Skip to main content
All measures

Measure · ISO 27001 and other standards

Approve remote work securely

Assess a specific task outside your sites. Connect suitable devices, access and support to existing rules for the work environment and information protection.

Accountable: Business owner with IT and the employees concernedReviewed

Reuse existing records

Use the employee policy, information protection policy and existing access control concept. Record the specific approval in the normal work or equipment process rather than creating another remote-work policy.

What to do

  1. 1

    Assess the task and environment

    Clarify activities, information, required access and intended locations. Consider observation or overhearing by others, shared rooms and networks, theft and relevant contractual or travel conditions. Use the existing classification and decide whether the task is permissible in these conditions. Record the task, permitted environment, devices and safeguards in the existing approval record.

  2. 2

    Provide and try the required resources

    Use approved devices and storage and suitable authenticated, protected connections. For private devices, clarify permitted use and management limits. Provide necessary maintenance, support, backup and recovery. Try a typical task, including access and information storage. Explain protection from observation and overhearing, safe storage and the known reporting channel.

  3. 3

    Maintain conditions or end approval

    Reassess new tasks, devices, locations or relevant risks in the existing workflow. If the environment is unsuitable, do not continue the affected work there. End approvals and access no longer needed and handle business information under the existing return and deletion rules.

Worked example

Working on confidential customer information on a train

Fictional example: An employee wants to work on a confidential customer list during a train journey.

Environment and permitted task
DecisionThe responsible role checks handling rules and possible observation. If adequate protection is not possible, the customer list stays closed; the employee chooses a task permitted in that environment.
EvidenceExisting rules and approval with permitted tasks, device, information access and safeguards.

Record the result

  • Existing approval record with task, permitted environment, devices, safeguards and responsibility.
  • Usable resources and communicated rules, with traceable changes or termination in the existing workflow.

Common implementation mistakes

Only switching on a VPN

Also check devices, storage, support and protection against observation or overhearing.

Treating private devices as company property

Clarify permissible management, data transfer and removal of business data before approval.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.6.7 · TelearbeitGerman guide

    The steps determine safe conditions outside sites, provide suitable resources and maintain approvals through changes and termination. The organisation selects suitable safeguards and actually implements them.

  • TISAX · 2.1.4

    VDA ISA 6.0.3 · Partial overlap

    Task-based and environment-based approval, information handling, suitable access and communication support remote work. Additional protection, contractual and travel requirements depend on the actual case.

    Reference

Templates for your implementation

Related resources

Sources and further reading