ISO 27001 for fully remote companies: audit and SoA

Can a fully remote company get ISO 27001 for remote companies without an office?

Yes. A company with no office can be certified to ISO/IEC 27001, and its controls cover remote working through Annex A control A.6.7 Remote working, which asks for security measures wherever personnel access, process or store information outside the organization's premises. The organization does not need a headquarters to pass. It needs a documented ISMS in which remote work is a deliberate, risk-assessed part of the design, with the related controls for endpoint devices (A.8.1), off-premises assets (A.7.9) and secure authentication (A.8.5) evidenced in practice. The organization owns these controls. DeployOpen can help prepare the systems and evidence, but only an independent certification body issues the certificate. What changes from one organization to the next is mostly a set of questions to answer early. How many people work remotely, and from which countries? Where do customer data, backups and source code actually live: in a cloud account, a managed service or on personnel laptops? Which physical controls from Annex A theme 7 are excluded from the Statement of Applicability, and why? Clause 6.1.3 d) requires the Statement of Applicability, so each exclusion needs a justification tied to the risk assessment, such as no secure areas or no owned equipment on premises. Remote-only companies often exclude many physical controls, but the justification must show the exclusion is reasoned, not assumed. Confirm with the certification body how it will record these choices. The certificate and audit report also describe the operating model. Under the rules that certification bodies follow, a client with few or no relevant physical sites has its certificate and audit report state that its activities are conducted remotely, and the audit report must state how far remote auditing was used and how effective it was. Ask the certification body early how it will word the scope and whether it expects a remote stage 1 or stage 2 audit. Verify the outcome in the IAF CertSearch database once the certificate is issued.

What makes a remote ISMS larger or smaller to audit

For a fully remote company, audit effort depends less on floor space and more on who does work under the organization's control, where they are, and how well their systems and evidence are recorded. The drivers below set how much the certification body must sample and how the certificate and audit report describe the remote operation.

Headcount and people doing work

Audit time for an organization with no relevant physical sites is calculated from the number of people doing work under its control, wherever they are. Contractors and part-time staff count too, so a clean personnel list matters. Keep one register that covers employees, contractors and anyone with access to in-scope systems, and confirm with the certification body how it will count them. The certification body makes the final call on audit time.

Countries and home locations

Staff spread across countries raise questions about local law, device handling and where data is accessed from. Each location changes the remote working risk assessment and the controls that depend on it. Record the countries where people work, the rules that apply there, and whether any location requires a local entity or extra safeguards. Ask your counsel which local employment and data rules shape the remote working procedure before the scope is fixed.

Cloud and SaaS scope

A remote company runs almost all of its work in cloud and SaaS tools, so the scope of the ISMS is largely the set of services that hold or process information. Each service needs an owner, an access review and a documented supplier assessment. Fewer, well-governed services make the audit shorter. Many tools added without review make it longer, because every one may need sampling. Confirm the final list of services with the certification body during stage 1.

Endpoint management of laptops

Remote staff use company laptops and sometimes personal devices, and A.8.1 on user endpoint devices applies to both. Auditors look for enrollment, disk encryption, screen locks, patch status and the ability to wipe a lost device. Personal devices that touch company data widen the scope and need a clear bring-your-own-device rule. Test the mobile device management records against a sample of staff, since mismatched inventories are a common finding.

Third parties that host data

Remote companies depend on hosting providers, email, identity and collaboration suppliers. Each supplier that stores or processes information falls under supplier controls, so the auditor will ask for contracts, security terms and recent assurance reports. Keep a supplier register that names the data each supplier holds. Confirm with the certification body which supplier evidence it will accept and how far it will sample.

Maturity of the evidence

The effort of an audit is driven by how easily staff can show that a control operated. Access reviews, onboarding records, training completions and incident tickets should be exported from systems that log them automatically, with dates. Evidence gathered by hand at audit time takes longer to check and invites nonconformities. Ask your implementer to confirm which evidence comes from tools and which needs a manual record, and to set a routine for collecting it.

