ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 27001 remote working is Annex A control 6.7, and it is the control most often satisfied with the wrong artefact. Almost every implementation answers it with a remote working policy, a VPN and a signed acknowledgement — then struggles at Stage 2 when the auditor asks what the organisation actually provided to the person working from a kitchen table, and how it knows the arrangement was authorised in the first place.
The gap comes from the control statement itself. In ISO/IEC 27001:2013, the teleworking control (A.6.2.2) opened with the words “a policy and supporting security measures”. In the 2022 edition, the word policy is gone from the control statement: A.6.7 requires security measures to be implemented when personnel work remotely, to protect information accessed, processed or stored outside the organisation’s premises. The policy is still sensible, and ISO/IEC 27002 still suggests one. It is simply no longer the thing the control asks for.
This guide covers what the ISO 27001 remote working control requires, how it divides from the two controls it is constantly confused with, what ISO 27002’s guidance actually names, and what the evidence set looks like when the workplace is somebody’s spare bedroom and you have no right to inspect it.
Free gap assessment
Where do you actually stand against ISO 27001?
Score every management system clause and all 93 Annex A controls, free, and get a prioritised gap list back.
Run the free ISO 27001 gap assessment → or View premium report sample
ISO 27001 remote working applies whenever personnel work outside the organisation’s premises. That is deliberately broad: home working, a co-working desk, a client site, a hotel room, a train, a relative’s house abroad for three weeks. The control does not care what you call the arrangement or whether it is permanent, hybrid or occasional. If information is accessed, processed or stored off-premises, A.6.7 is in scope.
Two things follow from the control statement that catch people out.
First, the duty is to implement measures, not to publish a document. A remote working policy is not in ISO 27001’s list of mandatory documented information — it does not appear among the required documents at all, as our ISO 27001 mandatory documents checklist sets out. You can be fully conformant with A.6.7 and have no document called “Remote Working Policy”, provided the measures exist and you can show them. The reverse is far more common and far more dangerous: a polished policy, no provisioned equipment, no authorisation record, and nothing to demonstrate.
Second, the control is written from the organisation’s side of the relationship. It is not a list of rules for employees to follow. It is a list of protections the organisation is responsible for putting in place around them. That distinction shapes everything about how ISO 27001 remote working gets evidenced.
ISO/IEC 27001:2022 has 93 Annex A controls in four themes — 37 organisational, 8 people, 14 physical and 34 technological. A.6.7 is one of the eight People controls, alongside screening, terms and conditions of employment, awareness and training, the disciplinary process, post-employment responsibilities, confidentiality agreements and event reporting.
Its placement is the first clue to the mistake. ISO 27001 remote working sits under People because the trigger is a human arrangement — yet most of what the control asks for is physical and equipment-related. A People control delivered through furniture, encryption and insurance is an odd shape, and it is why so many Statements of Applicability justify A.6.7 with a sentence about training and leave the substance to chance.
In the transition from the 2013 edition, ISO 27001 remote working is a clean one-for-one replacement. There was no merge and no split: 2013’s A.6.2.2 Teleworking became 2022’s A.6.7 Remote working, with the title modernised. If you certified under the 2013 edition, the control you already had is the control you still have.
The single biggest source of confusion in ISO 27001 remote working is that one document is usually asked to evidence three separate controls, and auditors sample them separately. Keeping them apart in your Statement of Applicability is the cheapest improvement available.
| Control | What it covers | Maps from 2013 | The question it answers |
|---|---|---|---|
| A.6.7 Remote working | The working arrangement — where the person works and what protects the information there | A.6.2.2 Teleworking | Is this way of working authorised and protected? |
| A.8.1 User endpoint devices | The configuration and management of the device itself | A.6.2.1 Mobile device policy | Is the laptop hardened, encrypted and managed? |
| A.7.9 Security of assets off-premises | Physical protection of assets once they leave the site | A.11.2.6 Security of equipment and assets off premises | Is the kit protected in transit and off-site? |
| A.5.11 Return of assets | Recovering everything when the arrangement ends | A.8.1.4 Return of assets | Did we get the laptop, tokens and papers back? |
| A.7.7 Clear desk and clear screen | Desk and screen discipline, which applies at home too | A.11.2.9 | Can a housemate read the screen? |
| A.5.14 Information transfer | How information moves between the office and the remote worker | A.13.2.1–13.2.3 | Is the channel appropriate for the classification? |
A practical test: if your remote working policy is the only document referenced against all six rows, you have a single point of failure. The device-level requirements belong with your endpoint standard and your BYOD policy; the desk-and-screen requirements belong with your clean desk policy, which should say explicitly that it applies off-premises. A.6.7 then carries only what is genuinely about the arrangement.
