ISO 27002:2022, Control 6.7 – Remote Working

Attributes Table

Attributes are used to categorise controls. You can immediately match your control option with widely used industry phrases and specs by using attributes.

Attributes for control 6.7 are as seen below.

What Is the Purpose of Control 6.7?

The purpose of Control 6.7 is to ensure that personnel working remotely have adequate access controls in place to protect the confidentiality, integrity and availability of sensitive or proprietary information, processes and systems from unauthorised access or disclosure by unauthorised individuals.

To ensure the security of information when personnel are working remotely, organisations should issue a topic-specific policy on remote working that defines the relevant conditions and restrictions for information security. The policy should be distributed to all staff and include guidance on how they can use remote access technologies safely and securely.

A topic-specific policy like this will likely cover:

• The circumstances in which remote working is permitted.
• The processes used to ensure that remote workers are authorised to access confidential information.
• The procedures for ensuring that information is protected when it is transmitted between different physical locations.

In addition to these basic requirements, it is also important to have a clearly defined procedure for reporting incidents, including the appropriate contact details. This can help reduce the risk of breaches or other types of security incidents from occurring in the first place.

The policy may also need to address issues such as encryption, firewalls and antivirus software updates as well as employee training about how to use remote connectivity safely.

What Is Involved and How to Meet the Requirements

In order to meet the requirements for control 6.7, organisations allowing remote working activities should issue a topic-specific policy on remote working that defines the relevant conditions and restrictions.

The policy should be reviewed regularly, particularly when there is any change in technology or legislation.

The policy should be communicated to all employees, contractors and other parties involved in remote working activities.

The policy should be documented and made available to any relevant third party, including regulators and auditors.

Organisations must also ensure that they have adequate measures in place to protect sensitive or confidential information transmitted or stored electronically during remote working activities.

In line with the provisions of control 6.7, the following matters should be considered:

• The existing or proposed physical security of the remote working site, taking into account the physical security of the location and the local environment, including the different jurisdictions where personnel are located.
• Rules and security mechanisms for the remote physical environment such as lockable filing cabinets, secure transportation between locations and rules for remote access, clear desk, printing and disposal of information and other associated assets, and information security event reporting.
• The expected physical remote working environments.
• The communications security requirements, taking into account the need for remote access to the organisation’s systems, the sensitivity of the information to be accessed and passed over the communication link and the sensitivity of the systems and applications.
• The use of remote access such as virtual desktop access that supports processing and storage of information on privately owned equipment.
• The threat of unauthorised access to information or resources from other persons at the remote working site (e.g. family and friends).
• The threat of unauthorised access to information or resources from other persons in public places.
• The use of home networks and public networks, and requirements or restrictions on the configuration of wireless network services.
• Use of security measures, such as firewalls and protection against malware.
• Secure mechanisms for deploying and initialising systems remotely.
• Secure mechanisms for authentication and enablement of access privileges taking into consideration the vulnerability of single-factor authentication mechanisms where remote access to the organisation’s network is allowed.

The guidelines and measures to be considered should include:

1. The provision of suitable equipment and storage furniture for the remote working activities, where the use of privately-owned equipment that is not under the control of the organisation is not allowed.
2. A definition of the work permitted, the classification of information that can be held and the internal systems and services that the remote worker is authorised to access.
3. The provision of training for those working remotely and those providing support. This should include how to conduct business in a secure manner while working remotely.
4. The provision of suitable communication equipment, including methods for securing remote access, such as requirements on device screen locks and inactivity timers.
5. The enabling of device location tracking.
6. Installation of remote wipe capabilities.
7. Physical security.
8. Rules and guidance on family and visitor access to equipment and information.
9. The provision of hardware and software support and maintenance.
10. The provision of insurance.
11. The procedures for backup and business continuity.
12. Audit and security monitoring.
13. Revocation of authority and access rights and the return of equipment when the remote working activities are terminated.

