S 2.117 Regulation of access by telecommuters

Initiation responsibility: IT Security Management, Head of IT Section

Implementation responsibility: Administrator, Superiors

If telecommuting requires access to the IT of the institution (for example, on a server), clarification is required beforehand as to which objects (data, IT) telecommuters actually require to perform their tasks. Rights such as read and write access need to be allocated accordingly for these objects. Telecommuters should not be allowed to access objects which they do not actually require. This applies to access to data as well as the IT available at the institution. This safeguard is intended to minimise the potential damage caused by hacker intrusions into the communications computer. For the allocation of access rights, refer to S 2.7 Granting of system/network access rights and S 2.8 Granting of application/data access permissions.

Additional controls:

• Does the administrator know which objects the telecommuter is allowed to access?

• Which requirements must be fulfilled before access rights can be allocated or modified?

• Is the server administered such that telecommuters are only able to access permissible objects?