ISO 27001 A.6.7: Protect Information During Remote Work
ISO 27001 A.6.7 addresses security measures for information accessed, processed or stored when personnel work outside the organisation’s premises. Remote work includes more than a home office: travel, customer locations and temporary project settings may all change the protection needed. A secure network connection does not address every exposure in those environments.
What A.6.7 requires in practice
Annex A control 6.7 applies whenever personnel work away from the organisation's premises. The organisation is expected to put security measures in place to protect information that is accessed, processed or stored in those remote settings. Remote work covers a home office, but also travel, hotels, customer sites and temporary project locations. The control is not limited to a secure connection; it also reaches the physical surroundings, the devices used and how people handle paper or local copies. Practical parts include deciding what work is allowed remotely, what conditions the setting must meet, how equipment is supplied and supported, and how personal devices, if permitted, are handled. The standard does not prescribe a single remote-access design or identical equipment for all staff. The outputs are an agreed remote working arrangement based on risk, communicated to people, with the technical and behavioural measures it relies on actually in place.
Decide which work can be done in which conditions
Identify the information and activity before approving the setting. Reading public material and discussing sensitive customer details have different needs. Define permitted work, relevant restrictions and what staff should do if the environment no longer supports them.
Consider who else may see or hear information. Shared households, visitors, adjacent desks and public spaces can affect confidentiality. The answer may involve changing the task, moving to an appropriate setting or using suitable protections. Avoid assuming that staff can create privacy through personal effort when the work environment makes it impossible.
Where personal equipment is permitted, establish the boundary between organisational protection and the individual’s privacy and ownership. Determine appropriate access, support and information-removal arrangements with relevant legal and policy input. Do not assume unlimited authority to inspect or erase a privately owned device.
Provide workable equipment and support
Staff need approved ways to access information, obtain assistance and keep equipment maintained. Remote deployment and recovery can be difficult when the usual support desk cannot physically reach the device. Plan those processes before an urgent failure encourages use of an unmanaged alternative.
Explain how to handle local copies, printing and disposal. Some remote activities may not justify printing sensitive information at all; others may require a controlled method. A rule should be matched with practical resources and an escalation route, rather than simply instructing staff to improvise secure storage.
Why protecting remote work matters to the business
Remote and hybrid work moves information into environments the organisation does not control: shared homes, public places and personal networks. Each brings exposure to overheard conversations, lost devices and unmanaged copies. Customers who outsource work to you often ask specifically how remote staff are controlled, and a weak answer can lose or end a contract. Getting this right also supports resilience, since people can keep working safely when offices are unavailable. For audit, remote working is a common sampling area, and a clear arrangement that matches how people really work avoids findings and shows that the ISMS covers the whole workforce.
How to implement A.6.7
Design the arrangement from how your people actually work away from the office. Keep the result readable by a non-specialist, since remote staff will rely on it without anyone beside them.
- Identify who works remotely, where, and with what kinds of information.
- Decide which activities are acceptable in which settings and which need extra protection or are not allowed.
- Define the equipment, access method and support route for remote staff, including how a failed device is repaired or replaced.
- Set the boundary for personal devices, if allowed, agreeing the position with legal and HR on inspection and removal of business data.
- Give practical guidance on shared spaces, calls, printing and disposal of paper.
- Communicate the arrangement and provide an escalation route for situations it does not cover.
- Check that the rules work in practice through spot checks, staff feedback and incident review, and refine them. Ask remote staff what they find hard to follow, because those are the rules most likely to be bypassed.
Illustrative BPO example: a call can be overheard
A hypothetical BPO agent works remotely through an approved managed device and secure connection. The agent takes customer calls in a shared living space where another person can hear sensitive details. The technical connection works correctly, but the working arrangement does not meet the information-handling need.
The organisation assesses which calls can be handled in that setting and provides an appropriate alternative arrangement where necessary. Supervisors explain how to pause or relocate work when privacy changes. The control addresses the actual exposure rather than treating a successful login as proof of remote-working suitability.
Illustrative construction example: a temporary project office
A hypothetical construction manager works from a shared project cabin. A portable printer produces commercial records that remain in an open tray after the manager leaves for a site visit. The device and connection are approved, but paper handling has not been considered.
The project establishes suitable printing, collection and storage rules, with access limited to the relevant audience. The manager knows how to handle unwanted copies and report loss. The example shows that remote work is an information lifecycle problem, not solely a laptop configuration problem.
Prepare for changes, loss and disruption
A remote location, device or task can change. Give personnel a way to request a new arrangement and report limitations. Travelling to another jurisdiction or connecting through a different service may introduce obligations or risks requiring assessment; avoid assuming one approval covers every future location.
Make event reporting available when the ordinary device or account is unavailable. Staff should know the authorised response to loss, suspected compromise or accidental disclosure without attempting unsupported investigation. Coordinate continuity arrangements so that an outage does not automatically push work into personal accounts.
End remote arrangements deliberately
When remote work ends or the person’s role changes, review remote permissions, equipment and retained information. A worker returning to the office may still hold local copies or access that was only justified for the earlier arrangement.
Check whether protective measures remain proportionate and effective. Monitoring or remote-management capabilities should be governed appropriately, including privacy considerations. The fact that a technology can collect information does not establish that every form of monitoring is justified.
Evidence and useful checks
Useful evidence includes approved conditions, communicated instructions, suitable equipment and access arrangements, support records and proportionate checks. A.6.7 does not universally require intrusive inspections of employees’ homes. Choose assurance methods that address risk and respect applicable boundaries.
Sample a normal working task and an exception: a failed device, unexpected visitor or need to print. Ask whether the person can continue securely or knows when to stop and seek help. Common failures include connection-only assessments, unsupported personal-device use and rules that ignore paper or spoken information.
Common nonconformities with A.6.7
Typical findings arise where the policy and the reality of remote work differ. Most are visible simply by asking a few remote workers to describe how they work day to day.
- A remote working policy that covers home offices but ignores travel and customer sites.
- Personal devices used for business information with no agreed conditions.
- No practical way to support or recover a device that is far from the support desk.
- Staff taking sensitive calls in public places with no guidance.
- Printed sensitive material at home with no disposal arrangement.
Frequently asked questions
Does a VPN satisfy remote-working security?
It may protect aspects of connectivity, depending on the design. It does not address every issue involving devices, local copies, conversations, physical access or support.
Does this control apply at customer or project sites?
Yes, work outside the organisation’s premises can involve those settings. Assess the task and environment rather than limiting the policy to home offices.
Must the employer inspect every home workspace?
No universal inspection method is prescribed. Establish proportionate assurance that addresses the relevant risks and respects applicable privacy, employment and legal constraints.
Make remote controls fit real working conditions
Discuss remote-working security with Sterling. Consulting and scoped Effivity ISO & GRC automation software can connect approvals, learning and implementation evidence. Enrol staff in Information Security Essentials training and reinforce your local procedures. Certification remains independently decided. Return to the people controls guide.