Remote working

Plain-language summary

Protecting the information people use and keep when they work away from your premises — at home, on the road, at a client site or in a coffee shop — with a clear policy, secured devices and connections, and habits that travel with them.

What the clause is really asking

The office used to be where the controls were; now the work happens wherever the laptop is, and this control asks you to put security measures around that. A topic-specific remote working policy is the usual anchor, setting out who may work remotely, under what conditions, and the technical and physical measures: managed and encrypted devices, multi-factor authentication, secure connections, rules for home and public Wi-Fi, use of personal devices, printing and paper at home, screen privacy and conversations in shared spaces, and how to report a lost device. The 2022 edition renamed teleworking to remote working because the scope is any location outside your control, not only a fixed home office. The misunderstanding is that a VPN solves it; the risks are as much physical (family members, overheard calls, a laptop left in a car) as technical. In South Africa, power outages push people onto coffee-shop Wi-Fi and mobile hotspots, POPIA section 19 applies wherever personal information is processed, and theft from vehicles makes the laptop-in-the-boot rule worth writing down.

What auditors look for

Auditors ask for the remote working policy and then test whether technology enforces it: device encryption reports, MFA enrolment for remote access, mobile device management compliance, and whether personal devices can reach company data. They ask how remote working is approved and whether there is a list of who does it. They interview a remote worker about where they work, how they connect, what they do with printouts and what they would do if the laptop were stolen. They review lost and stolen device reports and the response. The hard question: can someone open the ERP from a personal home computer today, and what stops the data leaving it?

Typical evidence

Remote working policy; remote work approvals or list of remote workers; device encryption and endpoint compliance reports; MFA enrolment for remote access and cloud services; mobile device management or conditional access settings; personal device rules and enrolment records; remote working awareness records; lost or stolen device reports and remote wipe records; guidance on home printing and paper disposal.

How to comply — recommendations

Write a two-page remote working policy covering eligibility, approved devices, connection rules, personal device use, paper and printing, physical security at home and in public, and reporting. Enforce what you can technically: full-disk encryption on every laptop, MFA on all remote access, conditional access so only managed devices reach sensitive systems, and remote wipe. Give staff who work in public places a privacy screen. Add a short remote working module to the awareness programme. Keep a list of approved remote workers and review it with HR twice a year.

Common nonconformities

No remote working policy, or one written only for permanent home workers; laptops not encrypted; remote access without MFA; unmanaged personal devices reaching company data; no list of who works remotely; printed confidential information thrown into household rubbish; lost device not reported or not wiped; remote staff unaware of the rules.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.