Remote working and BYOD policy under ISO 27001 (A.6.7 and A.8.1)
A remote working and BYOD policy sets out how employees work safely outside the office, and whether they may use their own laptop or phone for it. BYOD stands for Bring Your Own Device: using personal devices for work. In ISO/IEC 27001:2022 , these arrangements fall under A.6.7 “Remote working” and A.8.1 “User endpoint devices” in Annex A.
The NCSC (Dutch National Cyber Security Centre) advises organisations to take stock of which personal devices are being used, to draw up a BYOD policy and to enforce it. For remote working, the NCSC recommends specific agreements on devices, passwords and the home network. Such agreements fit with your password policy and your clean desk policy.
Short answer: for ISO 27001, you record in one policy where and on which devices employees may work (A.6.7), and what minimum protection each device must have (A.8.1). With BYOD, you make a deliberate choice: do not allow it, allow it in a limited way through a managed app, or allow it with device management. The auditor wants to see that this choice is enforced technically.
What do A.6.7 and A.8.1 require?
ISO 27002:2022 elaborates on both controls. A.6.7 requires you to take security measures for employees who work remotely. A.8.1 requires information on users’ devices to be protected, whether the device belongs to the company or to the employee.
| Control | Title (ISO/IEC 27001:2022) | What you make arrangements about |
|---|---|---|
| A.6.7 | Remote working | Home workspace, public places, network, shoulder surfing |
| A.8.1 | User endpoint devices | Encryption, updates, screen lock, remote wipe |
| A.7.9 | Security of assets off-premises | Laptops and paper outside the office |
| A.6.8 | Information security event reporting | Reporting loss or theft |
In the 2022 version, A.6.7 is called “Remote working”. In the 2013 version, working from home was grouped with mobile devices under “teleworking”. The content is similar, but the structure is new.
Three choices for BYOD
The most important decision in your policy is whether personal devices are allowed. There are three common options, each with a different risk and a different management burden.
Not allowed
No personal devices. Everyone works on a company laptop and phone. This is the simplest to secure and to explain to the auditor. You enforce it with conditional access: only managed devices can log in. Downside: higher costs and employees who carry two phones.
Example remote working and BYOD policy
This text is written for an organisation that works in a hybrid way, provides company laptops and allows personal phones through managed apps. Adapt it if you make a different BYOD choice.
Remote working and mobile devices policy Version 1.0, adopted by the board on 9 April 2026. Owner: IT manager. Belongs to ISO 27001 A.6.7 and A.8.1.
1. Devices. You work on the laptop we give you. You do not use private computers or private laptops for work. On your private phone, you may use email, calendar and Teams, but only through the apps we manage.
2. Laptop security. Laptops are encrypted, receive updates automatically and lock after 5 minutes. You do not switch these settings off.
3. Phone security. Your private phone has a PIN or biometric unlock and an operating system that still receives updates. You do not copy business data into private apps.
4. Network. At home, you use a Wi-Fi network with its own strong password. On public Wi-Fi, you use the VPN or your mobile hotspot.
5. Workspace. You work in a way that stops housemates and others from seeing confidential information. You lock your screen when you step away. You do not let anyone else use your laptop.
6. Paper. You do not print confidential documents at home. If you take them with you, you store them securely, and you bring them back to the office to destroy them.
7. Loss and theft. You report loss or theft of a device to IT immediately, including outside working hours. IT then wipes the business data remotely.
8. Leaving. When you leave, you return your laptop, and IT removes the business apps from your private phone.
9. Abroad. If you work from abroad for longer than two weeks, you discuss it with IT in advance.
Ask employees to sign this policy when they start. This also gives you a basis for enforcing the arrangements.
What does the auditor ask for as evidence for A.6.7 and A.8.1?
During an ISO 27001 audit, the auditor checks whether the policy matches what the systems actually do. Expect to show:
- The adopted policy and evidence that employees know it, such as a signed statement.
- An overview from your management system: how many devices are encrypted and up to date?
- The setting that keeps unmanaged devices out.
- An example of a loss report, with the time the remote wipe was carried out.
- A conversation with a remote worker: “How do you log in from your phone?”
A classic finding is a policy that says “private devices are not allowed”, while anyone can simply log in to webmail from a private laptop. Test for yourself before the audit whether an unmanaged device is refused.
Common mistakes with a remote working and BYOD policy
Forgetting web access. You block the email app on unmanaged phones, but the browser still works. Set access rules for all routes.
No inventory. The NCSC advises first taking stock of which devices are used. Without an overview, you do not know what your policy needs to cover. Include device groups in your asset register.
Forgetting the employee’s privacy. With full management of a personal phone, you may see more than you need to. Record what you do and do not look at, and discuss it with the works council (ondernemingsraad) if you have one.
Not enforcing updates. A phone with an operating system that no longer receives updates is an open door. See vulnerability management and patching.
Remote working and BYOD in government
Government organisations that follow the BIO2 (Dutch Baseline Information Security for Government, version 2) have stricter minimum requirements for mobile equipment. Business information is preferably not stored on the device itself, remote wiping must be possible, devices fall under patch management and MDM or MAM, and users sign a statement for mobile working.
Frequently asked questions about remote working and BYOD
Is a VPN mandatory for remote working under ISO 27001?
No. If your employees mainly work in cloud services with MFA and managed devices, a VPN adds little. A VPN is useful if you give access to systems on your own network.
May I wipe a private phone remotely?
Only if you have agreed this with the employee in advance. With managed apps (MAM), you wipe only the business data. For most organisations, this is the best route.
Does remote working fall within the scope of my ISMS?
If employees work from home with information that is within your scope, that workspace falls under your controls. You do not need to name home workspaces as a location in your scope.
More information
- Password policy: MFA and passwords on every device
- Clean desk policy: screen locking and paper, at home too
- Classifying information: which information may be on a private device
- Incident management: what happens after a loss report
- Annex A: all 93 controls
- NCSC: Bring Your Own Device