Remote Working Policy

Purpose

This policy establishes the information security requirements for remote working at Carriyo. As a fully remote organisation, Carriyo must ensure that information assets are protected regardless of where employees and contractors work. This policy defines the controls required to maintain the confidentiality, integrity, and availability of data when accessed from remote locations. It supports ISO 27001:2022 Annex A control A.6.7 (Remote working).

Scope

This policy applies to all Carriyo personnel (employees, contractors, and third-party service providers) who access Carriyo systems, data, or services from any location outside a Carriyo-controlled office. Given Carriyo's fully remote operating model, this effectively applies to all personnel at all times.

It covers:

• Use of company-provided devices for remote work
• Use of personal devices for work purposes (governed additionally by the Mobile Device / BYOD Policy)
• Access to Carriyo systems over home networks, public networks, and mobile networks
• Physical security of the remote workspace
• Handling of Carriyo data in remote environments

Device Requirements

Company-Provided Devices

All personnel who regularly access Carriyo systems are provided with company-managed devices. These devices must meet the following minimum security requirements:

Software Requirements

• Only approved and licensed software may be installed on work devices
• Software installations from untrusted sources are prohibited
• Browser extensions must be limited to those approved by the Information Security Specialist or IT
• Peer-to-peer file sharing software is prohibited on work devices

Device Maintenance

• Personnel are responsible for keeping their devices updated and in good working order
• Lost or stolen devices must be reported to the Information Security Specialist immediately (within 1 hour of discovery)
• Devices that are damaged or malfunctioning must be reported promptly so that security controls can be verified before the device is repaired or replaced

Network Security

Home Network Requirements

Personnel working from home must ensure the following minimum security standards for their home network:

VPN and Encrypted Connections

• All connections to Carriyo systems use encrypted channels (HTTPS/TLS 1.2 or higher) authenticated through Google Workspace SSO; administrative interfaces are additionally protected by authentication, MFA where enforced (to be verified with DevOps) and WAF
• Where a system requires network-level access control, access is restricted by AWS security group and IAM policy
• Carriyo operates no corporate VPN today. A VPN is planned as an additional layer for access to critical systems (AWS infrastructure and future servers). Once in place, personnel shall connect through it when accessing the systems behind it, and its product, administering role, in-scope systems, MFA enforcement and access-log location shall be recorded in CAR-ISMS-LST-001

Public Network Use

• Personnel should prefer a personal or company-provided mobile hotspot over public Wi-Fi (cafes, airports, hotels, co-working spaces) whenever available
• Restricted data must not be accessed over public Wi-Fi
• Administrative and production operations (AWS console, production data access, privileged actions) must not be performed over public Wi-Fi
• Personnel should prefer mobile hotspot (personal or company-provided) over public Wi-Fi when available
• Bluetooth should be disabled when not in active use in public locations

Network Monitoring

• Personnel must not interfere with or disable any network monitoring or security tools installed on company devices
• Anomalous network activity detected on company devices may be investigated in accordance with the Acceptable Use Policy and applicable privacy laws

Physical Security of the Remote Workspace

Workspace Requirements

Personnel must maintain a workspace that provides a reasonable level of physical security for Carriyo work:

• Screen privacy — Position screens so that they are not easily visible to unauthorized persons (household members, visitors, passers-by). Use a privacy screen filter in shared or public environments.
• Clean desk — Do not leave Confidential or Restricted information visible or accessible when stepping away from the workspace. Lock the device screen when leaving the workspace.
• Secure storage — If physical documents containing Carriyo data are necessary, store them in a locked drawer or cabinet when not in active use.
• Meeting privacy — Conduct video and audio calls involving sensitive or Confidential information in a private room or space where conversations cannot be overheard. Use headphones in shared spaces.
• Visitor access — Do not allow unauthorized persons (including household members) to use Carriyo devices or access Carriyo systems.