How physical controls are justified in the Statement of Applicability for remote companies

A remote company still has to address every Annex A control in theme 7 in its Statement of Applicability. Clause 6.1.3 d) of ISO/IEC 27001:2022 requires the SoA to list the Annex A controls the organization has determined as necessary, and to justify both their inclusion and any exclusion. A company with no offices does not get to skip the physical theme by default. It has to write down, control by control, why a physical control applies or why it does not, and that reasoning should describe how the company actually operates: which devices staff use, whether any equipment is stored in a home or a co-working space, how cloud providers' facilities are relied on, and who handles paper or removable media, if anyone.

For a company without sites, the physical risk mostly sits in two other places. A.7.9 Security of assets off-premises covers laptops, phones and storage media that leave the controlled environment, and A.6.7 Remote working covers the home or public workspaces where staff access company information. Many fully remote companies will find that A.7.9 and A.6.7 carry most of the physical risk, so the justification for each theme 7 control should point to the specific gap it leaves and to the compensating measure, such as full-disk encryption, device management or a loss and theft procedure. Confirm with your certification body before stage 1 how it expects these justifications to be written, and whether it wants them traced to the risk assessment under clause 6.1.2. Keep each justification tied to the risks recorded there, so that the SoA, the risk register and the treatment plan agree with one another.

Treat the SoA as a living record. Revisit each physical justification when the operating model changes, such as a new co-working arrangement, a hardware refresh policy, or a decision to use a colocated data center for backups. Ask your implementation partner or internal owner to record the date and reason for each change, because auditors test whether the SoA reflects current practice rather than the setup at the time of first writing. Whether a given exclusion is acceptable is a judgment the certification body makes, not the company or its consultant, so state the reasoning plainly and be ready to show the evidence behind each statement.

Which remote working controls to treat as in scope, and when each approach fits

This table compares the three ways a remote company can handle physical and remote-work controls: excluding them with written justification, applying them to home workspaces and personal devices, or relying on a provider's documented controls for hosted data. Read each row as a decision, then check the evidence column against what your auditor will ask to see.

Option	When it fits	Evidence the auditor will look for	Main risk
Exclude physical controls with written justification	No office, warehouse or equipment room exists, and every physical control maps to a provider's data center or to nothing the company operates	Statement of Applicability entries with reasons for exclusion, the risk assessment that supports them, and proof that no premises exist	The exclusion is accepted on paper but later contradicted by a co-working desk, a stored laptop cabinet or a field site
Apply A.7.x controls to home workspaces through policy and attestation	Staff work from home offices and the company keeps company equipment in those homes	Remote working policy, signed staff attestations on screen locking, clear desks and private workspaces, and evidence of training	Attestations are signed but never checked, so the auditor finds unlocked screens or documents left in shared rooms
Rely on a cloud or colocation provider's documented controls	Customer data sits in a provider's facilities and the company has no control over those sites	Supplier controls under A.5.19 to A.5.22, the provider's current attestation reports, and the company's review of them	The provider's report covers different services or dates than the company uses, and the gap goes unnoticed
Core remote-work controls: A.6.7, A.8.1 and A.8.5	Always in scope for a remote company, whatever it decides about physical controls	Remote working procedure, endpoint configuration records, and authentication settings such as multi-factor sign-in	Remote access is treated as a home-network question only, so unmanaged devices and shared accounts go untested

How a remote company moves through stage 1 and stage 2 of the audit

The initial two-stage audit checks that the ISMS is designed correctly, then tests whether it works in practice, and for a remote company it also tests whether remote devices, access and working arrangements are controlled. Each step ends with a written output that the organization can keep as evidence.

