ISO 27001 A.6.7: Remote Working

Quick Reference (60 Seconds)

What the Control Asks For

Do you need this control?

A.6.7 is not mandatory in itself: under clause 6.1.3 you include it if your risk assessment calls for it, and record the decision in your Statement of Applicability. Include it if anyone works away from your premises, at home, client sites or while travelling. A fully on-site organisation could exclude it with that reason, though this is rare today.

The Control in Brief

Annex A 6.7 asks organizations to implement security measures when personnel work remotely, to protect information accessed, processed or stored outside the organization's premises.

Implementation Guidance (ISO 27002:2022, paraphrased)

Issue a topic-specific remote working policy setting conditions and restrictions. Consider, where applicable:

• (a) the physical security of the remote site and its surroundings, including the jurisdictions where people are located
• (b) rules for the remote physical environment: lockable storage, secure transport, clear desk, printing, disposal, and event reporting (A.6.8)
• (c) the expected remote environments (home, client site, travel)
• (d) communications security, given the sensitivity of the information and systems accessed
• (e) virtual desktop or similar access that keeps processing and storage off privately owned equipment
• (f)–(g) the threat of access by family, friends and people in public places
• (h) home and public networks, with requirements or restrictions on wireless configuration
• (i) firewalls and malware protection; (j) secure remote deployment and initialisation of systems
• (k) secure authentication, recognising the weakness of single-factor authentication for remote access

Measures to consider include: suitable equipment where personal devices are not allowed; defining the work permitted, the classification of information that may be held and the systems that may be accessed; training for remote workers and those who support them; screen locks, inactivity timers, location tracking and remote wipe; physical security; rules on family and visitor access; hardware and software support; insurance; backup and business continuity; audit and monitoring; and revoking access and returning equipment when remote work ends. 27002 notes that some measures may not be lawful in every jurisdiction, which matters for monitoring.

"Shall" vs "Should" Analysis

• Shall (once you have selected this control): security measures for remote working are implemented
• Should: Specific measures, tools, and procedures are flexible based on context

Common Misinterpretations

Why Remote Working Security Matters

The Business Risk Narrative

Remote work has exploded in India, creating massive security exposure:

• Hybrid and remote work are now normal for Indian IT, ITeS and SaaS companies, which moves information outside the office perimeter
• Unmanaged personal devices, home networks shared with family, and lost or stolen laptops are the recurring remote-work risks
• DPDP Act 2023: failing to take reasonable security safeguards, including for remote work, can attract a penalty of up to ₹250 crore
• Home burglary and theft of work devices are a real risk for remote workers
• Family members using work devices is a common way information is exposed

Regulatory Landscape in India

Industry-Specific Consequences

Scope and Applicability

What the Control Covers

• Remote work authorization: Formal process for approving remote work
• Remote work policy: Documented policy covering all remote work scenarios
• Device security: Company devices or managed BYOD for remote work
• Network security: VPN, secure home Wi-Fi, public Wi-Fi restrictions
• Physical security: Home office privacy, device storage, access restrictions
• Data protection: No printing, secure storage, data deletion, DLP
• Access control: MFA, least privilege, session timeout, conditional access
• Communication security: Encrypted email, secure messaging, video conferencing
• Monitoring: Activity monitoring, compliance verification, incident detection
• Incident response: Remote-specific incident reporting and response
• Home office equipment: Company-provided equipment, secure setup, return process
• Family and visitor access: Restrictions on unauthorized access to work devices
• Travel security: Working from hotels, cafes, airports, client sites
• Termination: Remote work termination, equipment return, access revocation
• Training: Remote work security awareness and training
• Compliance: Regulatory compliance for remote work (DPDP, RBI, etc.)

Who It Applies To

What It Does NOT Cover

• General remote work HR policy (flexibility, hours, performance), covered by HR
• Remote work compensation and benefits, covered by HR/Finance
• General IT support, covered by IT helpdesk
• Physical office security, covered by physical security controls
• General cybersecurity, covered by technical controls (but remote-specific security is covered here)

Size-Based Applicability

Key Definitions and Terminology

Relationship to Other Controls

Upstream Controls (Prerequisites)

Downstream Controls (Enabled By)

Parallel Controls (Work Alongside)

Implementation Roadmap (Week-by-Week)

Phase 1: Discovery and Assessment (Weeks 1-2)