ISO/IEC 27002:2022 expands 6.7 into two halves: factors to consider when deciding whether and how remote working is permitted, and measures to put in place once it is. The guidance is not normative — 27002 is a guidance standard, not a requirements standard — but it is what a competent auditor has in mind, and ignoring an item needs a reason.
| Area | What ISO 27002’s 6.7 guidance points at |
|---|---|
| Physical environment | Physical security of the remote site, lockable storage, rules for the expected working environment, secure disposal of sensitive hard copy |
| Equipment | Provision of suitable equipment and storage furniture by the organisation, support and maintenance for it |
| Permitted work | Definition of what work may be done remotely, which classification levels may be handled, and which systems may be reached |
| Networks | Home and public network use, wireless configuration expectations, and the assumption that these networks are not controlled by you |
| Access and authentication | Remote access techniques, and the specific weakness of single-factor authentication |
| Device controls | Device locks and inactivity timeouts, malware protection, firewalling, location tracking and remote wipe capability |
| Household risk | Rules and guidance on access by family members and visitors, and the risk of being overlooked in public spaces |
| People | Training for remote workers and for the staff who support them |
| Resilience | Backup arrangements and business continuity for remote working |
| Oversight | Audit and security monitoring that reaches remote endpoints |
| Insurance | Insurance cover appropriate to the remote working arrangement |
| Exit | Revocation of access and return of equipment when the arrangement or employment ends |
Note what is absent: a frequency. ISO/IEC 27001:2022 states no review interval for ISO 27001 remote working arrangements — not in Annex A, not in clause 9. ISO 27002’s guidance is qualitative. Several commercial checklists assert that A.6.7 must be reviewed or audited “at least annually” and mark you non-conformant otherwise; that is a vendor’s own threshold, not a requirement of the standard. Set an interval, justify it against your risk assessment, and never present the number as something ISO demands.
Free ISO 27001 risk assessment
Which of your risks sit above your appetite line?
Set your own risk criteria, pick from 61 information security risk scenarios, rate likelihood and impact, and decide how to treat each one. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free risk assessment → or View premium report sample
Two of the ISO 27001 remote working measures above are routinely skipped, and both are visible to an auditor in minutes.
Provision of equipment and storage furniture. ISO 27002’s guidance on 6.7 does not say “permit staff to use their own equipment with conditions”. It points at the organisation providing suitable equipment and suitable storage furniture for remote working. Storage furniture means what it sounds like: if a remote worker handles hard copy, something lockable has to exist in the house, and it is the organisation’s job to supply it. The same logic applies to a shredder — a staff member told to destroy sensitive printouts at home, with nothing to destroy them with, is a finding waiting to happen. If you do allow privately owned equipment, that is a risk decision that needs recording, not a default.
Insurance. ISO 27002’s 6.7 guidance names insurance as a remote working measure, and it is almost never addressed in an ISMS. The question is narrow and answerable: does your cover extend to organisation-owned equipment and information at employees’ homes and in transit, or does it stop at the office door? Someone in finance or operations already knows. Getting a one-line confirmation on file costs nothing and closes an item most competitors’ toolkits do not even raise.
Here is the structural problem that makes ISO 27001 remote working different from every other Annex A control. For an office, physical security is evidenced by inspection — the auditor walks the floor. For a home, there is no inspection. You have no right of entry, and neither does your certification body. The control still has to be demonstrated.
That forces the evidence onto four things you can produce, and a well-built ISMS has all four:
Attestation is the weakest of the four, which is exactly why the other three have to be strong. If the only thing standing between a confidential file and a housemate is a sentence the employee ticked eighteen months ago, the measure is not implemented.
A.6.7’s guidance points at “remote access techniques” without prescribing one. The clearest free framework for that decision is NIST’s SP 800-46 Revision 2, Guide to Enterprise Telework, Remote Access, and BYOD Security, published in July 2016 and still the current final edition, with Revision 3 at pre-draft. It sorts remote access into four architectures, which is a much more useful conversation than “do we have a VPN”.
| Method | How it works | Security characteristic |
|---|---|---|
| Tunnelling | An encrypted tunnel carries traffic between device and organisation | Broad access; the device effectively joins the network, so device compromise matters most |
| Application portals | A server presents access to one or more applications through a portal | Narrower exposure; the portal becomes the control point and the thing to harden |
| Remote desktop access | The remote device controls an internal workstation or virtual desktop | Data can stay inside; indirect access through a third-party intermediate server needs its own risk assessment |
| Direct application access | The device reaches an individual application directly | Only appropriate for well-secured, perimeter or public-facing services, not internal ones |
Two of NIST’s recommendations in that guide are worth adopting as stated assumptions in your own risk assessment, because they are the honest starting position for ISO 27001 remote working. Organisations should plan remote access security on the assumption that the networks between the remote device and the organisation cannot be trusted; and they should assume client devices will become infected with malware and plan controls accordingly. Write those two assumptions down and most of the device-level measures in the table above stop needing a separate justification.
If you permit personally owned devices on the corporate network rather than only through remote access, NIST’s position is firmer still: put them on a separate, external, dedicated network that grants no more access than remote access already would.
A document is still the efficient way to communicate your ISO 27001 remote working measures, even though the control no longer names one. Keep it to what is genuinely about the arrangement, and cross-reference the rest.
Leave out device hardening detail, access control rules and acceptable use boilerplate. They live in their own documents, they change on a different cycle, and duplicating them guarantees the two copies will disagree by the time of your next privileged access review.
Expect ISO 27001 remote working to be tested by sampling, not by document review. The usual sequence runs: ask how many people work remotely and in what pattern; pick two or three; ask to see the authorisation for each; ask what each was issued; then pull the technical state of those specific devices. The policy is read, but it is read last and it is read for consistency with what the sample showed.
The findings that come out of this are predictable. A policy that says the organisation provides lockable storage, with no record that anyone ever received any. Encryption asserted in the policy and unverifiable for the sampled laptops. An employee who has worked from another country for months with no approval on file and no consideration of local law. A leaver whose remote access was revoked promptly but whose equipment is still unaccounted for, which is an A.5.11 finding reached through the A.6.7 sample.
If you want to rehearse this, run the sample on yourself before the auditor does — take two remote workers and try to produce authorisation, provisioning and device state for both. Our guide to the ISO 27001 certification process sets out where in the audit cycle this sampling happens, and the Statement of Applicability is where you record which of these controls carries which requirement.
No. A remote working policy is not in ISO 27001’s list of mandatory documented information, and the 2022 control statement for A.6.7 does not name a policy — it requires security measures. A policy is strongly advisable as the way you communicate and demonstrate those measures, and ISO 27002’s guidance suggests one, but the auditable obligation is the measures themselves. The practical answer for most ISO 27001 remote working implementations is to write one anyway, because producing coherent evidence without it is harder than writing it.
Yes. Being fully remote changes how the audit is conducted, not whether you can certify. Where an organisation has few or no physical sites, the accreditation rules require the audit report, and the certification document itself, to state that activities were conducted remotely. Our guide to the ISO 27001 remote audit covers that in detail. For ISO 27001 remote working specifically, being fully remote raises the stakes rather than removing the control: with no office, every working environment is a remote one.
Both controls touch it from different directions. A.6.7 asks whether information processed on a privately owned device outside your premises is adequately protected, and ISO 27002’s guidance treats organisation-provided equipment as the expected arrangement. A.8.1, user endpoint devices, is where the device-level requirements live — configuration, encryption, management, acceptable use. Permitting personal devices under ISO 27001 remote working is a risk decision to be recorded and justified, with A.8.1 carrying the technical conditions.
ISO 27001:2022 sets no frequency, so this is yours to decide and justify. A defensible pattern is to re-confirm authorisations annually and on any material change — a change of role, a change of classification handled, or a move to another country — while monitoring device compliance continuously through your management platform rather than at review points. State the interval and the trigger conditions in the ISO 27001 remote working policy so the auditor sees a deliberate choice.
Four sets, as above: authorisation records per person and arrangement; provisioning records showing what was issued; technical state pulled from your management platform for sampled devices; and specific, refreshed attestation plus remote-aware training records. Keep them linked, so that picking a name produces all four in one place. That linkage is what turns a sampling exercise from an hour of searching into a two-minute answer.
ISO 27001 remote working is cheap to fix and expensive to leave alone. The control itself is modest — one of eight People controls, a clean carry-over from the 2013 edition — but it reaches into asset management, physical security, endpoint configuration, training and offboarding, and a gap in any of those surfaces through the A.6.7 sample. The fix is structural rather than lengthy: separate the three controls in your Statement of Applicability, start an authorisation record, make the provisioning list real, and let the management platform prove the device state.
If you would rather start from drafted documents than a blank page, the ISO 27001 Toolkit includes the remote working, endpoint, clear desk and asset management documentation as part of 165 templates aligned to the 2022 edition, for $99. The source of record for the standard itself is ISO/IEC 27001:2022 on iso.org, currently in its third edition with one amendment — the 2024 climate change amendment, which ISO publishes at no charge.
October 12, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026