August 2026. Hybrid and remote work are structural, but scope, SoA and audit evidence often lag reality. Certification bodies sample remote access, device posture and logging outside the office.
Scope and boundaries
Record which locations, devices and networks are in scope. Allow BYOD only with explicit policy and risk acceptance in management review. Remote work without MDM is a conscious choice, document residual risk.
Controls auditors check
- MFA on all remote access, no exceptions for leadership;
- endpoint: patch, encryption, screen lock, remote wipe;
- logging: VPN, IdP, cloud apps, same retention as office;
- awareness: remote work and phishing, metrics in review.
More: ISMS, ISO 27001 certification and readiness overview.
Review remote work annually or after major SaaS change. Scope drift is a common surveillance theme when teams adopt new tools without ISMS update.