Week 1: Remote Work Inventory

• Deliverable: Remote work inventory and risk assessment
• Owner: CISO + IT + HR
• Activities:
  1. Identify all remote workers (full-time, hybrid, occasional, travel, client site)
  2. Inventory all remote devices (company-owned, BYOD, personal)
  3. Inventory all remote access methods (VPN, RDP, cloud, SaaS, direct)
  4. Assess home network security (Wi-Fi, router, ISP)
  5. Assess home office physical security (privacy, access, storage)
  6. Assess remote data handling (printing, storage, USB, cloud)
  7. Assess remote communication security (email, messaging, video)
  8. Assess remote monitoring and logging
  9. Assess remote incident response capability
  10. Benchmark against ISO 27001 requirements and industry practices

Week 2: Risk Analysis

• Deliverable: Remote work risk analysis report
• Owner: CISO + IT + HR + Compliance
• Activities:
  1. Map remote work scenarios to risks (device theft, network compromise, data leakage, unauthorized access)
  2. Identify high-risk remote workers (access to sensitive data, admin rights, customer data)
  3. Assess remote work compliance gaps (DPDP, RBI, SEBI, industry-specific)
  4. Identify Shadow IT used by remote workers
  5. Assess remote work authorization process (formal vs. informal)
  6. Assess remote work training gaps
  7. Identify unmanaged devices with work access
  8. Define target state for remote work security maturity
  9. Create gap closure plan

Phase 2: Design and Planning (Weeks 3-4)

Week 3: Remote Work Policy and Controls Design

• Deliverable: Remote Work Policy + Home Office Security Guide + Remote Work Security Checklist
• Owner: CISO + IT + HR + Legal
• Activities:
  1. Design remote work authorization process (request, approval, security review, agreement)
  2. Design remote work policy (scope, eligibility, security requirements, prohibited activities)
  3. Design device policy (company devices vs. BYOD vs. no personal devices)
  4. Design VPN/remote access policy (mandatory VPN, split vs. full tunnel, geofencing)
  5. Design home network security requirements (WPA3, strong password, router security)
  6. Design physical security requirements (privacy, clean desk, device lock, storage)
  7. Design data protection requirements (no printing, DLP, secure storage, encryption)
  8. Design access control (MFA, conditional access, session timeout, least privilege)
  9. Design communication security (encrypted email, approved messaging, secure video)
  10. Design monitoring requirements (activity monitoring, compliance checks, DLP)
  11. Design incident response for remote work (reporting, investigation, containment)
  12. Design home office equipment provision (company laptop, monitor, peripherals, chair)
  13. Design travel security (public Wi-Fi, hotel, cafe, airport, client site)
  14. Design termination process (remote work end, equipment return, access revocation)
  15. Legal review for DPDP compliance and liability

Week 4: Technical Architecture and Tools Design

• Deliverable: Remote Work Technical Architecture + Tool Selection + Implementation Plan
• Owner: CISO + IT + Security Team
• Activities:
  1. Design remote access architecture (VPN, ZTNA, SASE, direct cloud)
  2. Select remote access solution (VPN, ZTNA, SASE) based on organization size
  3. Select MDM/EDR solution for remote device management
  4. Select DLP solution for remote data protection
  5. Select MFA solution for remote authentication
  6. Select remote monitoring solution (activity, compliance, security)
  7. Design home office equipment standard kit
  8. Design remote device provisioning and deprovisioning process
  9. Design remote device compliance check (before access grant)
  10. Design secure remote communication stack (email, messaging, video, file sharing)
  11. Design remote logging and SIEM integration
  12. Design remote incident response playbooks

Phase 3: Implementation (Weeks 5-8)

Week 5: Remote Work Policy Rollout

• Deliverable: Remote work policy published and communicated
• Owner: HR + CISO + IT
• Activities:
  1. Finalize remote work policy with Legal review
  2. Obtain management approval
  3. Publish policy on employee portal and intranet
  4. Communicate to all remote workers (email, town hall, video)
  5. Create remote work security agreement for employees to sign
  6. Create home office security checklist
  7. Create remote work FAQ (30 questions)
  8. Update employee handbook with remote work security section
  9. Track employee acknowledgment of policy

Week 6: Technical Controls Implementation

• Deliverable: Remote access, MDM, DLP, MFA operational
• Owner: IT + Security Team
• Activities:
  1. Deploy VPN/ZTNA solution for all remote workers
  2. Configure MFA for all remote access (mandatory, no exceptions)
  3. Deploy MDM on all company devices and managed BYOD devices
  4. Deploy EDR on all remote endpoints
  5. Deploy DLP for remote endpoints and cloud
  6. Configure conditional access policies (device compliance, location, risk)
  7. Configure remote activity logging and SIEM integration
  8. Configure geofencing if applicable (restrict access from certain countries)
  9. Test all technical controls with pilot group of remote workers
  10. Create remote access troubleshooting guide for IT helpdesk

