ISO 27001 Remote Access Policy: Secure Work From Anywhere
The shift to hybrid and remote working has made the remote access policy one of the most critical documents in any ISO 27001 Information Security Management System (ISMS). With employees, contractors, and third parties connecting from home offices, coffee shops, and co-working spaces, the attack surface has expanded dramatically. ISO 27001’s Annex A.6.7 (Teleworking) and A.8 (Access Control) provide the framework for securing remote connections. This article explains exactly what your ISO 27001 remote access policy must cover, including VPN requirements, multi-factor authentication (MFA), endpoint compliance, logging, and third-party access.
Annex A.6.7: Teleworking Requirements in ISO 27001
Annex A.6.7 of ISO 27001:2022 specifically addresses teleworking (remote working). The control states that “security measures shall be implemented to protect information accessed, processed, or stored at teleworking sites.” This is not merely a recommendation – it is a requirement for certification.
The control covers four key areas:
- Security of the teleworking site – Ensuring the physical environment where remote work occurs has adequate controls (e.g., locked doors, screen filters, secure disposal of papers).
- Security of the network connection – Protecting the communication channel between the remote user and the organisation’s network, typically through encrypted VPNs.
- Security of the device – Ensuring endpoint devices (laptops, tablets, mobile phones) meet minimum security standards.
- Security of information and applications – Restricting access to only what is necessary and logging all remote access activity.
To satisfy Annex A.6.7, your remote access policy must be documented, approved by management, communicated to all remote workers, and subject to regular review and audit.
Structure of an ISO 27001 Remote Access Policy
A compliant remote access policy should include the following sections:
| Section | Content | ISO 27001 Reference |
|---|---|---|
| Purpose and Scope | Why this policy exists and who it applies to | A.5.1 (Policies) |
| Roles and Responsibilities | Who owns, manages, and enforces remote access | A.5.2 (Roles) |
| Authorised Access Methods | Approved VPN, remote desktop, and cloud access methods | A.6.7, A.8.1 |
| Authentication Requirements | MFA, password policy, certificate-based auth | A.8.5, A.8.6 |
| Endpoint Compliance | Device security standards, antivirus, patching, disk encryption | A.8.1, A.7.10 |
| Network Security | VPN encryption standards, split-tunnelling rules, firewall requirements | A.8.21, A.8.22 |
| Logging and Monitoring | What is logged, retention period, review frequency | A.8.16 |
| Third-Party Remote Access | Rules for vendors, contractors, and partners | A.5.13 |
| Incident Response | What to do if a remote access breach is suspected | A.6.8 |
VPN Requirements Under ISO 27001
ISO 27001 does not mandate a specific VPN technology, but it does require that network communications are encrypted and authenticated. The policy must specify:
Encryption Standards
The policy should mandate minimum encryption standards for VPN connections. Industry best practice is AES-256 for data encryption and SHA-256 for integrity. Older protocols like PPTP and L2TP/IPsec should be explicitly prohibited. Only modern VPN protocols such as OpenVPN (AES-256-GCM), WireGuard, or IPsec IKEv2 should be permitted.
Split Tunnelling
Split tunnelling – where remote traffic is split between the corporate VPN and the local internet connection – presents a significant security risk. Your policy should either prohibit split tunnelling entirely or specify strict exceptions approved by the Information Security Manager. When split tunnelling is permitted, traffic to sensitive internal systems must still route through the VPN, and internet-facing traffic should pass through a web security gateway.
VPN Logging
All VPN connections must be logged, including:
- Username and device identifier
- Connection timestamp and duration
- Source IP address and location
- Data volume transferred
- Disconnection reason (normal, timeout, error)
| Parameter | Minimum Requirement | Rationale |
|---|---|---|
| Encryption Algorithm | AES-256 (minimum) | Protects data in transit from interception |
| Authentication | MFA + Certificate or Pre-Shared Key | Prevents unauthorised VPN access |
| Protocol | OpenVPN, IKEv2, WireGuard | Modern, audited, secure protocols |
| Split Tunnelling | Prohibited unless approved by CISO | Reduces risk of malware propagation |
| Idle Timeout | 15 minutes (max) | Prevents session hijacking |
| Log Retention | Minimum 12 months | Supports forensic investigation |
Multi-Factor Authentication (MFA)
Annex A.8.5 (Secure Authentication) requires the use of strong authentication mechanisms. For remote access, MFA is no longer optional – it is a baseline expectation for ISO 27001 certification. The policy must specify:
- When MFA is required – All remote access to the corporate network, cloud applications, and administrative systems.
- Acceptable MFA methods – Time-based one-time passwords (TOTP), push notifications, hardware security keys (e.g., YubiKey), or biometrics (fingerprint, facial recognition). SMS-based OTP is increasingly discouraged due to SIM-swapping risks.
- Enrolment process – All users must register at least two MFA methods. Replacement of lost or broken MFA devices must follow a verified identity recovery process.
- Bypass procedures – Emergency access procedures when MFA is unavailable, requiring approval from the Information Security Manager and time-limited access codes.
Endpoint Compliance Requirements
Annex A.8.1 (User Endpoint Devices) requires organisations to protect endpoint devices. Your remote access policy must define minimum security standards for all devices connecting to the corporate network, whether company-managed or bring-your-own-device (BYOD).
