A.6.7 People
Remote working
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (13)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-17mostlycovers — The ISO control establishes policy, technical safeguards, and monitoring requirements for all remote access to organizational systems, directly satisfying the core intent of AC-17.
- AC-19mostlycovers — By mandating controls over mobile and privately-owned devices used outside organizational premises, the ISO guidance fulfills the same objective as AC-19.
- AC-20mostlycovers — The requirement to define permitted external-system use, device ownership rules, and security mechanisms for remote locations aligns with AC-20’s scope.
- PE-17mostlycovers — Physical-security, visitor, and equipment-protection measures for alternate work sites are explicitly addressed, matching the intent of PE-17.
- IA-2partialaligns with — Guidance on multi-factor authentication and privilege enablement for remote access supports the identification-and-authentication requirements of IA-2.
- SC-7partialaligns with — Network-boundary protections and firewall requirements for remote connections partially satisfy the boundary-protection objective of SC-7.
- SI-3partialaligns with — Mandating malware protection on remote devices and networks contributes to the malicious-code-protection objective of SI-3.
Aligned NIST CSF 2.0 outcomes (15)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.AA-01mostlyaligns with — The ISO control requires managed issuance, authentication, and revocation of remote-access credentials and privileges, directly supporting the CSF outcome of managing identities and credentials for authorized users and services.
- PR.AA-05mostlyaligns with — By defining permitted work, information classifications, and authorized internal systems for remote workers, the control establishes and enforces access permissions and entitlements in line with the CSF outcome.
- PR.AA-06mostlyaligns with — The control addresses physical security of remote sites, lockable storage, and protection against unauthorized physical access by family or visitors, matching the CSF outcome for managing and monitoring physical access commensurate with risk.
- PR.IR-01mostlyaligns with — Requirements for communications security, firewalls, malware protection, and secure remote-access mechanisms collectively protect networks and environments from unauthorized logical access, aligning with the CSF outcome.
- GV.PO-01partialaligns with — Issuing a topic-specific remote-working policy that defines conditions, restrictions, and risk-based controls directly fulfills the CSF outcome of establishing policy for managing cybersecurity risks based on organizational context.
- PR.AT-01partialaligns with — Training on secure remote-working practices and support procedures is required, satisfying the CSF outcome that personnel receive awareness and training to perform tasks securely.
- PR.PS-01partialaligns with — The control mandates secure configuration of home and public networks, device screen locks, inactivity timers, and remote-wipe capabilities, supporting the CSF outcome of applying configuration-management practices.
Related OWASP ASVS 5.0 requirements (11)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V13.2.1partialaligns with — The ISO control's emphasis on secure remote-access mechanisms and communications security for personnel outside organizational premises aligns with the ASVS requirement to protect backend communications that bypass standard user-session controls.
- V13.2.4partialaligns with — Defining permitted remote systems, services, and access privileges in the ISO policy corresponds to the ASVS requirement that an allow-list governs which external resources the application may communicate with.
- V13.3.2partialaligns with — The ISO guidance on restricting remote-worker access to only authorized internal systems and services aligns with the ASVS principle of least privilege for access to secret assets.
- V6.3.1partialaligns with — The ISO control's requirement for secure authentication mechanisms when granting remote access to organizational systems directly supports the ASVS mandate to implement controls against credential stuffing and brute-force attacks.
- V7.3.1partialaligns with — By mandating inactivity timers and device screen locks for remote workers, the ISO guidance aligns with the ASVS requirement to enforce session inactivity timeouts that trigger re-authentication.
Related weaknesses / CWE (6)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-200partialprevents — Rules for physical security, clear-desk practices, secure transport, and restrictions on family or visitor access at remote sites reduce the probability that sensitive information will be exposed to unauthorized individuals in the remote environment.
- CWE-284partialprevents — Requiring a topic-specific remote-working policy that explicitly defines permitted work, information classifications, and authorized internal systems reduces the chance that personnel will be granted access to resources they should not reach from outside the premises.
- CWE-319partialmitigates — Specifying communications-security requirements and secure remote-access methods (including encryption expectations) prevents the transmission of sensitive data in cleartext over home or public networks.
- CWE-287nonenone — Mandating secure authentication mechanisms and discouraging single-factor authentication for remote network access directly lowers the likelihood that weak or missing authentication will be exploited to obtain unauthorized entry.
- CWE-306nonenone — Requiring strong authentication and access-privilege enablement for remote connections ensures that critical functions cannot be invoked without proper verification, closing a gap that would otherwise allow unauthenticated use.
- CWE-862nonenone — Defining which internal systems and services each remote worker is authorized to access, together with revocation procedures at termination, ensures that authorization checks are enforced and obsolete privileges are removed.
Mitigated MITRE ATT&CK techniques (5)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1021partialmitigates — Rules governing remote access methods, network configuration, and permitted systems restrict the adversary's ability to move laterally through remote services from an external location.
- T1078partialmitigates — Mandating strong authentication, device controls, and revocation procedures for remote workers reduces the effectiveness of using stolen or misused valid accounts from outside the premises.
- T1133partialmitigates — Requiring a topic-specific remote-working policy and secure remote-access mechanisms limits the adversary's ability to abuse external remote services for persistent access.
- T1556nonemitigates — Requiring secure authentication mechanisms and discouraging single-factor authentication for remote access makes it harder for an adversary to modify or abuse authentication processes from outside the network.
- T1566nonemitigates — Training remote workers on secure practices and restricting the classification of information they may handle reduces the likelihood that phishing will succeed against personnel working off-site.
Prevented OWASP Web Top 10 (2025) risks (5)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A02partialprevents — Requiring secure configuration of home and public networks, firewalls, malware protection, and device screen-lock policies prevents the insecure defaults and misconfigurations that commonly arise on unmanaged remote endpoints.
- A04partialmitigates — Specifying secure remote-access mechanisms and discouraging single-factor authentication for network entry helps ensure that credentials and data in transit are not exposed through weak or missing cryptographic controls.
- A01nonemitigates — Defining which internal systems remote workers may access and enforcing rules for family or visitor access limits the chance that unauthorized individuals at the remote site can reach sensitive resources.
- A07noneprevents — Mandating strong remote authentication mechanisms and discouraging single-factor authentication directly reduces the likelihood of credential compromise when users connect from outside the organization.
- A09nonemitigates — Requiring audit, security monitoring, and event reporting for remote activities supplies the logging and alerting data needed to detect and respond to suspicious remote access attempts.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.