Week 7: Home Office Setup and Equipment

• Deliverable: Remote workers equipped with secure home office setup
• Owner: IT + Facilities + HR
• Activities:
  1. Define home office equipment standard kit (laptop, monitor, keyboard, mouse, webcam, headset, UPS)
  2. Procure and distribute equipment to remote workers
  3. Configure equipment with security baseline (encryption, MDM, EDR, VPN, MFA)
  4. Create home office setup guide (ergonomics, security, network)
  5. Provide home network security guidance (router setup, Wi-Fi security, password)
  6. Provide screen privacy guidance (positioning, privacy filters, shoulder surfing prevention)
  7. Provide clean desk policy guidance for home office
  8. Verify home office setup compliance (self-assessment + manager verification)
  9. Create equipment return process

Week 8: Training and Monitoring

• Deliverable: All remote workers trained; monitoring operational
• Owner: HR + CISO + Training Team
• Activities:
  1. Create remote work security training module (1 hour, e-learning or live)
  2. Train all remote workers on policy, controls, and responsibilities
  3. Create remote work security awareness materials (posters, videos, intranet)
  4. Create remote work incident reporting guide
  5. Create remote work self-assessment checklist (monthly/quarterly)
  6. Implement remote activity monitoring (compliance, not surveillance)
  7. Create remote work compliance dashboard
  8. Create remote work incident response playbooks
  9. Test incident response with mock remote work incident

Phase 4: Testing and Validation (Weeks 9-10)

Week 9: Technical Testing

• Deliverable: Technical validation report
• Owner: IT + Security Team + Internal Audit
• Activities:
  1. Test VPN/ZTNA from various locations (home, cafe, hotel, client site)
  2. Test MFA enforcement (no access without MFA)
  3. Test MDM compliance (non-compliant device blocked)
  4. Test DLP effectiveness (data exfiltration simulation)
  5. Test EDR detection (malware simulation on remote endpoint)
  6. Test conditional access (device compliance, location, risk)
  7. Test remote logging and SIEM integration
  8. Test remote device wipe (if lost/stolen)
  9. Test secure communication (email encryption, messaging, video)
  10. Test remote incident response (report, investigation, containment)

Week 10: Compliance and Audit Validation

• Deliverable: Compliance validation report
• Owner: Compliance + CISO + Legal
• Activities:
  1. Validate remote work policy against ISO 27001 requirements
  2. Verify DPDP compliance for remote work (personal data protection)
  3. Verify RBI compliance for remote banking work (if applicable)
  4. Verify SEBI compliance for remote trading (if applicable)
  5. Verify employee training completion
  6. Verify policy acknowledgment
  7. Verify equipment provision and return process
  8. Verify monitoring compliance (privacy, DPDP, labor law)
  9. Prepare compliance evidence package
  10. Conduct internal audit of remote work program

Phase 5: Documentation and Certification Prep (Weeks 11-12)

Week 11: Documentation

• Deliverable: Complete remote work security documentation
• Owner: CISO + Compliance Manager
• Activities:
  1. Document all policies, procedures, and checklists
  2. Create illustrative scenarios and examples
  3. Create training materials and videos
  4. Create FAQ and quick reference guides
  5. Create metrics dashboard and reporting templates
  6. Create evidence repository for audits
  7. Document technical architecture and configuration

Week 12: Certification Readiness

• Deliverable: Audit-ready evidence package
• Owner: CISO + Compliance Manager
• Activities:
  1. Conduct internal audit of remote work program
  2. Prepare evidence for external ISO 27001 auditor
  3. Remediate any gaps found
  4. Conduct management review
  5. Present program to certification body

Detailed Implementation Guidance

Step-by-Step Implementation

Step 1: Remote Work Authorization

Authorization Process:

1. Employee submits remote work request (form, reason, duration, location)
2. Manager reviews role suitability and performance
3. HR reviews eligibility and policy compliance
4. Employee completes a home-office self-assessment with photo or attestation (no in-person inspections)
5. IT reviews device and network readiness
6. Legal reviews contract and liability (if applicable)
7. Approval granted with conditions and security requirements
8. Employee signs remote work security agreement
9. IT provisions remote access and equipment
10. Employee completes remote work security training
11. Remote work begins with monitoring

Step 2: Remote Work Policy

Step 3: Implement Remote Access Architecture

Remote Access Architecture Components:

1. VPN/ZTNA Gateway: Entry point for remote access; encrypted tunnel
2. Identity Provider: Authentication and MFA (Azure AD, Okta, Google)
3. Device Compliance Check: MDM verification before access grant
4. Conditional Access Engine: Policy-based access decisions (device, location, risk, user)
5. Micro-Segmentation: Internal network segmentation for remote users
6. Cloud Access Security Broker (CASB): Cloud application security and DLP
7. Secure Web Gateway (SWG): Web filtering and security for remote users
8. Firewall-as-a-Service (FWaaS): Cloud-delivered firewall for remote users
9. SIEM Integration: Remote activity logging and monitoring

Step 4: Implement Device Security

Step 5: Implement Home Network Security

Step 6: Implement Physical Security

Step 7: Implement Data Protection

Step 8: Implement Access Control

Step 9: Implement Communication Security

Step 10: Implement Monitoring

Step 11: Implement Incident Response

Step 12: Implement Travel Security

Step 13: Implement Termination and Return

Step 14: Implement Training

Step 15: Implement Metrics and Reporting

• Track remote worker count (full-time, hybrid, occasional, travel)
• Track remote device inventory (company, BYOD, managed, unmanaged)
• Track VPN usage (who, when, duration, compliance)
• Track MFA compliance (100% remote MFA enforcement)
• Track MDM enrollment rate (target: 100% of remote devices)
• Track DLP alerts for remote workers (trending down)
• Track EDR alerts for remote endpoints (trending down)
• Track remote incident count and type (trending down)
• Track remote work authorization compliance (100% authorized)
• Track home office security assessment completion (100% for full-time remote)
• Track remote training completion (100% of remote workers)
• Track remote device return rate (100% upon termination)
• Report quarterly to management and board

Tools, Technologies, and Solutions

Complete Tool Comparison

Recommendations by Organization Size

Policy and Procedure Templates

Remote Work Security Policy (Key Sections)

Remote Work Security Procedure

Risk Assessment and Treatment

Key Risks Addressed by This Control

Audit and Compliance Checklist

Audit Questions (25 Questions)

Metrics and KPIs

Key Metrics Dashboard

Common Pitfalls and How to Avoid Them

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Indian SaaS Company, CloudTech Solutions

Company Profile:

• Size: 140 employees (100 remote, 40 hybrid)
• Industry: B2B SaaS, Cloud Security Platform
• Location: Pune, India (remote workforce across India)
• Customers: 200 enterprise clients globally
• Regulatory Scope: DPDP Act 2023, SOC 2 Type II, ISO 27001, GDPR

Challenge: CloudTech was 70% remote but had minimal remote security:

• Employees used personal laptops for work without any MDM or security controls
• VPN was "optional" and only 40% of remote workers used it regularly
• No MFA for remote access; only password-based login
• Home networks were not assessed; many used default router passwords and WPA2 with weak passwords
• Public Wi-Fi was commonly used by employees working from cafes and co-working spaces
• No DLP on remote devices; employees stored customer data on personal Google Drive and Dropbox
• No EDR on remote endpoints; malware infections went undetected for weeks
• A developer working from a Mumbai cafe on public Wi-Fi had his credentials stolen via man-in-the-middle attack
• The attacker accessed the company's AWS console, deleted customer data backups, and created fraudulent resources
• The breach led to recovery costs, customer notification and a regulatory inquiry
• 3 customers churned citing "inadequate security practices"
• The company had no remote work policy, no home office guidance, no travel security, no incident response for remote
• Employees were unaware of security risks; no training had been provided since onboarding

Solution:

1. Week 1-2: Emergency Remote Security Assessment

   • Engaged an external security consultant for emergency remote work security redesign
   • Conducted remote security assessment of all 140 employees
   • Found: 60% using personal devices, 60% not using VPN, 0% MFA, 0% MDM, 0% DLP, 0% EDR
   • Found: 30% using public Wi-Fi for work, 25% sharing devices with family, 45% storing work data on personal cloud
   • Created emergency remote work security policy (interim)
   • Implemented emergency VPN for all employees (mandatory)
   • Implemented emergency MFA for all remote access (Azure AD)

2. Week 3-4: Complete Remote Work Program

   • Created complete Remote Work Security Policy
   • Created home office security checklist (network, physical, device, data)
   • Created travel security guide (public Wi-Fi, hotels, cafes, airports)
   • Created remote work incident response playbook (lost device, breach, malware, unauthorized access)
   • Created remote work authorization process (request, security review, approval, agreement)
   • Created BYOD policy (MDM enrollment required; company devices preferred)
   • Legal review for DPDP compliance and privacy

