ISO 27001:2022 · People controls
ISO 27001:2022 6.7: Remote working
ISO 27001:2022 6.7 covers Remote working. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.6.7, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Remote access relies on a password alone.
Where personnel work remotely, security measures are to be applied to protect information that is accessed, processed or held away from the organization's premises. Purpose (stated in ISO/IEC 27002:2022): ensures the security of information when personnel work remotely. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 6.7.
What evidence supports 6.7?
- Annex A people controlStatement of Applicability entry for control A.6.7, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A people controlThe topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
- Annex A people controlRemote access configuration showing multi-factor authentication, secure channels or virtual desktops
- Annex A people controlEndpoint configuration for remote devices: screen lock, inactivity timeout, firewall, anti-malware, encryption, location tracking and remote wipe
- Annex A people controlTraining records for remote workers and support staff on secure remote working
Where this requirement comes from
This is our own statement of ISO 27001:2022 6.7, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Remote access relies on a password alone
- Personally owned devices are used with no control over what information they store
- Remote workers print and dispose of sensitive documents at home without any rules
- Monitoring and backup do not extend to remote endpoints
How it maps to SOC 2
- CC6.6 high Remote working controls protect access originating outside the boundary.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.