RWP-06ISO/IEC 27001:2022 A.6.7, A.8.1SOC 2 CC6.1, CC6.6
Remote Work & Mobile Device (BYOD) Security Policy Template
Security standards for distributed engineering teams covering endpoint encryption, public Wi-Fi restrictions, auto-lock timeouts, and remote wipe procedures.
Mandatory Controls Enforced in This Policy
Mandatory Full Disk Encryption (FileVault on macOS, BitLocker on Windows, LUKS on Linux)
Maximum 10-minute idle screen lock with biometric or strong password unlock
Mandatory VPN / secure tunneling when accessing corporate assets on public Wi-Fi
Immediate reporting SLA (< 2 hours) for lost or stolen company devices
remote-work-byod-security-policy.md
LIVE ISMS SPEC
# Remote Work & BYOD Policy (RWP-06)
**Classification:** Internal / All Staff
**Controls Mapped:** ISO/IEC 27001:2022 A.6.7, A.8.1 | SOC 2 CC6.1
---
## 1. Device Security Baseline
All laptops and devices used for company work must enforce:
1. **Full Disk Encryption:** FileVault (macOS), BitLocker (Windows), or LUKS (Linux).
2. **Screen Auto-Lock:** Automatic engagement after a maximum of **10 minutes** idle.
3. **Endpoint Antivirus / EDR:** Active real-time malware protection.
## 2. Public Network Security
Connecting to unencrypted public Wi-Fi networks (airports, cafes) without a trusted VPN is strictly prohibited.
## 3. Lost / Stolen Device Protocol
In the event of device theft or loss, the employee must notify the Security Lead within **2 hours** to initiate remote credential revocation and session invalidation.
This is 1 of 18 policies compiled dynamically in LeanSec Studio.Open Full Studio Editor
Auditor Evidence Checklist for RWP-06
Audit-ReadyWhen an ISO 27001 or SOC 2 auditor reviews this policy, they will ask for the following artifacts:
Device inventory showing enabled full-disk encryption status across team laptops
Signed employee security acknowledgment agreements upon hire
Frequently Asked Questions
Is MDM (Mobile Device Management) mandatory for small agencies?
Not strictly mandatory for ISO 27001 if you maintain an accurate asset inventory and collect verified evidence of full disk encryption and auto-lock settings from all team members.