3. Week 5-6: Technical Controls Implementation

   • Deployed Zscaler ZTNA for all remote access (no VPN client needed, cloud-delivered)
   • Deployed Microsoft Intune MDM for all devices (company and BYOD)
   • Deployed Microsoft Defender for Endpoint EDR on all remote endpoints
   • Deployed Microsoft Purview DLP for remote devices and cloud
   • Configured Azure AD conditional access (device compliance, location, risk)
   • Configured geofencing (access restricted from certain countries)
   • Configured remote activity logging in Microsoft Sentinel
   • Created remote device compliance policy (encryption, OS version, patch level, antivirus)

4. Week 7-8: Home Office Setup and Training

   • Provided home office equipment standard kit to all 100 remote workers (laptop, monitor, peripherals)
   • Created home office setup guide (ergonomics, security, network)
   • Created home network security guidance (router setup, Wi-Fi security, DNS)
   • Conducted remote work security training for all 140 employees (1 hour, live + recorded)
   • Training covered: VPN, MFA, device security, home network, physical security, data protection, incident reporting
   • Created remote work security awareness campaign (posters, videos, intranet)
   • Created remote work FAQ (30 questions)
   • Created remote work self-assessment checklist (monthly)

5. Week 9-12: Monitoring, Compliance, and Culture

   • Implemented remote activity monitoring (DLP, EDR, VPN logs, SIEM)
   • Created quarterly remote work compliance dashboard
   • Created remote work security scorecard for each employee (compliance, incidents, training)
   • Conducted first quarterly remote work security review
   • Found: 100% VPN usage, 100% MFA compliance, 100% MDM enrollment, 0% public Wi-Fi violations
   • DLP detected 2 data exfiltration attempts in first month (prevented, employees retrained)
   • EDR detected 1 malware infection on remote endpoint (contained, no data loss)
   • Created remote work security champion program (5 employees recognized)
   • Remote work security became part of organizational culture

Results:

• Remote security posture: From 0% to 100% VPN, MFA, MDM, EDR, DLP coverage
• Incidents: Zero remote breaches in 6 months (vs. 1 catastrophic breach before)
• DLP alerts: 2 data exfiltration attempts detected and prevented
• EDR alerts: 1 malware infection detected and contained
• Public Wi-Fi: work on public networks now always goes through VPN or ZTNA
• Family access: Zero incidents (from 25% before)
• Customer trust: Restored; won 2 new customers citing remote security program
• Compliance: Passed SOC 2 Type II audit with zero remote work findings
• Culture: Remote work security became part of daily practice
• Employee satisfaction: Remote work security score increased from 2.8/5 to 4.2/5

Illustrative Scenario 2: Large BFSI, Bharat National Bank (BNB)

Company Profile:

• Size: 8,500 employees, 3,200 branch staff
• Industry: Retail Banking and Financial Services
• Location: Delhi, India (branches nationwide)
• Customers: 6 million retail customers, 25,000 corporate clients
• Regulatory Scope: RBI, SEBI, IRDAI, DPDP Act 2023, ISO 27001, PCI DSS
• Union: Strong bank employees union; CBA every 3 years

Challenge: BNB had a critical remote work security problem in the post-pandemic era:

• During COVID-19, 4,000 employees were sent to work from home within 48 hours with no security preparation
• Employees used personal laptops with no security controls to access core banking systems
• VPN was overloaded and frequently failed; employees bypassed VPN to access cloud systems directly
• No MFA for remote access; core banking passwords were shared among team members
• Home networks were not assessed; many employees used default router passwords
• Public Wi-Fi was used by employees working from cafes and relatives' homes
• Family members accessed work devices for "just checking something"
• A customer service representative working from home had her laptop stolen from her home during a burglary
• The laptop had no encryption, no MDM, and no remote wipe
• Customer data of 2,000 customers was on the laptop (spreadsheet downloaded for "convenience")
• The theft of an unencrypted laptop with customer data was a personal data breach: the bank reported to CERT-In within 6 hours and to RBI as its directions require, and notified affected customers
• RBI's supervisory review required a complete remote work security overhaul
• The bank had no remote work policy, no home office security, no travel security, no incident response for remote
• Union resisted remote work security measures, fearing "surveillance" and "unfair restrictions"
• The bank had 3,200 branch staff who needed occasional remote work (training, meetings, system access)
• RBI Cyber Security Framework required specific remote work security controls for banking

Solution:

1. Months 1-2: RBI Compliance and Union Alignment

   • Engaged an external security consultant for RBI-compliant remote work security redesign
   • Established Joint Remote Work Security Committee (3 management + 3 union representatives)
   • Conducted 10 workshops with union leaders on remote work security risks in banking
   • Presented RBI data: 1 remote breach could lead to license restrictions, affecting 8,500 jobs
   • Shared industry examples: banks with remote breaches lost RBI approval, faced penalties, and closed branches
   • Union agreed to remote work security terms if:
     • Remote work security training is paid work time
     • Company provides secure home office equipment (not employee expense)
     • No surveillance of personal activity or personal network traffic
     • Monitoring is for security only, not performance surveillance
     • Union representative on security committee
     • RBI-compliant garden leave for customer-facing remote roles
   • RBI compliance plan created with 90-day remediation timeline

2. Months 3-4: Enterprise Remote Work Framework

   • Created enterprise Remote Work Security Policy for 8,500 employees
   • Created role-based remote work authorization (branch staff, customer service, admin, IT, management)
   • Created home office security requirements (network, physical, device, data)
   • Created travel security policy (public Wi-Fi, hotels, cafes, client sites)
   • Created emergency remote work procedure (pandemic, disaster, lockdown)
   • Created remote work incident response playbook (lost device, breach, unauthorized access, malware)
   • Created RBI-specific remote work compliance checklist (RBI Cyber Security Framework alignment)
   • Created garden leave policy for remote customer-facing roles (RBI requirement)
   • Created remote work security agreement for all employees

3. Months 5-6: Technical Controls Implementation

   • Deployed Palo Alto Prisma Access SASE for all remote access (cloud-delivered, scalable)
   • Deployed hardware MFA tokens (YubiKey) for all customer-facing and admin roles (RBI requirement)
   • Deployed Microsoft Intune MDM for all 4,000 remote devices (company-provided)
   • Deployed CrowdStrike Falcon EDR on all remote endpoints
   • Deployed Forcepoint DLP for remote devices and cloud (customer data protection)
   • Configured Azure AD conditional access (device compliance, location, risk, hardware MFA)
   • Configured geofencing (access restricted from high-risk countries; RBI requirement)
   • Configured remote activity logging in Splunk (SIEM integration)
   • Created RBI reporting dashboard for remote work security metrics
   • Created remote device compliance policy (encryption, OS version, patch level, antivirus, EDR, DLP)

4. Months 7-8: Home Office Setup and Training

   • Provided secure home office kit to 4,000 remote workers (laptop, monitor, peripherals, UPS, webcam, headset)
   • Created home office setup guide in Hindi and English (RBI multilingual requirement)
   • Created home network security guidance (router setup, Wi-Fi security, DNS, guest network)
   • Conducted remote work security training for all 8,500 employees (2 hours, paid work time, as per union agreement)
   • Training covered: RBI remote work requirements, VPN, MFA, device security, home network, physical security, data protection, incident reporting, customer data protection
   • Created visual posters on intranet: "Remote Work Security = RBI Compliance = Job Protection"
   • Created remote work FAQ in Hindi and English (40 questions)
   • Created remote work self-assessment checklist (monthly)
   • Trained 500 branch managers on remote work security for their teams

5. Months 9-12: Monitoring, Compliance, and RBI Certification

   • Implemented remote activity monitoring (DLP, EDR, VPN logs, SIEM, UEBA)
   • Created quarterly remote work compliance dashboard for RBI
   • Created remote work security scorecard for each employee (compliance, incidents, training)
   • Conducted first quarterly remote work security review (RBI reporting)
   • Found: 100% VPN usage, 100% MFA compliance (hardware tokens), 100% MDM enrollment, 100% EDR coverage, 100% DLP coverage
   • DLP detected 12 data exfiltration attempts in first quarter (prevented, employees retrained)
   • EDR detected 3 malware infections on remote endpoints (contained, no data loss)
   • Zero lost/stolen device incidents (due to encryption, MDM, and secure home office guidance)
   • RBI audit: zero findings on remote work security; penalty lifted; commendation for improvement
   • SEBI audit: zero findings on remote trading system access
   • PCI DSS audit: zero findings on remote access to cardholder data environment
   • Customer trust restored; no customer churn due to security concerns

Results:

• Remote security posture: From 0% to 100% VPN, MFA, MDM, EDR, DLP coverage for 4,000 remote workers
• RBI compliance: Zero findings; penalty lifted; RBI commendation
• Incidents: Zero remote breaches in 12 months (vs. 1 catastrophic breach before)
• DLP alerts: 12 data exfiltration attempts detected and prevented in first quarter
• EDR alerts: 3 malware infections detected and contained
• Device loss: Zero lost/stolen device incidents (from 1 major before)
• Customer data: Zero unauthorized customer data access from remote
• Union relations: First bank in India with union-approved remote work security terms
• Cost: program investment vs. RBI penalty + reputational damage + customer loss
• Industry recognition: Featured in RBI cybersecurity best practices for remote work in banking
• Employee satisfaction: Remote work security satisfaction increased from 2.5/5 to 4.0/5

Multi-Framework Mapping

The references below genuinely overlap with A.6.7. Use them when one set of evidence must satisfy several frameworks.

