All 93 controls · People controls
Control 6.7
Remote working
What ISO/IEC 27002:2022 control 6.7 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Where personnel work remotely, security measures are to be applied to protect information that is accessed, processed or held away from the organization's premises. Purpose: keep information secure during remote working. Guidance: remote working means working from anywhere outside the premises with access to paper or electronic information, including teleworking, telecommuting, flexible workplaces, virtual environments and remote maintenance; local law may prevent some measures. Organizations allowing it issue a topic-specific remote working policy setting conditions and restrictions. Matters to weigh include: the physical security of the remote site and its surroundings, including the jurisdictions people are in; rules and mechanisms there such as lockable storage, secure transport between locations, and rules on remote access, clear desk, printing, disposal and event reporting (6.8); the physical environments expected; communications security given the systems reached, the sensitivity of information passed and of the systems and applications; remote access methods such as virtual desktops that allow work on privately owned equipment; the risk of access by others at the site, such as family and friends, or by people in public places; use of home and public networks and rules on wireless configuration; firewalls and anti-malware; secure remote deployment and initialization of systems; and secure authentication and privilege enablement, bearing in mind the weakness of single-factor authentication for network access. Measures include: providing equipment and storage furniture where private equipment is not allowed; defining the permitted work, the classification levels of information allowed to be held and the systems the worker may use; training for remote workers and their support staff on working securely; suitable communication equipment with secured remote access, screen locks, inactivity timeouts, location tracking and remote wipe; physical security; rules on what household members and visitors may see or touch; hardware and software support and maintenance; insurance; backup and continuity procedures; audit and security monitoring; and withdrawing authority and access and recovering equipment when remote working ends.
Purpose in the standard’s terms, in our words: Ensures the security of information when personnel work remotely.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Asset management, Information protection, Physical security, System and network security; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Asset managementInformation protectionPhysical securitySystem and network security |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
- Remote access configuration showing multi-factor authentication, secure channels or virtual desktops
- Endpoint configuration for remote devices: screen lock, inactivity timeout, firewall, anti-malware, encryption, location tracking and remote wipe
- Training records for remote workers and support staff on secure remote working
- Rules for home and public network use, printing, disposal and family or visitor access
- Records of revoking access and recovering equipment when remote working arrangements end
Where audits commonly find gaps
- Remote access relies on a password alone
- Personally owned devices are used with no control over what information they store
- Remote workers print and dispose of sensitive documents at home without any rules
- Monitoring and backup do not extend to remote endpoints
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 4 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (06.2.2) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.