How to write a remote work policy

Why remote work needs its own policy

Remote and hybrid work move company data onto home networks and personal spaces your perimeter never covered. A remote work policy defines the security conditions under which staff work outside the office, so productivity does not come at the cost of uncontrolled exposure.

What to include

Scope and eligibility — who can work remotely, from where, and any geographic restrictions.
Devices — company-managed devices, or BYOD under your BYOD policy; full-disk encryption and screen lock required.
Network — secure home Wi-Fi (WPA2/WPA3), VPN for internal systems, no sensitive work on public Wi-Fi without VPN.
Physical environment — privacy screens, locked storage, no confidential calls in public.
Authentication — MFA for all remote access.
Data handling — keep company data in sanctioned tools; no local copies on unmanaged devices.
Incident reporting — how to report a lost device or suspected compromise quickly.

Common mistakes

Treating remote work as identical to office work — the threat model is different.
No VPN or unclear rules on public Wi-Fi.
Silence on the physical environment (shoulder-surfing, household members).

Framework alignment

Maps to ISO 27001:2022 Annex A 6.7 (remote working), supports SOC 2 and the NIST CSF Protect function.

Primary sources

NIST SP 800-46 Rev. 2 — Guide to Enterprise Telework, Remote Access, and BYOD Security (csrc.nist.gov/pubs/sp/800/46/r2/final).
ISO/IEC 27001:2022 — Annex A control 6.7, remote working (iso.org/standard/27001).
ANSSI — recommandations pour la sécurité du télétravail (ssi.gouv.fr).

Generate it in minutes

See a sample remote work policy or generate yours free.

Frequently asked questions

How does a remote work policy differ from a BYOD policy?

A remote work policy covers the conditions for working outside the office — networks, physical environment, VPN, data handling. A BYOD policy covers using personal devices specifically. They overlap: a remote work policy typically references your BYOD policy for any personally owned devices.

Is a VPN required for remote work?

Require a VPN (or zero-trust access) for internal systems and for any sensitive work over public Wi-Fi, always with MFA. Home Wi-Fi should use WPA2 or WPA3. The remote threat model differs from the office, so do not treat the two as identical.

What physical-environment rules belong in a remote work policy?

Address shoulder-surfing and household members: privacy screens, locked storage for documents and devices, and no confidential calls in public spaces. These low-tech controls are easy to overlook but are exactly what auditors expect a mature remote work policy to cover.