# HR-07 Remote Working - Policy

- Domain: HR – Personnel
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/hr-07/

## Basic criterion

### HR-07.01B

Policies and procedures for the protection of information when personnel works remotely are documented, communicated and provided in accordance with SP-01 and address the following aspects:

1. Establishing guidelines for the personnel for the safe handling and storage of sensitive information and data types;
2. Definition of remote access security requirements;
3. Utilisation of secure communication methods and enforcement of secure network use (e.g., VPN usage, endpoint protection, multi-factor authentication, secure communication channels); and
4. Provision of organisation-approved equipment and prohibition of unregulated personal devices.

**Supplementary information:**

Please note that this criterion refers to off-site working places whereas PS-08.01B addresses security requirements for on-site office workplaces.

The guidelines for the personnel for safe handling and storage of sensitive information and data types refer to organisational measures the personnel is obligated to follow. Remote access security requirements refer to technical measures like e.g. MFA and VPN and also rules for the particular work place that follow from general considerations about working e.g. in public places where the screen can be spied on.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.