Regulatory and Industry Context

India Regulatory Framework

International Regulations

Sector-Specific Requirements

Roles and Responsibilities (RACI)

Documentation and Evidence Requirements

Required Documents

Continuous Improvement

Figure · Tiers

Maturity levels for remote working

Maturity Model (Level 1-5)

Improvement Cycle

• Plan: Annual review of remote work policy; quarterly metrics; industry benchmarking; regulatory updates; employee feedback; threat intelligence; technology trends
• Do: Deploy new tools; update remote access architecture; enhance monitoring; improve automation; update training; refine DLP; enhance EDR; improve home office security
• Check: Measure remote security posture; audit compliance; benchmark; gather feedback; review incidents; analyze threats; technology assessment
• Act: Standardize; communicate; update procedures; report to management; share best practices; union collaboration; regulatory reporting; industry leadership

Technology Trends

• SASE Adoption: Secure Access Service Edge becoming standard for remote work security
• Zero Trust Architecture: Zero trust replacing traditional VPN for remote access
• AI-Driven Remote Security: AI predicting and preventing remote work security incidents
• Biometric Remote Authentication: Fingerprint, face recognition, behavioral biometrics for remote access
• Home Network Security Integration: Organization providing home network security appliances or services
• Predictive Threat Analytics: Predicting remote worker security incidents before they occur
• Continuous Adaptive Trust: Real-time risk assessment for remote access decisions
• Edge Security: Security at the network edge for remote workers
• Remote Work Security as a Service: Managed security services for remote work
• Quantum-Safe Remote Encryption: Preparing remote encryption for quantum computing threats

FAQ

Frequently Asked Questions (20 Questions)

Q1: Is a remote work security policy required for ISO 27001 certification? A: Not automatically. No Annex A control is mandatory. Under clause 6.1.3 you choose the controls your risk assessment calls for, then record A.6.7 in your Statement of Applicability as included (and how) or excluded (and why). If anyone works from home, client sites or while travelling, you will normally include it. An organisation where nobody works remotely could exclude it with that justification. If you include it, auditors will look for remote-working rules and evidence that the technical measures are in place.

Q2: Do we need to provide company devices for remote work, or can employees use personal devices? A: Company-provided devices are preferred for security and control. If BYOD is used, it must be managed (MDM enrollment, containerization, compliance checks). Personal devices without any management should not be used for work.

Q3: Is VPN mandatory for all remote work? A: Yes, VPN is mandatory for remote access to organizational systems. ZTNA (Zero Trust Network Access) is an alternative that provides even stronger security. Public Wi-Fi should be avoided or used only with VPN.

Q4: Can we monitor remote employees without violating privacy? A: Yes, but monitoring must be for security purposes only, not performance surveillance. Employees must be informed of monitoring. Monitoring should focus on work data and devices, not personal activities. DPDP and labor law compliance must be maintained.

Q5: What is the difference between VPN and ZTNA? A: VPN creates an encrypted tunnel to the network; once connected, user has broad network access. ZTNA provides application-level access based on identity, device compliance, and risk; no broad network access. ZTNA is more secure and is the modern replacement for VPN.

Q6: How do we secure home networks for remote work? A: Provide guidance: WPA3/WPA2 encryption, strong Wi-Fi password, change router admin password, update firmware, enable firewall, disable UPnP/WPS, use guest network for personal devices. Do not enforce technically (privacy) but require self-assessment.

Q7: What should we do if a remote worker loses a device? A: (1) Remote wipe via MDM immediately, (2) Revoke access, (3) Report to police, (4) Notify manager, (5) Insurance claim, (6) Assess data exposure, (7) Notify affected parties if data breach, (8) Replace device, (9) Retrain employee on device security.

Q8: Is MFA mandatory for remote access? A: Yes, MFA is mandatory for all remote access with no exceptions. Password-only remote access is a major security risk. Hardware tokens (YubiKey) are recommended for high-risk roles (BFSI, admin, customer data).

Q9: How do we handle remote work for contractors and third parties? A: Contractors require third-party NDA, limited access, managed device or MDM-enrolled BYOD, enhanced monitoring, and contract termination includes access revocation and data return.