Agree the audit plan and remote audit approach
Before stage 1, the certification body proposes an audit plan that names the scope, the sites or remote locations to be covered and the planned audit days. Ask the certification body to confirm in writing how much of the audit will be conducted remotely, which tools will be used and how the remote audit approach will be reported. The output is the written audit plan and the agreed remote audit method, which you should check against your Statement of Applicability and the scope of your certificate.
Submit the documents for stage 1 review
Your team provides the ISMS documentation to the auditor, typically the scope statement, information security policy, risk assessment and risk treatment process, Statement of Applicability, and records of internal audit and management review. For a fully remote company, this set should also show how remote working is governed under A.6.7, how endpoints and remote access are managed, and how the company states that its activities are conducted remotely. The output of this step is the stage 1 document review, which tests whether the ISMS is designed to meet the standard and is ready for stage 2.
Receive the stage 1 output and close gaps
At the end of stage 1, the auditor issues a written report that records findings on documentation, identifies areas of concern and states whether the organization can proceed to stage 2. Gaps raised here must be resolved before the stage 2 evidence review, so treat this report as the working list for remediation. Ask the certification body for the stage 1 report in writing and confirm the planned interval before stage 2, since that timing depends on how quickly the gaps can be closed.
Prepare remote evidence for stage 2 sampling
Before stage 2, your team assembles evidence that the controls operate on the devices and accounts that staff actually use at home or in co-working spaces. Typical evidence includes device inventories, disk encryption and endpoint management status, screen lock and patch records, identity provider logs, multi-factor authentication settings and access reviews. The output is an evidence pack organized by control, which lets the auditor sample individual people, devices and accounts without needing to visit an office.
Sample remote devices, access and records in stage 2
In stage 2, the auditor tests whether the controls operate in practice by selecting samples of people, devices, accounts, changes and records. For a remote organization, samples often include laptops from different staff members, onboarding and offboarding tickets for remote hires, and access logs for remote sessions. The auditor may conduct parts of this testing remotely using screen sharing or read-only access to tools, and the audit report must state how far remote auditing was used and how effective it was. The output is the auditor's list of observations, including any nonconformities.
Hold the opening and closing meetings
A stage 2 audit begins with an opening meeting, where the auditor explains the audit plan, confirms the scope and introduces the people to be interviewed, and ends with a closing meeting, where the auditor presents findings and the nonconformities classified for the audit. Ask who from your team should attend each meeting and which remote tools the certification body will use. The output is the agreed list of findings presented at the closing meeting, which becomes the basis for corrective action.
Respond to nonconformities with corrective actions
If the auditor records nonconformities, your organization must analyze the cause, decide on a correction and a corrective action, and submit them to the certification body within the deadline it sets. Keep records showing the root cause, the action taken, the evidence that the action worked and the date it was verified. The certification decision depends on whether these corrective actions are accepted, and the output is either a certificate or a documented set of remaining actions that the certification body must verify before it can decide.

How remote audits work for the auditor and for the company

The compliance lead owns the evidence trail that an auditor samples during a remote audit. Because the auditor cannot walk the floor or sit beside an engineer, every claim in the Statement of Applicability needs a document or recording that can be shared in advance and walked through on screen. The lead also decides who answers for each evidence set, so the auditor is never left waiting for someone to be found.

Secure document sharing: Set up one controlled repository with access logs, version history and expiry on external links, and agree the sharing method with the certification body before stage 1.
Recorded walkthroughs: Record short walkthroughs of onboarding, offboarding, access reviews and incident handling so the auditor can see the process without a live session slipping past the agreed time.
Named evidence owners: Assign one person per Annex A control in the Statement of Applicability, with a backup, and publish the list to the auditor.
Remote working evidence: Keep records for A.6.7 Remote working, including the device and access rules that apply to people working away from premises.
Report wording: Ask early how the certification body will word the extent and effectiveness of remote auditing in its report.

Confirm with the certification body which sampling method it uses for remote evidence and whether it accepts screen-share walkthroughs for every control.

What a remote organization needs in place before the audit

A fully remote company has no office to show an assessor, so its evidence has to come from device, identity, policy and data records. The six items below are the ones a certification body will ask to see first, and each one can be checked internally before stage 1 begins.

Device inventory for work use

Keep a register of every laptop, phone and server image used for company work, including personal devices that touch company data. For each entry, record the owner, operating system version, disk encryption status, screen lock setting, and the date of the last patch cycle. This supports A.8.1 User endpoint devices and shows the auditor the scope of what remote work actually touches. Check internally by sampling five devices at random and confirming each record matches the device's real settings. Ask your security lead to confirm how personal devices are enrolled and whether any are excluded from the register.