Changes and Differences from ISO 27002:2013

Control 6.7 in ISO 27002:2022 is a modified version of control 6.2.2 in ISO 27002:2013 and is not a new control.

While these two controls have many characteristics, they differ somewhat in nomenclature and wordings. The control name, for example, is not the same. Control 6.2.2 in ISO 27002:2013 is referred to as teleworking. Control 6.7 refers to it as remote working. At the same time, teleworking was replaced by remote working in the new version of the standard.

In control 6.7, ISO 27002:2022, the standard defines what remote working is, and the types of work that can qualify as remote working. This includes teleworking, which is the original control name in the 2013 version of the standard.

The implementation guidelines are somewhat similar even though the language and terms are different. Version 2022 used a lot of user-friendly language so as to ensure that the users of the standard can understand what they are doing.

That said, some points were added in control 6.7 and some removed from control 6.2.2.

Added to Control 6.7 Remote Working

• rules and security mechanisms for the remote physical environment such as lockable filing cabinets, secure transportation between locations and rules for remote access, clear desk, printing and disposal of information and other associated assets, and information security event reporting.
• the expected physical remote working environments.
• the threat of unauthorised access to information or resources from other persons in public places.
• secure mechanisms for deploying and initialising systems remotely.
• secure mechanisms for authentication and enablement of access privileges taking into consideration the vulnerability of single-factor authentication mechanisms where remote access to the organisation’s network is allowed.

Removed From Control 6.2.2 Teleworking

• The use of home networks and requirements or restrictions on the configuration of wireless network services.
• Policies and procedures to prevent disputes concerning rights to intellectual property developed on privately owned equipment.
• Access to privately owned equipment (to verify the security of the machine or during an investigation), which may be prevented by legislation.
• Software licensing agreements that are such that organisations may become liable for licensing for client software on workstations owned privately by employees or external party users.

Furthermore, the ISO 27002 version 2022 provides statements of purpose and attribute tables for each control, which assist users in better understanding and implementing the controls.

The 2013 version does not have these two parts.

Who Is in Charge of This Process?

The primary responsibility for creating an information security policy for remote workers lies with the organisation’s information security officer. However, other stakeholders should also be involved in the process.

This includes IT managers, who are responsible for implementing and maintaining the policy, as well as HR managers, who are responsible for making sure that employees understand it and adhere to it.

If you have a vendor management program, then the answer will depend on who is responsible for managing contractors and vendors in general. In most cases, this person would also be responsible for creating an information security policy for remote workers in that department.

What Do These Changes Mean for You?

The ISO 27002 was not significantly changed so you don’t need to do much except check that your information security processes are in line with the upgrade.

The main change was to modify some of the controls and to clarify some of the requirements. The main effect as with regards to control 6.7 is that if you outsource any of your operations to a third party or have people working remotely, you will need to ensure that they have an appropriate level of security controls in place.

If you have an existing ISO 27001 certification, then your current process for managing information security will meet the new requirements.

This means that if you are looking to renew your current ISO 27001 certification then you don’t need to do anything at all. You just have to make sure that your processes still align with the new standard.

If however, you’re starting from scratch, then you’ll need to put some thought into how your company can be prepared for cyber attacks and other threats to its information assets.

The main thing is that it’s important to treat cyber risks seriously enough so that they’re managed as part of your overall business strategy rather than being treated as a separate issue by IT or security departments alone.

How ISMS.Online Helps

The ISMS.Online platform helps with all aspects of implementing ISO 27002, from managing risk assessment activities through to developing policies, procedures and guidelines for complying with the standard’s requirements.

It provides a way to document your findings and communicate them with your team members online. ISMS.Online also allows you to create and save checklists for all of the tasks involved in implementing ISO 27002, so that you can easily track the progress of your organisation’s security program.

With its automated tool set, ISMS.Online makes it easy for organisations to demonstrate compliance with the ISO 27002 standard.

Contact us today to schedule a demo.