ISO 27001 Annex A 6.7 Remote working security measures
What it says
Security measures shall be implemented when personnel are working remotely to protect information accessed, processed or stored outside the organization's premises.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishImplement security measures to protect company info when working outside the office.
When employees work from home or any place outside the office, their laptops and information can be at risk. This control is about ensuring the safety of company data when staff are working remotely. If it's not followed, sensitive information could be accessed by unauthorised people, leading to data breaches or identity theft.
Free. Save your status, tasks and notes.
Why it matters
Without robust remote-working controls, data accessed off-site may be intercepted on insecure Wi‑Fi or lost from unmanaged devices, leading to breaches and unauthorised disclosure.
How to implement
IT Managers should develop and enforce a remote working policy.
This policy should outline security practices, such as using VPNs (Virtual Private Networks) or secure network connections whenever accessing company data, in line with ISO 27002:2022 and Australian laws like the Privacy Act 1988.
HR should provide training to all staff on secure remote working practices.
This includes how to safely use communication tools, the importance of strong passwords, and recognising phishing attempts. Training should comply with the ASD Essential Eight framework.
The Facilities Manager should assess the physical security of common remote work environments.
They should ensure employees have lockable cabinets for storing physical documents, and advise on securing home offices against theft or unauthorised access.
Procurement should provide the necessary hardware, like laptops and secure USBs, with pre-installed security software.
Equipment should have encryption software installed, following standards such as CPS 234, to protect sensitive information.
The IT Support Team should establish a robust system for managing remote access to company networks.
This includes using multifactor authentication to ensure that only authorised personnel can access the networks remotely, enhancing security as recommended by ISO 27002:2022.
Keep it running
Harden remote access: enforce VPN + MFA, keep remote access clients patched, and require managed devices with encryption, screen locks and remote wipe for off-premises work.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The remote working policy document.
Look at
Whether it includes guidelines on secure data access and storage outside the office. GOOD means the policy is comprehensive and aligns with both ISO 27002:2022 and local legislation.
- Check 2 of 5What an auditor asks for
Ask for
Training records or logs for remote working security awareness.
Look at
If all employees have completed the training within the past year. GOOD training records show full participation and regular updates.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of equipment issuance and maintenance records.
Look at
Whether employees are using organisation-approved secure devices. GOOD means there is a complete inventory and maintained record of secure device usage.
- Check 4 of 5What an auditor asks for
Ask for
Examples of remote connection logs.
Look at
Logs to ensure connections are only from approved employees and devices. GOOD logs show patterns consistent with secure and authorised access.
- Check 5 of 5What an auditor asks for
Ask for
Records on the configuration of home networks by employees.
Look at
Any instructions or assistance provided to ensure secure home network setups. GOOD means employees were supported in securing their home networks.
Mappings
Closest match in ASD Information Security Manual: ISM-0694, Block privately owned devices from SECRET and TOP SECRET systems, which this control covers in full and more.
ASD Information Security Manual: 13 mappings
This control is broader than ISM-0694.
Annex A 6.7 addresses protecting information when personnel work remotely, including controlling which devices can access organisational systems from outside premises. ISM-0694 prohibits privately-owned devices from accessing SECRET and TOP SECRET systems or data, directly constraining high-risk remote access paths. ISM-0694 is a narrow prohibition for high classifications, while Annex A 6.7 encompasses remote working security for all relevant information classifications and scenarios.
This control is broader than ISM-0705.
ISM-0705 requires organisations to disable split tunnelling when connecting to the organisation's network over VPN. Annex A 6.7 requires implementing security measures for remote working to protect information accessed or processed outside the organisation's premises, which commonly includes secure remote access configurations such as VPN policy enforcement. ISM-0705 is a specific remote-access technical safeguard within the broader remote working control scope of Annex A 6.7.
This control is broader than ISM-1554.
ISM-1554 requires specific precautions for personnel travelling overseas with mobile devices to high or extreme risk countries, including using dedicated travel devices and accounts and applying tamper seals. Annex A 6.7 requires security measures for remote working to protect information accessed, processed or stored outside organisational premises, which can include travel and mobile use scenarios. ISM-1554 is a concrete, travel-to-high-risk-countries implementation pattern, while Annex A 6.7 is broader and technology-agnostic for all remote working contexts.
This control is broader than ISM-1887.
ISM-1887 requires mobile devices to be configured with remote locate and remote wipe functionality to reduce risk from loss or theft. ISO/IEC 27001:2022 Annex A 6.7 requires security measures for remote working to protect information accessed or stored outside organisational premises, which can include managing and protecting mobile devices used remotely. ISM-1887 is a specific technical safeguard within the broader remote working security control, while Annex A 6.7 also covers people, process and other technical measures beyond locate/wipe.
