## 6.7 Remote working

  

| **Control type** | **Information security properties** | **Cybersecurity concepts** | **Operational capabilities** | **Security domains** |

|------------------|-----------------------------------------|---------------------------|--------------------------------------------------------------------------------|---------------------|

| #Preventive | #Confidentiality #Integrity #Availability | #Protect | #Asset_management #Information_protection #Physical_security #System_and_network_security | #Protection |

  

**Control**

  

Security measures should be implemented when personnel are working remotely to protect information accessed, processed or stored outside the organization’s premises.

  

**Purpose**

  

To ensure the security of information when personnel are working remotely.

  

**Guidance**

  

Remote working occurs whenever personnel of the organization work from a location outside of the organization’s premises, accessing information whether in hardcopy or electronically via ICT equipment. Remote working environments include those referred to as “teleworking”, “telecommuting”, “flexible workplace”, “virtual work environments" and “remote maintenance”.

  

NOTE It is possible that not all the recommendations in this guidance can be applied due to local legislation and regulations in different jurisdictions.

  

Organizations allowing remote working activities should issue a topic-specific policy on remote working that defines the relevant conditions and restrictions. Where deemed applicable, the following matters should be considered:

  

a\) the existing or proposed physical security of the remote working site, taking into account the physical security of the location and the local environment, including the different jurisdictions where personnel are located;

  

b\) rules and security mechanisms for the remote physical environment such as lockable filing cabinets, secure transportation between locations and rules for remote access, clear desk, printing and disposal of information and other associated assets, and information security event reporting (see [6.8](a-6.8-Information-security-event-reporting.md));

  

c\) the expected physical remote working environments;

  

d\) the communications security requirements, taking into account the need for remote access to the organization’s systems, the sensitivity of the information to be accessed and passed over the communication link and the sensitivity of the systems and applications;

  

e\) the use of remote access such as virtual desktop access that supports processing and storage of information on privately owned equipment;

  

f\) the threat of unauthorized access to information or resources from other persons at the remote working site (e.g. family and friends);

  

g\) the threat of unauthorized access to information or resources from other persons in public places;

  

h\) the use of home networks and public networks, and requirements or restrictions on the configuration of wireless network services;

  

i\) use of security measures, such as firewalls and protection against malware;

  

j\) secure mechanisms for deploying and initializing systems remotely;

  

k\) sec ure mechanisms for authentication and enablement of access privileges taking into consideration the vulnerability of single-factor authentication mechanisms where remote access to the organization’s network is allowed.

  

The guidelines and measures to be considered should include:

  

a\) the provision of suitable equipment and storage furniture for the remote working activities, where the use of privately-owned equipment that is not under the control of the organization is not allowed;

  

b\) a definition of the work permitted, the classification of information that can be held and the internal systems and services that the remote worker is authorized to access;

  

c\) the provision of training for those working remotely and those providing support. This should include how to conduct business in a secure manner while working remotely;

  

d\) the provision of suitable communication equipment, including methods for securing remote access, such as requirements on device screen locks and inactivity timers; the enabling of device location tracking; installation of remote wipe capabilities;

  

e\) physical security;

  

f\) rules and guidance on family and visitor access to equipment and information;

  

g\) the provision of hardware and software support and maintenance;

  

h\) the provision of insurance;

  

i\) the procedures for backup and business continuity;

  

j\) audit and security monitoring;

  

k\) revocation of authority and access rights and the return of equipment when the remote working activities are terminated.

  

**Other information** No other information.