How do we decide the rules for remote working and personal devices under ISO 27001?

Start

People work outside the office and some use their own devices

Remote working and device controls keep information safe when it leaves the building. The Library's mistakes are rules that assume a VPN nobody uses, personal devices with no controls reaching company data, and company email on unmanaged phones. The decision is what you allow, and on what terms.

• Then: List who works remotely, from where, and what each group can reach

Step

List who works remotely, from where, and what each group can reach

Include home, travel and shared spaces such as coworking sites, and separate staff from contractors. For each group note the systems and the classification of the information they reach. The rule you write should follow that picture, not a guess.

• Then: Will personal devices be allowed to reach company data?

Decision

Will personal devices be allowed to reach company data?

NCSC advises starting from objectives, user needs and risks, and says no organisation can do all its functions securely on personal devices alone. Allowing them is a risk decision for top management, not a default. If staff already use them and nobody decided, answer yes and decide now.

• No: Block unmanaged devices at sign-in and say so in the rule
• Yes, or not known: Can people reach data in a browser or app without storing it locally?

Step

Block unmanaged devices at sign-in and say so in the rule

Use conditional access so only managed, compliant devices reach company data. State the rule in the remote working document and in the acceptable use policy, and tell staff what to do instead, such as the loan of a laptop.

• Then: Do managed devices enforce encryption, lock, updates, malware cover?

Decision

Can people reach data in a browser or app without storing it locally?

Browser access and app-level controls keep company data off the personal device and need no management of the whole device. NCSC compares web access, virtual desktops, mobile device management and mobile application management. If staff need files stored locally, answer no.

• Yes: Use app controls: strong sign-in, no local download, device checks
• No: Enrol the device in management, or refuse it

Step

Use app controls: strong sign-in, no local download, device checks

Require multi-factor sign-in, block saving to the device where the data is sensitive, require a screen lock and a current operating system, and be able to remove company data alone. State what you cannot see on a personal device.

• Then: Do managed devices enforce encryption, lock, updates, malware cover?

Step

Enrol the device in management, or refuse it

NCSC warns that full management of a personal device makes it a corporate device in practice, with the privacy and cost consequences that brings. Tell staff plainly what you can see on the device and what you could wipe, and agree the terms before enrolment. The legal basis for that is a question for whoever advises on data protection. If staff will not accept the terms, they get a company device.

• Then: Do managed devices enforce encryption, lock, updates, malware cover?

Decision

Do managed devices enforce encryption, lock, updates, malware cover?

Devices out of compliance for months with no action is the Library's named mistake. A report from device management shows the state. If you have not looked at the report this month, answer no.

• Yes: Can you lock or wipe a lost device, and do people report loss quickly?
• No, or not known: Set the baseline and block or chase non-compliant devices

Step

Set the baseline and block or chase non-compliant devices

Make the baseline automatic where you can. Give non-compliant devices a short deadline to fix, then restrict access, and track the exceptions with an owner and a date.

• Then: Can you lock or wipe a lost device, and do people report loss quickly?

Decision

Can you lock or wipe a lost device, and do people report loss quickly?

The Library's mistake is loss reported days later and no way to wipe a phone that has company email. For a personal device you may be able to remove only company data. If you cannot, answer no.

• Yes: Do staff handle Confidential information at home or on the move?
• No, or not known: Set a reporting rule and limit access until the device is dealt with

Step

Set a reporting rule and limit access until the device is dealt with

Tell staff who to call, any time, and what happens next: sessions revoked, device locked or company data wiped. Test it with one device. Include travel: a lost laptop abroad is the same problem.

• Then: Do staff handle Confidential information at home or on the move?

Decision

Do staff handle Confidential information at home or on the move?

Rules for home networks, public places, screens and papers matter more as the classification rises. The pack's handling matrix has a row for remote and mobile working. If you have not asked, answer yes.

• Yes, or not known: Set simple rules for where and how Confidential work may be done
• No: Do leavers and movers lose access and return or wipe their devices?

Step

Set simple rules for where and how Confidential work may be done

Say how people connect to company systems and whether that way is actually used, since rules that assume a VPN nobody uses are a mistake the Library names. Cover screens in public places, calls, printing and paper at home, shared spaces and travel to places you decide are higher risk. Keep it to a page that people can follow, and put it in the briefing.

• Then: Do leavers and movers lose access and return or wipe their devices?

Decision

Do leavers and movers lose access and return or wipe their devices?

A leaver's account still active, or a company laptop never returned, shows how remote devices escape control. The leaver checklist includes device return and the wipe. If devices are not part of the leaver steps, answer no.

• Yes: Brief staff and keep their acknowledgement
• No, or not known: Add device return, wipe and data removal to leaver and mover steps

Step

Add device return, wipe and data removal to leaver and mover steps

Tie the inventory of devices to the leaver checklist and chase the return. For personal devices, record that company data was removed and by whom.

• Then: Brief staff and keep their acknowledgement

Step

Brief staff and keep their acknowledgement

The rules work only if people know them. Put them into the induction and the acknowledgement process. The Library lists acknowledgements as part of the evidence.

• Then: Check a sample of devices and sign-ins against the rule

Step

Check a sample of devices and sign-ins against the rule

Compare the device management report and the conditional access settings with the rule. Check a few leavers and a lost-device record. The auditor samples the same evidence.

• Then: Did the sample show a device or sign-in the rule does not allow?

Decision

Did the sample show a device or sign-in the rule does not allow?

Any unmanaged device with access, or a leaver's device not recovered, shows the rule is not yet applied. If you did not sample, answer yes.

• Yes, or not known: Close the route, fix the record and sample again
• No: Remote working and device rules decided, enforced and sampled

Step

Close the route, fix the record and sample again

Block or enrol the device, correct the leaver step that missed it and take a fresh sample.

• Then: Check a sample of devices and sign-ins against the rule (back to an earlier step)

Outcome

Remote working and device rules decided, enforced and sampled

Keep the rule, the device and conditional access reports and the sample result. Do not say all devices are managed if personal ones reach company data through app controls only, and say plainly what you cannot see on them.