Q10: What is conditional access and why is it important? A: Conditional access makes access decisions based on conditions: device compliance, location, user risk, time of day. Example: block access from non-compliant devices or high-risk countries. It adds an intelligent security layer beyond just VPN and MFA.

Q11: How do we prevent family members from accessing work devices? A: Policy prohibition, lock screen with auto-lock, MDM, employee training, and incident response. If family access occurs, treat as security incident: assess exposure, retrain, disciplinary action if repeated.

Q12: What is SASE and should we use it? A: SASE (Secure Access Service Edge) combines network security functions (SWG, CASB, FWaaS, ZTNA) with WAN capabilities (SD-WAN) in a cloud-delivered service. It is ideal for organizations with significant remote workforces. For 500+ remote workers, SASE is highly recommended.

Q13: Do we need different security controls for occasional remote work vs. full-time remote work? A: Full-time remote workers need more complete controls: company devices, home office assessment, secure equipment, VPN, MFA, MDM, EDR, DLP. Occasional remote workers may use lighter controls but still require VPN, MFA, and device security.

Q14: How do we handle remote work during emergencies (pandemic, disaster)? A: Emergency remote work procedure: scalable VPN, emergency device provisioning, relaxed controls temporarily (with risk acceptance), enhanced monitoring, return to normal controls when emergency ends. Plan ahead; do not wait for emergency.

Q15: What travel security measures should remote workers follow? A: Avoid public Wi-Fi (use mobile hotspot or VPN), carry devices as hand luggage, lock devices, use hotel safe, avoid confidential work in public spaces, disable Bluetooth, maintain screen privacy.

Q16: How do we verify data deletion from remote devices upon return? A: MDM remote wipe for company devices, employee data deletion affidavit for BYOD, DLP scan, and verification of cloud data removal. For high-risk roles, device may be scanned or forensically imaged.

Q17: Can we allow remote admin access to critical systems? A: Remote admin access should be restricted and require additional controls: hardware MFA, session recording, just-in-time access, additional approval, enhanced monitoring, and limited time windows.

Q18: What is Shadow IT and how do we prevent it for remote workers? A: Shadow IT is unauthorized software/services used by employees. Prevent it with MDM app whitelist, approved software policy, monitoring, CASB for cloud apps, and employee education on approved tools.

Q19: How do we ensure DPDP compliance for remote work? A: Remote work policy must include DPDP data protection obligations: no personal data on personal devices, encryption, secure transmission, access controls, data deletion, incident reporting, and employee training on DPDP.

Q20: What will an ISO 27001 auditor look for in A.6.7? A: The auditor will verify: (1) remote work security policy exists, (2) remote work is authorized, (3) security measures are implemented (VPN, MFA, device security, network security, physical security, data protection), (4) remote devices are managed, (5) remote access is monitored, (6) remote incidents are responded to, (7) remote workers are trained, (8) there is evidence of implementation (logs, records, compliance checks), and (9) the policy is reviewed.

References and Further Reading

ISO Standards

• ISO 27001:2022: Information Security Management Systems
• ISO 27002:2022: Information Security Controls
• ISO/IEC 27701:2025: Privacy information management systems

Indian Law

• DPDP Act 2023
• IT Act 2000
• RBI Cyber Security Framework: Remote work security for banking
• SEBI CSCRF (2024): Remote trading system access
• IRDAI Guidelines: Remote access to insurance data
• Companies Act 2013
• OSH Code 2020 (replaced the Factories Act 1948)
• Shops and Establishments Act
• POSH Act 2013
• Labour Laws: Home-based worker protections

International

• GDPR (EU): Articles 5, 28, 32
• HIPAA (US): §164.308(a)(4), §164.312(e)**
• SOX (US): Internal controls
• UK Employment Rights Act 1996
• EU Remote Work Directive
• ILO Convention: Home-based worker protections
• FCRA (US): Background checks
• CCPA (California): Employee data privacy
• NIST Cybersecurity Framework: Telework security guidance
• NIST SP 800-46: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security
• NIST SP 800-114: User's Guide to Telework and Bring Your Own Device (BYOD) Security

Industry

• NASSCOM: Remote work best practices for IT industry
• ISACA: Remote work security guidance
• Data Security Council of India: Remote work data protection
• Verizon DBIR: Remote work breach statistics
• Kaspersky: Remote work security research
• Proofpoint: Remote work phishing and threat research
• Microsoft: Remote work security guidance
• Google: Remote work security best practices
• Cisco: Remote work security architecture
• Palo Alto: SASE and remote work security
• Zscaler: ZTNA and remote work
• Netskope: SASE and remote work
• CrowdStrike: Remote endpoint security
• IDC: Remote work security market data