THP-2 - Remote Work
Security control for employees working remotely or in hybrid mode
Control Definition
Security controls must be established to ensure remote employees have the same level of protection as in the physical facilities, requiring a secure connection and multi-factor authentication to access corporate resources. Remote work devices must be managed through centralized solutions that enforce encryption, locking and usage restrictions, and only collaboration tools with a secure corporate configuration must be approved. Compliance with these policies must be assessed periodically, and information accessed, processed or stored outside the organization's facilities must be protected.
Requirements
Requirement 1
We establish security controls to ensure remote employees maintain the same level of protection as in the physical facilities.
Requirement 2
We evaluate and approve officially used cloud collaboration tools with a secure corporate configuration.
Requirement 3
We prohibit the use of public Wi-Fi networks without an active VPN.
Requirement 4
We communicate and enforce the clean desk policy in home environments.
Requirement 5
We apply security measures to protect information accessed when staff work remotely.
Requirement 6
We apply security measures to protect information processed when staff work remotely.
Requirement 7
We apply security measures to protect information stored when staff work remotely.
Requirement 8
We require a corporate VPN with MFA authentication for all remote access, corporate network and corporate resources.
Requirement 9
We manage remote work devices through MDM/UEM solutions with enforced security policies.
Requirement 10
We require disk encryption, inactivity locking and restriction of unauthorized applications on all remote devices.
Requirement 11
We perform periodic security policy compliance assessments on remote devices.