Remote working requirements

The entity must formalise a Security policy This policy, which must be approved by the Board of Directors, defines the principles and rules applicable to teleworking in order to protect the confidentiality, integrity and availability of data, information and ICT.

The access rights Access rights granted to teleworkers must be in line with the risk analysis and security policy. These access rights must be reviewed at least annually (semi-annually for privileged users).

Furthermore, the entity must ensure that it keeps the control on the devices for remote connection to ICT systems. In this context, the use of personal devices must be restricted to low-risk activities and must be subject to specific risk analysis.

The components of the’Remote working infrastructure must, at all times, be secure and controlled. Thus, mechanisms must be put in place by the entity to detect and block any abnormal connection. Two-factor authentication must also be implemented to remotely connect to the company's ICT systems.

The entity must retain all elements permitting the control of conformity to the remote working policy and CSSF Circular 21/769, as amended. This information must be made available CSSF's disposition As requested.

The internal control functions (compliance, risk management, internal audit…) must to include The review of compliance with the requirements relating to teleworking within their Multiannual work plans. Furthermore, the Reports synthèse annuelle doit to include elements Statistics on the use of remote working as well as a mention of the Incidents significant ones that have taken place.

The Good functioning of the communication channel between the remote device and the company's infrastructure as well as the’effectiveness of security measures implementations must be audited by an independent security control function (Information security officer, internal audit or specialised external third party) before the launch of remote working and regularly thereafter. Scan tests and penetration tests must also be carried out regularly.

Furthermore, the entity must implement a Journalisation in order to ensure that all connections and technical information relating to remote working are recorded for security audit purposes.

The Staff awareness The risks and best practices associated with remote working must also be ensured by the entity through periodic training, newsletters or other communications.