Acquisition and instructions for a VPN-service

Critical
High
Normal
Low

Organisation's data can only be processed on a predefined, trusted network, or by using a VPN service defined by the organisation.

For example, a coffee shop's Wi-Fi network is often either completely unencrypted or the password is easily accessible to everyone. In this case, the information sent online is vulnerable to spyware. A VPN connection encrypts information regardless of network settings.

Connected other frameworks and requirements:
6.2.2: Teleworking
ISO 27001
9.1.2: Access to networks and network services
ISO 27001
14.1.2: Securing application services on public networks
ISO 27001
6.7: Remote working
ISO 27001

Personnel guidelines for secure remote work

Critical
High
Normal
Low

Remote workers have their own operating guidelines, which are monitored. In addition, regular training is provided to staff to identify threats to information security arising from the use of mobile devices and remote work, and to review the guidelines.

Connected other frameworks and requirements:
6.2.2: Teleworking
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
PR.AC-3: Remote access management
NIST CSF
6.7: Remote working
ISO 27001

Defining suitable locations and needed protections for remote work

Critical
High
Normal
Low

When working remotely, the employee must follow the following guidelines:

  • remote work may only be performed in rooms where eavesdropping is not possible
  • remote work must be agreed in advance (e.g. on a one-off basis or in an employment contract with flexible work arrangements) or remote work must be requested by the employer
  • the employee must ensure the required security for remote work equipment (e.g. backup, malware protection, firewall, encryption, updates)
Connected other frameworks and requirements:
6.2.2: Teleworking
ISO 27001
PR.AC-3: Remote access management
NIST CSF
6.7: Remote working
ISO 27001

Definition of measures permitted in remote work

Critical
High
Normal
Low

Definition of the classification of permitted work, working hours and information to be used and definition of the internal systems and services to which the teleworker is granted access.

Connected other frameworks and requirements:
6.2.2: Teleworking
ISO 27001
I22: Etäkäyttö ja etähallinta
6.7: Remote working
ISO 27001

Arranging suitable equipment and storage equipment for teleworking

Critical
High
Normal
Low

Arranging suitable equipment and storage for teleworking if the use of personal equipment beyond the control of the organization is not permitted.

Connected other frameworks and requirements:
6.2.2: Teleworking
ISO 27001
11.2.6: Security of equipment and assets off-premises
ISO 27001
6.7: Remote working
ISO 27001
7.9: Security of assets off-premises
ISO 27001
No items found.