ISO/IEC 27001:2022 and remote support: the Annex A controls involved

How ISO 27001 is structured

The standard has two parts: the main clauses, which describe how an information security management system should be planned, run, checked and improved, and Annex A, a reference set of controls an organisation draws on to address the risks it identifies. The 2022 revision reduced the previous fourteen control categories into four themes and 93 controls, several of which were newly introduced, including ones covering threat intelligence, data masking and web filtering.

Organisations are not required to implement every Annex A control. Instead, they run a risk assessment, decide which controls are relevant, and record the outcome in a statement of applicability. Remote access controls become relevant the moment an organisation identifies remote access, whether inbound support or outbound working, as part of its information security risk landscape, which in practice is almost always.

Access control (A.5.15 to A.5.18, A.8.2 to A.8.5)

The access control group covers how access rights are granted, reviewed and removed, how privileged access is managed, and how authentication is enforced. Remote access is a direct application of these controls: every remote session represents a granted access right, and the standard expects that right to be based on business need, reviewed periodically, and revoked when no longer required.

Secure authentication (A.8.5) specifically expects strong authentication methods appropriate to the risk, which in practice means multi-factor authentication for remote access to anything sensitive. Auditors typically ask to see the access control policy, a sample of access review records, and evidence that leaver accounts were disabled within a reasonable timeframe.

• Access rights granted on a documented business need, not by default
• Privileged and remote access reviewed on a defined schedule
• Strong authentication required in proportion to the risk of what is being accessed

Cryptography and network security (A.8.24, A.8.20 to A.8.23)

The cryptography control asks organisations to define and apply rules for the use of encryption, appropriate to the classification of the information involved. Remote support sessions that carry screen content, keystrokes and file transfers should be encrypted in transit, and organisations should be able to state which encryption standard is used and why it is considered adequate.

Network security controls cover segregation, monitoring and secure configuration of networks and network devices, which extends to how a remote access gateway or agent sits within the network architecture. A remote access product using AES-256 encryption for session data, of the kind offered by tools such as 247connect, gives an organisation a concrete answer when an auditor asks how remote sessions are protected in transit, though the wider network architecture around it still needs to be assessed on its own merits.

Logging and monitoring (A.8.15, A.8.16)

Logging (A.8.15) requires event logs recording user activities, exceptions and security events to be produced, retained and reviewed. Monitoring activities (A.8.16) expects networks and systems to be monitored for anomalous behaviour. Remote access sessions are exactly the kind of event these controls are aimed at: who connected, to what, for how long, and whether anything about the session looked unusual.

For an auditor, the useful evidence is not a claim that logging exists but a sample log extract showing operator identity, timestamp, target system and duration, alongside evidence that logs are actually reviewed rather than only stored. A log nobody ever looks at satisfies the letter of the control poorly, even if it technically exists.

• Retain remote access logs for a defined, documented period
• Review logs on a schedule, not only after an incident is already suspected
• Be able to produce a sample log extract on request during an audit

Supplier relationships (A.5.19 to A.5.23)

Where remote access is provided by a third party, such as an IT support company connecting into client systems, or where a remote access product is bought from a vendor, the supplier relationship controls apply. These expect organisations to assess information security risk in supplier relationships, address security requirements in agreements, and monitor supplier performance against those requirements.

In practice this means a documented view of what any remote access vendor or supplier can reach, what their own security practices are, and how that risk is reviewed over the life of the relationship, rather than assessed once at the point of purchase and never revisited.