This control is broader than ISM-2101.
ISM-2101 requires that sensitive or classified phone calls and conversations are not conducted within or near connected vehicles to reduce acoustic capture and telemetry-assisted eavesdropping risks. ISO/IEC 27001:2022 Annex A 6.7 requires security measures for remote working to protect information accessed or discussed outside organisational premises, which can include guidance on safe locations for confidential conversations. Annex A 6.7 is broader (covers the overall remote-work context), while ISM-2101 is a specific situational prohibition focused on connected-vehicle environments.
- ISM-1504Multi-factor authentication for human users of sensitive data online servicesPartially meets
This control partially meets ISM-1504.
Annex A 6.7 requires organisations to implement security measures to protect information accessed, processed or stored while personnel work remotely. ISM-1504 mandates multi-factor authentication for online services handling sensitive organisational data, which is a common core control for securing remote access. ISM-1504 is one specific technical measure within the broader remote-working security regime that Annex A 6.7 expects (which can also include device hardening, secure connectivity, monitoring, and user guidance).
This control partially overlaps ISM-1400.
ISM-1400 requires enforced separation of classified data and personal data when personnel use privately-owned devices to access sensitive systems or data. ISO/IEC 27001:2022 Annex A 6.7 overlaps by requiring security measures for remote working, which commonly includes controls for BYOD and protecting organisational information off-premises. Annex A 6.7 is broader (covering many remote work safeguards), while ISM-1400 is more specific about enforcing separation of personal and classified data on the endpoint.
This control partially overlaps ISM-1482.
ISM-1482 requires enforced on-device separation of classified data and personal data for organisation-owned mobiles and desktops used to access classified systems or data. Annex A 6.7 requires security measures for remote working to protect information accessed, processed or stored outside organisational premises, and those measures can include managed containers/profiles, separate work/personal spaces, and restrictions on personal app access that incidentally achieve segregation. The connection is indirect: Annex A 6.7 does not specifically mandate classified-versus-personal separation, and ISM-1482 applies regardless of whether the user is remote, so each control has scope the other does not cover.
This control partially overlaps ISM-1866.
ISM-1866 requires organisations to prevent personnel using privately-owned devices from storing classified data from OFFICIAL: Sensitive or PROTECTED systems on those devices. ISO/IEC 27001:2022 Annex A 6.7 relates by requiring remote-working security measures to protect information accessed, processed, or stored outside organisational premises, which may include controls to prevent local storage on unmanaged devices. Annex A 6.7 is broader (covers many remote-working risks), whereas ISM-1866 is a specific prohibition focused on classified data storage on personal devices.
This control supports ISM-0871.
ISM-0871 requires mobile devices to be kept under continual direct supervision when they are being actively used to reduce loss or theft. Annex A 6.7 requires security measures for remote working to protect information accessed, processed or stored outside organisational premises, where mobile devices are frequently used in uncontrolled environments. Direct supervision of a mobile device during active use supports remote-working security by reducing opportunistic theft or unauthorised physical access, but Annex A 6.7 also covers broader remote-work controls (e.g. connectivity, handling practices, and technical safeguards).
This control supports ISM-1084.
ISM-1084 requires secure physical transport of mobile devices using approved security bags when the devices cannot be otherwise secured. Annex A 6.7 requires security measures for remote working to protect information when accessed, processed, or stored outside the organisation's premises. ISM-1084 supports Annex A 6.7 by reducing the likelihood of loss or theft of devices while travelling to/from remote locations, but Annex A 6.7 also covers remote access, environment and procedural controls that ISM-1084 does not address.
This control depends on ISM-0467.
ISM-0467 requires HACE for SECRET and TOP SECRET data communicated outside secure areas. Annex A 6.7 focuses on securing information accessed or processed remotely. HACE can be part of the security measures for remote classified communications, though Annex A 6.7 covers a broader range of remote-working risks.
This control depends on ISM-2096.
ISM-2096 requires mobile devices to be configured so organisational applications and data are kept separate from personal applications and data. This supports ISO/IEC 27001:2022 Annex A 6.7 by reducing the risk of information exposure when personnel use mobile devices for remote work (e.g., BYOD), through containerisation/work profiles and separation of storage and apps. Annex A 6.7 covers many remote-working controls such as secure connectivity and handling practices, while ISM-2096 is a specific mobile data-separation technical requirement.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, explicitly including from untrusted, external or high-risk locations. Strong authentication of personnel connecting from outside the organisation's premises is a key remote working safeguard, so it shares common ground with Annex A 6.7. Annex A 6.7 extends to all security measures protecting information accessed, processed or stored off premises, while IT.PRO-13.4 also applies to authentication from inside the organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.