ISO 27001 Control 6.7: Remote Working

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

In short: ISO 27001 control 6.7, remote working, requires security measures for people working away from your premises. For a small business that means managed or approved devices, secure access to company services, guidance on public networks and places, and clear rules on personal devices.

When I look at remote and hybrid working in small businesses, the biggest gap is almost always the same: personal devices, connecting to company systems, with no restrictions at all.

It is an easy gap to fall into. Staff check email on their home laptop, open shared files on their own tablet, and sign in to the company’s cloud services from whatever device is nearest. Very few people stop to consider what that means: a personal device, probably without much in the way of hardening, connected straight into the heart of the business’s operations. If that device is infected, ransomware can potentially reach everything that person can reach.

The frustrating part is how easy it is to fix. Microsoft 365 and Google Workspace both let you set the security standard a device must meet before it can connect. This page covers what control 6.7 requires and how to meet it proportionately, and there is a free remote working checklist further down.

What control 6.7 actually asks for

The control requires security measures to be implemented when personnel are working remotely, to protect information accessed, processed or stored outside the organisation’s premises. In practice that means a remote working policy, and the technical measures that enforce it, covering:

• Which devices can be used, and to access what.
• The standard those devices must meet: supported operating system, patching, encryption, screen lock, malware protection.
• Secure access: MFA, and conditions on where and how people connect.
• Physical security away from the office: screens in public, devices in cars, conversations on calls.
• Home networks and public Wi-Fi.
• Reporting a lost or stolen device quickly.

In the 2013 edition this was control A.6.2.2, teleworking. The 2022 version broadens it to all remote working, reflecting how most organisations now operate.

Personal devices: the biggest gap

Company laptops are usually reasonably well looked after: encrypted, patched, managed. Personal devices are the unknown. Nobody knows whether they are patched, whether anyone else in the household uses them, what else is installed, or whether they are already compromised.

It also matters for Cyber Essentials. The Cyber Essentials requirements bring personal devices that access organisational data or services into scope, so unmanaged personal devices can stop you passing as well.

You have three options, and most small businesses use a mix:

• Do not allow them. Company devices only. Simple, but often unrealistic for phones.
• Allow them, with conditions enforced by the platform. The approach I recommend for most.
• Allow them with limited access. Browser only, no downloads, no admin systems.

What you should not do is allow them with no conditions, which is what most organisations are actually doing.

Restricting devices is easier than you think

This is the part people do not realise. Both major platforms can check a device before letting it connect:

• In Microsoft 365, Conditional Access can require devices to be compliant with your policies or enrolled in management, require MFA, block unsupported platforms and limit what unmanaged devices can do. App protection policies can keep company data inside managed apps on personal phones.
• In Google Workspace, endpoint management lets you require device approval, enforce screen locks and encryption, and wipe company data from a lost device.

Set a minimum standard: a supported, patched operating system, encryption, a screen lock and MFA. Devices that meet it get access; devices that do not get limited access or none. Then the policy is enforced wherever people happen to be working.

Check your licence. Some of these features need a particular plan, such as Microsoft 365 Business Premium. For many small businesses that upgrade is the single best security investment they can make, and the NCSC’s BYOD guidance is a good place to start deciding how far to go.

The rest of remote working

Devices are the biggest gap, but not the only one. A proportionate remote working policy also covers:

• Home networks. Change the router’s default password and keep its firmware updated. No need to inspect people’s homes.
• Public Wi-Fi. Fine for cloud services protected by MFA and encryption; avoid for admin work, or use a mobile hotspot.
• Working in public. Screens visible to others, conversations overheard on trains, laptops left in cars.
• Family use. Company devices are not for family use. Children and partners do not need access to client data.
• Printing and paper at home. Avoid it if you can; if not, store and shred properly.
• Lost or stolen devices. Report straight away, so the device can be wiped remotely.

What auditors will look for

For remote working, I ask how people actually work, not only what the policy says.

1. The remote working policy. Does it exist, and does it say which devices may be used for what?
2. Enforcement. Show me the Conditional Access or endpoint management settings. A policy that says personal devices must be patched, with nothing checking, is a hope.
3. Personal devices. How many are connecting right now? The admin console will tell you.
4. Encryption and remote wipe for company laptops and phones.
5. Awareness. I will ask a remote worker how they would report a lost laptop and what they do on public Wi-Fi.

Common issues

• Personal devices connecting to company systems with no conditions at all.
• A remote working policy with nothing technical enforcing it.
• Licences that include device controls, with the controls never switched on.
• Admin work done from personal or shared family computers.
• No way to wipe company data from a lost personal phone.
• Lost devices reported days later, if at all.

The self-check

Picture someone working from a café this afternoon.

• How many personal devices are signed in to your company systems right now?
• Could an unpatched personal laptop sign in to your email and files today?
• Does your Microsoft 365 or Google Workspace licence include device controls you are not using?
• If a member of staff lost their phone tonight, could you remove company data from it?
• Is any admin work done from personal devices?

The first two are the ones to sit with. The answers are in your admin console, and they are usually a surprise.

What I see in audits

Most smaller organisations have not really thought through the risks of remote working. The one I raise most often is untrusted networks: café, hotel and co-working Wi-Fi, where traffic can be watched or redirected. Very often there is no policy at all on working in public places, and VPNs, where they exist, are usually reserved for developers rather than everyone.

My own approach is simple. When I work away from home I use Cloudflare’s free WARP client, which encrypts traffic between my laptop and the internet. It is not a corporate VPN, and it does not replace securing the services themselves, but it is a sensible baseline for anyone who works on public networks, and it costs nothing.

The guidance usually arrives late. Among the businesses I coach, almost none have any written guidance on working in public places at the start. By the time they approach an internal audit most have something, but in my experience, across the businesses I coach, around seven in ten of those documents are AI-generated and do not really help. They are generic bullet points that nobody reads. They do not tell people anything specific, such as which tool to switch on before using public Wi-Fi, or which networks not to connect to and why.

The purpose of this control is to change behaviour, and generic text does not do that. A one-page guide written for your own tools and your own people, read and acknowledged, is worth more than ten pages of generated policy.

How control 6.7 links to other clauses and controls

• Control 8.1, User endpoint devices. The device standards that remote working depends on.
• Control 5.15, Access control. Conditional access is access control.
• Control 5.17, Authentication information. MFA for remote access.
• Control 7.9, Security of assets off-premises. Physical care of devices away from the office.
• Control 6.8, Information security event reporting. Reporting a lost device quickly.

Frequently asked questions

Sources and further reading

Official legislation, standards and guidance referred to on this page.

• ISO/IEC 27002:2022. The implementation guidance that accompanies the controls.
• Bring your own device (BYOD). NCSC guidance on allowing personal devices.
• Device security guidance. NCSC guidance on configuring and managing devices.
• Conditional Access overview. Microsoft documentation for restricting access by device and conditions.
• Google endpoint management. Google Workspace documentation for managing and securing devices.
• Cyber Essentials. The UK scheme whose scope includes personal devices that access organisational data.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call