Organizations allowing teleworking activities should issue a policy that defines the conditions and restrictions for using teleworking. Where deemed applicable and allowed by law, the following matters should be considered:

• the existing physical security of the teleworking site, taking into account the physical security of the building and the local environment;
• the proposed physical teleworking environment;
• the communications security requirements, taking into account the need for remote access to the organization’s internal systems, the sensitivity of the information that will be accessed and passed over the communication link and the sensitivity of the internal system;
• the provision of virtual desktop access that prevents processing and storage of information on privately owned equipment;
• the threat of unauthorized access to information or resources from other persons using the accommodation, e.g. family and friends;
• the use of home networks and requirements or restrictions on the configuration of wireless network services;
• policies and procedures to prevent disputes concerning rights to intellectual property developed on privately owned equipment;
• access to privately owned equipment (to verify the security of the machine or during an investigation), which may be prevented by legislation;
• software licensing agreements that are such that organizations may become liable for licensing for client software on workstations owned privately by employees or external party users;
• malware protection and firewall requirements.

The guidelines and arrangements to be considered should include:

• he provision of suitable equipment and storage furniture for the teleworking activities, where the use of privately owned equipment that is not under the control of the organization is not allowed;
• a definition of the work permitted, the hours of work, the classification of information that may be held and the internal systems and services that the teleworker is authorized to access;
• the provision of suitable communication equipment, including methods for securing remote access;
• physical security;
• rules and guidance on family and visitor access to equipment and information;
• the provision of hardware and software support and maintenance;
• the provision of insurance;
• the procedures for backup and business continuity;
• audit and security monitoring;
• revocation of authority and access rights, and the return of equipment when the teleworking activities are terminated.