Do you have a documented and currently implemented strategy for securing employee workstations when they work remotely (i.e., not in a trusted computing environment)?
Explanation
Remote work introduces risk outside your trusted network, and this item looks for a documented, actively enforced strategy for securing employee workstations wherever they operate.
Why it's important: Remote work introduces significant security risks as employees connect to public networks, work from shared spaces, or use personal devices. Without proper controls, remote work can lead to data breaches, unauthorized access, or malware infections that could compromise your organization's systems and data.
The assessment is trying to determine if you've thoughtfully addressed the security challenges of remote work rather than leaving it to chance. Organizations with mature security programs recognize that the security perimeter now extends to wherever employees work.
A good answer should include:
- Confirmation that you have a documented remote work security policy
- Description of technical controls implemented (VPN requirements, device encryption, etc.)
- Administrative controls (training, acceptable use policies)
- How you enforce these requirements
- How you monitor compliance with the policy
Example Responses
Example Response 1
Yes, our organization has a comprehensive Remote Work Security Policy that is documented, implemented, and reviewed annually The policy includes mandatory use of company-issued devices with full-disk encryption, required VPN connections for accessing company resources, multi-factor authentication for all system access, and automated security updates We enforce technical controls through our MDM (Mobile Device Management) solution which ensures device compliance before allowing network access Employees receive quarterly security awareness training specific to remote work threats, and we conduct regular audits of remote access logs Our security team also performs periodic vulnerability assessments of our remote access infrastructure.
Example Response 2
Yes, we maintain a documented Remote Workforce Security Strategy that addresses the security of employee workstations outside our office environment Our approach includes: (1) Endpoint Protection: All remote devices run our standardized security stack including EDR, DLP, and application whitelisting; (2) Network Security: Required use of our corporate VPN with split tunneling disabled; (3) Access Controls: Zero Trust architecture requiring continuous authentication and authorization for resource access; (4) Device Management: Cloud-based MDM ensuring all devices maintain current patches and security configurations; (5) Employee Training: Mandatory quarterly training on remote work security practices Compliance is monitored through our security operations center with automated alerts for policy violations.
Example Response 3
No, we currently do not have a formal documented strategy specifically for securing remote workstations While we do require VPN usage and provide basic security guidelines to remote employees, we have not developed a comprehensive policy or implemented technical controls specifically for remote work scenarios Our current approach relies primarily on employee discretion and general security awareness We recognize this as a gap in our security program and are in the process of developing a formal remote work security policy, which we expect to implement within the next quarter In the interim, we've increased security awareness communications to remote staff and are evaluating MDM solutions to better manage remote device security.
Context
- Tab
- Product
- Category
- Data
Related questions
- Will the institution's data be stored on any devices (database servers, file servers, SAN, NAS, etc.) configured with non-RFC 1918/4193 (i.e., publicly routable) IP addresses?
- Is the transport of sensitive data encrypted using security protocols/algorithms (e.g., system-to-client)?
- Is the storage of sensitive data encrypted using security protocols/algorithms (e.g., disk encryption, at-rest, files, and within a running database)?
- Do all cryptographic modules in use in your solution conform to the Federal Information Processing Standards (FIPS PUB 140-2 or 140-3)?
- Will the institution's data be available within the system for a period of time at the completion of this contract?
- Are ownership rights to all data, inputs, outputs, and metadata retained even through a provider acquisition or bankruptcy event?