Company-Managed Devices
Company laptops and mobile devices must meet the following baseline:
- Full disk encryption (e.g., BitLocker, FileVault) enabled
- Endpoint detection and response (EDR) agent installed and reporting
- Operating system and application patching within 14 days of release
- Device firewall enabled
- Screen lock enabled after 10 minutes of inactivity
- Anti-malware software with real-time scanning enabled
- Remote wipe capability enabled for lost or stolen devices
BYOD (Bring Your Own Device)
If BYOD is permitted, additional controls are required:
- Containerisation or application-level VPN to separate corporate data from personal data
- No corporate data stored locally on the device (streaming-only access)
- Device attestation to verify OS integrity, root/jailbreak status, and patch level
- Acceptable use agreement signed by the employee
- Right to wipe corporate data from the device if the employment ends or a breach is suspected
Remote Access Logging and Monitoring
Annex A.8.16 (Monitoring Activities) requires logging and regular review of user activities. For remote access, the following logs must be captured and reviewed:
| Log Source | Data Captured | Review Frequency | Retention Period |
|---|---|---|---|
| VPN Gateway | Connection events, authentication success/failure, data volume | Daily (automated alerts) | 12 months |
| MFA System | Authentication requests, method used, success/failure | Daily (automated alerts) | 12 months |
| Endpoint (EDR) | Process execution, network connections, file access | Continuous (SIEM integration) | 6 months |
| Cloud Access (CASB) | User activity, data downloads, anomalous behaviour | Daily (risk scoring) | 12 months |
| Remote Desktop Gateway | Session start/end, applications accessed, file transfers | Weekly review | 6 months |
All remote access logs should be centralised in a Security Information and Event Management (SIEM) system with automated alerting for:
- Multiple failed authentication attempts (more than 5 in 10 minutes)
- Remote access from unusual geographic locations
- Access outside of approved working hours
- Connections from unapproved or non-compliant devices
- Simultaneous VPN sessions from different locations using the same user account
Third-Party Remote Access
Annex A.5.13 (Supplier Relationships) requires organisations to manage security risks arising from third-party access. Many ISO 27001 audits fail because third-party remote access is not properly controlled. Your policy must address:
- Dedicated third-party access accounts – Vendors must use named accounts, not shared credentials. Accounts must be time-limited and reviewed quarterly.
- Just-in-time (JIT) access – Third-party access should be provisioned for specific time windows and revoked automatically.
- Least privilege – Third-party accounts must be restricted to only the systems and data necessary for their work.
- Separate VPN gateway – Third-party connections should terminate on a segregated network segment with no direct access to internal systems.
- Contractual obligations – All third-party remote access must be covered by a data processing agreement (DPA) and non-disclosure agreement (NDA).
Auditing Your Remote Access Policy
Annex A.9.1 (Internal Audit) requires regular audits of the ISMS, including the remote access policy. Your internal audit programme should verify:
- The remote access policy is current and approved by management.
- All remote users have acknowledged and agreed to the policy.
- MFA is enforced for all remote access, with no exceptions granted without documented approval.
- VPN encryption standards meet the minimum requirements specified in the policy.
- Endpoint compliance checks are performed before each VPN connection.
- Remote access logs are being reviewed and actioned.
- Third-party remote access accounts are reviewed and revoked when no longer needed.
- Security incidents involving remote access are investigated and remediated.
The internal audit should also include a sample of actual remote sessions to verify compliance. Non-conformities should be tracked, remediated, and verified within agreed timeframes.
Conclusion: Building a Culture of Secure Remote Work
A well-written remote access policy is only the first step. To achieve and maintain ISO 27001 certification, your organisation must embed secure remote working practices into its culture. This requires ongoing training, regular policy reviews, and continuous monitoring. The policy must be a living document – reviewed annually and updated whenever the threat landscape, technology stack, or regulatory requirements change.
By addressing Annex A.6.7 comprehensively, you not only satisfy the ISO 27001 auditors but also significantly reduce the risk of a data breach originating from a remote connection.
Frequently Asked Questions
Is a remote access policy mandatory for ISO 27001 certification?
Yes, if your organisation has employees who work remotely (including hybrid working), Annex A.6.7 (Teleworking) requires a documented remote access policy. It is a mandatory control under ISO 27001:2022 and will be audited during certification and surveillance audits.
Does ISO 27001 require a VPN for remote access?
ISO 27001 does not explicitly mandate a VPN, but Annex A.8.21 (Securing Network Services) requires that network communications are protected. For remote access, a VPN with at least AES-256 encryption and MFA is the industry standard approach to satisfying this control.
Can I allow BYOD devices under ISO 27001?
Yes, but you must implement compensating controls. BYOD devices must have containerisation, application-level access control, device attestation, and a signed acceptable use agreement. Your policy must clearly state that the organisation has the right to wipe corporate data from any BYOD device.
How often should the remote access policy be reviewed?
The remote access policy should be reviewed at least annually or whenever there is a significant change to the technology stack, threat landscape, or regulatory environment. The ISO 27001 management review (Annex A.5.1) is a good trigger for policy review.
What are the most common ISO 27001 audit findings related to remote access?
The most common findings are: (1) MFA not enforced for all remote access, (2) no endpoint compliance checks before VPN connection, (3) third-party remote access accounts not reviewed or revoked, (4) split tunnelling enabled without documented approval, and (5) remote access logs not reviewed.
Do ISO 27001 requirements apply to remote access from home?
Yes. ISO 27001 certification covers all locations where organisational information is accessed, processed, or stored. Home offices are classified as teleworking sites and must have adequate physical and technical controls. Your policy should address home office security, including screen privacy, secure disposal of documents, and network security (home Wi-Fi encryption).
Need Help Building Your ISO 27001 Remote Access Policy?
Bitrixme specialises in ISO 27001 implementation and audit readiness. Our consultants can help you draft a compliant remote access policy, implement the required technical controls, and prepare for certification. Contact us to schedule a gap assessment.
