]
  I --> P{"Personal data at risk?"}
  P -- "Yes" --> B["Privacy lead starts breach assessment"]
  P -- "No" --> C2["Handle under incident response plan"]
  C --> X["Issue replacement device"]
  C2 --> X
  B --> X
```

People who report promptly are not disciplined for the loss itself.
Disciplinary action is considered only for deliberate or repeated
disregard of this policy (section 11).

## 11. Exceptions and non-compliance

<!-- Guidance: Give one route for exceptions and say what happens on breach. Link the disciplinary process. Pitfall: informal "just this once" approvals by managers that nobody records. -->

Exceptions (for example a temporary use of an unmanaged device during a
supply shortage) are requested through the security exception process
(`security/security-exception-request`, DOC-ISMS-122), assessed against
the risk criteria (`isms/isms-risk-appetite-criteria`) and approved at
the authority the risk methodology (DOC-ISMS-010 section 2.4) sets for
the residual risk: the risk owner for Low; the risk owner and department
head for Medium (top management if the risk category is Averse,
DOC-ISMS-015 section 9 rule 1); top management with a treatment decision
for High, recorded in the risk acceptance record (DOC-ISMS-019).
Critical residual risk is not approvable as an exception: treat it or
stop the activity. Maximum duration is 12 months for Low or Medium and 6
months for High; at expiry the exception is reassessed, and a renewal is
a new decision (DOC-ISMS-122 section 7). The exception register is
reviewed monthly by the ISMS manager.

Breaches of this policy are handled proportionately under the
disciplinary process for security breaches
(`isms/security-disciplinary-process`, DOC-ISMS-052). Remote working
arrangements may be suspended while a serious breach is investigated.

## 12. Size tiers

<!-- Guidance: Show how the policy scales. Keep the rules identical in principle and change the mechanisms. These tiers are the library's working tiers, not official definitions. -->

| Topic | Small: Quillmere Analytics Ltd *(Example)* | Medium: Quillmere Health Systems *(Example)* | Large: Quillmere Group *(Example)* |
|---|---|---|---|
| Context | 46 staff (38 employees, 8 contractors), one office plus remote staff, production on one public cloud provider | 320 staff, two offices and one colocation suite, hospital customers | 2,400 staff, 6 sites in 4 countries, OT and IT |
| Eligibility model | RW-1 for most staff, RW-3 for the 4 platform engineers; decisions recorded in the HR system | All four levels; RW-3 for production and colocation administrators, RW-4 for roles handling Restricted clinical data exports | All four levels, plus "no remote access" for OT operators at plants |
| Devices | Company laptops for all 46; contractors use company laptops, no BYOD for laptops | Company laptops; BYOD phones with app protection for email and chat | Company laptops; loaner pool for high-risk travel; regional IT teams |
| Remote access | Zero-trust access client and identity provider MFA | VPN for legacy clinical systems, zero-trust client for SaaS | Zero-trust client for IT; OT remote access only through the jump host with vendor session approval |
| Working abroad | Approved by the CEO; legal advice bought in | HR and privacy lead approve; country list maintained | Global mobility team with HR, tax, legal and security sign-off |
| Monitoring | MDM and identity logs; no DLP in year 1 | MDM, EDR, DLP for patient-related data | MDM, EDR, DLP; works council agreements per country |
| Review | Annual, by the part-time ISMS manager (0.5 FTE) | Annual, by the security team | Annual group policy, local addenda per country |

## 13. Records and evidence

<!-- Guidance: List the records that prove this policy operates. Link each to the control evidence matrix (DOC-ISMS-033). Auditors usually sample: 5 remote workers, their acknowledgement, training, device compliance and access logs. -->

| Record | Proves | Owner | Location | Retention |
|---|---|---|---|---|
| Policy acknowledgements | Staff read and accepted the policy | HR lead | [HR system] | Employment plus [2] years |
| Remote working arrangement register (3.3) | Eligibility decisions are made and approved | HR lead | [HR system] | Arrangement end plus [2] years |
| MDM compliance report | Remote devices meet the baseline | IT operations lead | [MDM console export, monthly] | [24] months |
| Remote access logs | Access uses approved paths with MFA | Security operations | [SIEM] | [12] months |
| Lost and stolen device reports | Losses are reported and handled | Service desk | [Ticketing system] and `isms/incident-register` | [3] years |
| Working abroad approvals | Legal and data transfer checks done | HR lead, legal | [HR system] | [3] years |
| Training completion for remote working module | Awareness delivered (A.6.3) | Awareness lead | [Learning platform] | [3] years |
| Exception register entries | Deviations are approved and time-limited | ISMS manager | [GRC tool] | [3] years after closure |

Map these records to A.6.7, A.7.9 and A.8.1 in
`isms/control-evidence-matrix` (DOC-ISMS-033). Retention periods
follow `data/data-retention-deletion-standard`.

## 14. Review, measurement and maintenance

<!-- Guidance: Define a small set of measures with targets, and the triggers for an unscheduled review. Feed results to the measurement programme (DOC-ISMS-080). -->

| Metric ID | Measure | Target *(Example)* | Source |
|---|---|---|---|
| RW-M01 | Remote devices compliant with the MDM baseline | ≥ 98 % | MDM report |
| RW-M02 | Lost devices reported within 1 hour | ≥ 90 % | Service desk tickets |
| RW-M03 | Lost devices confirmed encrypted at the time of loss | 100 % | MDM records |
| RW-M04 | Remote workers with current policy acknowledgement | 100 % | HR system |
| RW-M05 | Open remote working exceptions past expiry | 0 | Exception register |

The policy is reviewed at least annually and also after: a significant
incident involving remote work, a change of remote access technology, a
new country of operation, or a change in law affecting workplace
monitoring. Review results go to the ISMS steering committee
(`isms/isms-steering-committee-charter`).

## 15. References

<!-- Guidance: Cite editions. Use only the iso.org links given below and check for newer editions before each review. -->

- ISO/IEC 27001:2022 Information security management systems,
  requirements, https://www.iso.org/standard/82875.html, with Amendment
  1:2024, https://www.iso.org/standard/88435.html (Annex A A.6.7, A.7.9,
  A.8.1, A.6.8 cited by number only)
- ISO/IEC 27002:2022 Information security controls,
  https://www.iso.org/standard/75652.html (guidance on remote working,
  cited only)
- NIST SP 800-46 Rev. 2, *Guide to Enterprise Telework, Remote Access,
  and Bring Your Own Device (BYOD) Security*, July 2016,
  https://csrc.nist.gov/pubs/sp/800/46/r2/final (an initial preliminary
  draft of Rev. 3 was released in September 2020; Rev. 2 remains the
  final version, check for a newer one)
- Regulation (EU) 2016/679 (GDPR), as an example of data protection law
  that applies to workplace monitoring and to personal data transfers
- Related templates: `isms/endpoint-device-byod-policy`,
  `isms/clear-desk-clear-screen-policy`, `isms/information-transfer-policy`,
  `isms/access-control-policy`, `isms/security-event-reporting-procedure`,
  `compliance/acceptable-use-policy`, `security/privileged-access-standard`,
  `isms/control-evidence-matrix`

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 Annex A control
A.6.7 and the related controls A.7.9, A.8.1 and A.6.8, with
practical content informed by NIST SP 800-46 Rev. 2 (a US Government
work in the public domain). The text of this template is original. No
ISO/IEC text is reproduced; control numbers and short descriptive labels
only are used, and you need the official standards to read the
requirements and guidance. Check the current editions before use. Parts
on monitoring and working abroad are a documentation format, not legal
advice. Template licence: MIT.