Printing

• Printing of Confidential or Restricted data at home is discouraged. Where necessary, printed materials must be securely destroyed (cross-cut shredded) when no longer needed.
• Printing of Carriyo data at public locations (hotel business centres, libraries, print shops) is prohibited.

Data Handling

Data Classification Compliance

All data handling in remote environments must comply with Carriyo's Information Classification Framework:

Data Transfer

• Carriyo data must not be transferred to personal devices, personal email accounts, personal cloud storage, or unauthorized USB drives
• File sharing between Carriyo personnel uses approved collaboration tools only
• Data transfer to external parties follows the data sharing procedures defined in the Data Protection Policy (CAR-ISMS-POL-008)
• Removable media (USB drives, external hard drives) must not be used to store Confidential or Restricted data unless encrypted and specifically authorized

Cloud Storage

• Carriyo data must be stored in approved cloud services (company-provisioned accounts)
• Local copies of work files should be synchronized to approved cloud storage
• Personnel must not store Carriyo data in personal cloud storage accounts (personal Google Drive, Dropbox, iCloud, etc.)

Acceptable Use Provisions

General Conduct

• Remote workers must comply with the Acceptable Use Policy (CAR-ISMS-POL-003) at all times
• Work devices are provided for business use; limited personal use is permitted provided it does not compromise security, violate any policy, or interfere with work responsibilities
• Personnel must not install unauthorized software, disable security controls, or modify device configurations that affect security

Communication Security

• Business communications should use approved channels (company email, approved messaging platforms)
• Sensitive or Confidential information must not be communicated through personal messaging apps, personal email, or social media
• Video conferencing platforms must be company-approved; meetings involving Confidential topics should use waiting rooms or meeting passwords to prevent unauthorized access

Authentication

• Multi-factor authentication (MFA) is mandatory for all Carriyo systems as defined in the Access Control Policy (CAR-ISMS-POL-003)
• Authentication to Carriyo platform systems is managed through AWS Cognito, which is the sole authentication and credential-management tool in use. Access to corporate SaaS applications is SSO-first through Google Workspace
• Platform and workload secrets are managed in AWS Secrets Manager. Personnel must not hold platform secrets locally
• Passwords must not be shared, written down in accessible locations, or stored in unencrypted files
• Carriyo does not operate a standalone password manager. Where a credential cannot be placed behind SSO, personnel shall use the operating system's built-in secure credential store (macOS Keychain, Windows Credential Manager) rather than plaintext files, notes or spreadsheets
• Personnel must not allow browsers to save passwords for Carriyo systems on unmanaged or shared devices

Incident Reporting

Remote workers must report the following security events immediately to the Information Security Specialist:

• Lost or stolen devices (within 1 hour)
• Suspected malware infection or compromise
• Unauthorized access to Carriyo data or systems
• Phishing attempts or social engineering attacks
• Physical security breaches affecting Carriyo data (e.g., break-in where a work device was present)
• Any situation where Confidential or Restricted data may have been exposed to unauthorized persons

Incident reporting follows the Incident Management Policy (CAR-ISMS-POL-011).

Responsibilities

Compliance Verification

Compliance with this policy is verified through:

• Periodic device compliance checks (currently manual; automated checks depend on adoption of a device management platform)
• Security awareness training that includes remote work security topics
• Internal audit review of remote work security controls
• Incident analysis to identify remote work-related security gaps
• Self-assessment questionnaires for personnel (annually)

Review

This policy is reviewed annually or when significant changes occur to Carriyo's remote working arrangements, technology stack, or threat landscape. Updates are processed through the standard document control procedure (CAR-ISMS-PRC-001).

Enforcement

Violations of this policy may result in disciplinary action, up to and including termination of employment or contract. Repeated failure to maintain device security standards or comply with data handling requirements is treated as a serious policy violation. Personnel who become aware of violations by others are expected to report them to the Information Security Specialist.