Remote working and acceptable use policy

Write one policy that states which locations and networks staff may work from, which devices are permitted, how company data may be stored locally, and what must be reported if a device is lost. This policy is the primary document behind A.6.7 Remote working, so the auditor will read it against your actual practice. Check that every staff member has acknowledged the current version and that the policy names an owner and review date. A policy that describes an office-based process will be flagged as inconsistent with a remote company.

MFA and access evidence for cloud accounts

Remote companies rely on cloud and SaaS accounts for nearly every process, so the auditor will ask who can sign in, from where, and with which second factor. Export the user list from your identity provider and each critical SaaS tool, then compare it against your joiner, mover and leaver records. Confirm that multi-factor authentication is enforced rather than optional for administrator and production accounts. This evidence supports A.8.5 Secure authentication and A.5.18 Access rights. Flag any shared or dormant accounts before the auditor finds them.

Secure home working guidance and training

Provide written guidance covering home network basics, screen privacy in shared spaces, handling of printed material, and safe use of video calls. Pair it with training records showing who completed the session, when, and what it covered. The guidance and records together give evidence for A.6.3 Information security awareness, education and training and for the people-side measures in A.6.7. Check internally that new joiners receive the same material within their first weeks and that refresher content is dated. Ask your HR or people lead to confirm where completion records are kept.

Register of data storage and processing locations

Remote teams often store data in several cloud regions, SaaS vendors, and staff devices at once, which makes the location question hard to answer on the spot. Maintain a register listing each system holding company or customer information, the provider, the country or region of storage, and the owner responsible. This register feeds the asset inventory and the supplier controls the auditor will test. Check it against the actual cloud account lists and SaaS subscriptions, since shadow tools are the most common gap. Confirm with legal whether any region restrictions in customer contracts apply.

Current Statement of Applicability with justifications

The Statement of Applicability is required by clause 6.1.3 d) of ISO/IEC 27001:2022 and lists every Annex A control with whether it applies and why. For a remote company, the physical controls in theme 7 need specific justification, such as explaining that no secure office exists and that equipment and storage media are handled under other controls. Review every justification against the evidence above and confirm each control's status matches the operational reality. Assign a version number and approval date, and ensure top management has approved it. An SoA that marks physical controls as excluded without reasons is the most common reason for questions in stage 1.

Counting people for ISO 27001 audit time when nobody works in an office

Audit time for ISO 27001 does not depend on how many offices an organization has. For a fully remote company, the number that matters is the count of people doing work under the organization's control. Clause C.6 of ISO/IEC 27006-1:2024, as cited in European Accreditation FAQ 48.5, generally calculates on-site audit time from the total number of persons doing work under the organization's control, wherever they are located. A team with no premises therefore does not get a smaller audit by default. The certification body still counts the people, and the calculation starts from that headcount. Who counts is broader than the employee list. Employees count, and so do contractors, temporary staff and others whose work the organization directs and whose access to information it controls. Your count should follow the scope of the ISMS, not the payroll. Keep a dated register that lists each person, their role, whether they work under your control, and whether they access in-scope systems or information. Include founders, part-time staff and outsourced developers if they fall within scope. Exclude people whose work does not fall under your control, and record the reason for each exclusion. The register becomes the evidence the auditor uses to test the count. Confirm the number in writing with the certification body before you sign an audit proposal. Ask for the method they use, the headcount they applied, the audit days it produces, and how any remote-only sites or remote audit activities are reflected in that total. Do not assume that remote staff reduce audit time, because the calculation may not work that way for your organization. Ask the certification body to explain any difference between your count and theirs. A written answer protects you from an audit plan that changes after the contract is signed.

Questions remote companies ask before bringing in ISO 27001 help

Can a company with no office get ISO 27001 certified?

Yes, nothing in ISO/IEC 27001:2022 requires a physical office. The certification body audits the information security management system, so what matters is whether the controls that protect information work wherever people and systems are located. Remote companies still need to define a scope, run a risk assessment and produce a Statement of Applicability. Your cloud accounts, endpoints, identity provider and collaboration tools usually become the core of the scope. Confirm with your chosen certification body how it plans to sample remote staff and cloud evidence before you commit to a scope.

Does the ISO 27001 certificate say that the company is remote?

It can. ISO/IEC 27006-1:2024 requires the certificate and audit report of a client with few or no relevant physical sites to state that its activities are conducted remotely, according to IAF MD 29:2024. The certification body sets the wording, so ask for a draft certificate during the planning stage. Buyers who check the certificate through the IAF CertSearch database will see the scope and location statements, so review them with your sales and procurement teams before the first audit.

How do physical controls get justified when there is no office?

Physical controls in Annex A theme 7 are not automatically excluded. You justify each one in the Statement of Applicability, which clause 6.1.3 d) of the standard requires, by stating whether it applies and why. A remote company can often exclude controls for secure areas and office perimeters, while still addressing equipment security, off-premises assets (A.7.9) and clear desk or screen practices for home workspaces. Your risk assessment should support each exclusion. Expect the auditor to test those exclusions, so keep the reasoning written down.

How is audit time counted for a team with no office?

Audit time is driven by the number of persons doing work under the organization's control, wherever they are located. European Accreditation FAQ 48.5, citing clause C.6 of ISO/IEC 27006-1:2024, explains that on-site audit time for multi-site organizations is generally calculated from that total. Remote staff therefore count, even though no site is visited. Ask your certification body how it counts contractors and part-time people, and how it plans remote sampling. The headcount and the complexity of your scope both influence the quote, so give them an accurate, dated list of roles.

What does a remote ISO 27001 audit involve?

A remote audit uses information and communication technology to examine documents, records, system configurations and interviews without the auditor being physically present. Global ACI-TECH-3-003 governs the use of ICT in certification audits, and ISO/IEC 27006-1:2024 requires audit reports to state how far remote auditing was used and how effective it was. Prepare a secure way to share screen views and evidence, a current asset inventory, read-only access to cloud consoles where appropriate, and a named person who can walk the auditor through each system. Confirm with the certification body which parts it will audit remotely.

Can our own team implement ISO 27001 without outside help?

Yes, a company can prepare its own ISMS, and the standard does not require a consultant. The work falls into three parts: building the management system and Statement of Applicability, configuring and evidencing the technical controls, and running the management review and internal audit cycle. Teams with a security engineer and an operations owner often handle the technical part internally, while the documentation and audit preparation take more time than people expect. An implementation partner such as DeployOpen can prepare systems and evidence for your assessment, but it does not issue the certificate, and the certification body must be independent of whoever helps you build the system.

What do leadership and staff have to commit to?

Leadership must own the policy, the scope, the risk decisions and the management review, which the standard places under top management. Staff must follow the remote working, endpoint and acceptable use rules, complete awareness training and report security events. Those duties are recurring, so budget for time each quarter rather than only before the audit. Cost drivers include the number of tools to be evidenced, the maturity of your identity and device management, the number of contractors, and how much of the evidence you already collect. Ask any provider for a written scope and a list of deliverables that name who does each task.

How DeployOpen prepares a remote company's controls and evidence

DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For a fully remote company, that means preparing the systems, controls and evidence that an independent certification body will later examine, while the organization keeps ownership of its controls and its ISMS.

How we scope

Written scope agreed before work starts, naming the systems, cloud accounts and remote workforce it covers
Review of the remote working arrangements and the Statement of Applicability entries that justify each physical control
Clear list of which controls the company owns, which DeployOpen prepares and which the certification body assesses

How we build

Self-hosted platforms configured for remote access, endpoint management, secure authentication and logging inside your own accounts
Evidence collection set up so access reviews, device records and training completions can be produced on request
Testing of remote access and endpoint controls to confirm they operate as the written procedures describe

How we hand over

Documentation of configurations, procedures and evidence locations, written so your own staff can maintain them
Walkthrough of the evidence set with the people who will answer auditor questions about remote working
Clear record of what was delivered against the written scope, with open items listed for your decision

How we support

Fixed-scope engagements, with any follow-on work quoted from a new written scope
Ongoing support, upgrades and continuous testing available as a retainer for platforms that keep changing
Confirm with your certification body how remote audits will be conducted and reported before the audit is booked

ISO 27001 for fully remote companies