OPS.1.2.4 Teleworking

All the relevant aspects of teleworking MUST be specified. The applicable rules or a corresponding leaflet explaining the security safeguards to be considered MUST be provided to teleworkers. Contentious points MUST be clarified in employment agreements or separate agreements between the employee and employer as a supplement to their employment contract. The rules MUST be updated at regular intervals.

Security-related requirements MUST be defined that IT systems must meet for teleworking.

It MUST be ensured that only authorised persons have access to teleworking computers. Moreover, teleworking computers MUST be protected so that they can be used only for authorised purposes.

Employees MUST be made aware of the risks connected to teleworking by means of a guide. Furthermore, they MUST be instructed in the corresponding security safeguards of their organisation and trained in how to deal with them. Training and awareness safeguards for employees SHOULD be repeated at regular intervals.

A security concept for teleworking that describes the security objectives, protection needs, security requirements, and risks involved SHOULD be drawn up. The concept SHOULD be reviewed and updated regularly. The security concept for teleworking SHOULD be coordinated with the overall security concept of the organisation in question.

Clear rules SHOULD be specified regarding which communication capabilities may be used under which general framework conditions for the purpose of teleworking. There SHOULD be rules regarding the professional and private use of Internet services when teleworking. Here, it SHOULD also be clarified whether private use is generally allowed or prevented.

A regular in-house exchange of information SHOULD be ensured between teleworking employees and organisations. All employees SHOULD be informed about changed security requirements and other security-relevant aspects in a timely manner. All the colleagues of teleworking employees SHOULD know when and where these employees can be contacted. Technical and organisational teleworking rules on the performance of tasks, security incidents, and other problems SHOULD be specified and communicated to employees.

A special support and maintenance concept SHOULD be drawn up for teleworking locations. This concept SHOULD specify the following aspects: contact persons for user services, maintenance dates, remote maintenance, transport of IT devices, and the introduction of standard teleworking computers. Contact persons for hardware and software problems SHOULD be named to help ensure that employees can continue to work.

A requirements analysis SHOULD be performed before setting up a teleworking location. It SHOULD include the hardware and software components required for teleworking locations. The requirements for each teleworking location SHOULD be agreed with the persons in charge of IT. The protection needs of the information processed at teleworking locations SHOULD always be determined and documented.