Remote access and mobile working audit program.
How to audit whether access from outside uses secured paths with strong sign-in, reaches only what is needed and whether working from home and on the move is governed.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation handles remote access by staff and service providers through approved, hardened gateways with multi-factor sign-in and limits and monitors access to what is required. It also assesses whether rules for working from home, on the move and abroad exist and are followed.
Scope
- VPN, zero trust access, remote desktop gateways and comparable remote access
- Remote maintenance access by service providers
- Working from home, on the move and on trips abroad
- Out of scope: the general network architecture, which has its own audit program
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A policy governs mobile working and teleworking, including permitted locations, devices and rules of conduct. | ISO/IEC 27001:2022 Annex A 6.7; BSI OPS.1.2.4 | Read the policy, check approval and compare it with the agreement on mobile working. | Mobile working policy, agreement with employee representatives |
| 2 | Remote access is possible only through approved, centrally managed gateways. | BSI NET.3.3; ISO/IEC 27001:2022 Annex A 8.20 | Compare the overview of remote access gateways with a scan of services reachable from outside. | List of remote access gateways, external scan result |
| 3 | Every remote access requires sign-in with multiple factors. | NIS2 Directive Art. 21(2)(j); § 30(2) no. 10 BSIG; ISO/IEC 27001:2022 Annex A 8.5 | Check the sign-in configuration of the gateways and have accounts without a second factor listed. | Sign-in configuration, exception list |
| 4 | Only managed devices in a verified state may connect. | ISO/IEC 27001:2022 Annex A 8.1 | Review device posture rules and trace a connection attempt from an unmanaged device. | Device posture rules, log of rejected connections |
| 5 | VPN gateways and access systems are hardened and updated promptly. | BSI NET.3.3; ISO/IEC 27001:2022 Annex A 8.8 | Compare the version of the access systems with vendor advisories and trace the response to the last critical vulnerability. | Version status, patch log, vendor security advisories |
| 6 | The VPN tunnel uses recommended protocols and algorithms. | BSI TR-02102-3 | Read the configuration of protocol versions and encryption algorithms and compare it with the recommendations. | VPN configuration extract |
| 7 | Remote access reaches only the networks and systems needed for the respective task. | ISO/IEC 27001:2022 Annex A 8.22 | Analyse access rules per user group and flag blanket access to the whole internal network. | Gateway rule set per group |
| 8 | Remote maintenance by service providers takes place only after approval, time-limited and traceable. | BSI OPS.1.2.5 | Check five remote maintenance sessions for reason, approval, duration and log. | Remote maintenance logs, approvals, contract provisions |
| 9 | Sign-ins and sessions over remote access are logged and monitored for anomalies. | ISO/IEC 27001:2022 Annex A 8.15 and 8.16 | Review monitoring rules for remote access, such as sign-ins from unusual countries, and trace one alert. | Log extract, rule catalogue, alert example |
| 10 | Rules for the workplace at home and on the move protect information against viewing and loss. | BSI INF.8; BSI INF.9; ISO/IEC 27001:2022 Annex A 7.7 | Check rules on privacy screens, printouts and storage and ask five employees whether they know them. | Rules of conduct, interview notes |
| 11 | Special rules apply to travel and work abroad, for example on devices and taking data along. | BSI CON.7 | Read the rule for trips abroad and trace its application for two trips. | Rule for trips abroad, travel devices, approvals |
| 12 | Remote access permissions are reviewed regularly and revoked immediately on leaving. | ISO/IEC 27001:2022 Annex A 5.18 | Reconcile members of the access groups with headcount and review the last review. | Group members, leaver list, review record |
Documents to request
- Mobile working and teleworking policy
- List of remote access gateways and result of an external scan
- Configuration of sign-in and device posture checks
- Version status and patch log of the access systems
- Gateway rule set per user group
- Remote maintenance logs and contract provisions with service providers
- Rule for trips abroad
- Record of the last review of access permissions
Typical findings
- An old remote access gateway is still reachable from outside and usable without a second factor.
- VPN gateways were not updated promptly after critical vendor advisories.
- The whole internal network is reachable through remote access.
- Remote maintenance access for service providers is permanently open.
- Private devices can connect without checks.
- Access permissions are never reviewed.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing