How should security teams adapt SOC 2 controls when employees work remotely across unmanaged networks and devices?

Remote work changes the control design, not the control objective

For SOC 2, the goal stays the same: demonstrate that access, integrity, availability, confidentiality, and auditability hold under real operating conditions. What changes is the trust boundary. A remote employee on an unmanaged network or device introduces more variable endpoint posture, more exposure to session theft or phishing, and less certainty that the device itself is enforcing the policies the organisation expects.

That means teams should treat remote work as a control environment issue, not a temporary exception. The strongest controls are the ones that still work when the endpoint is outside corporate management and the network is not trusted.

For the control baseline, the SOC 2 Trust Services Criteria (AICPA) still anchor the audit objective, but the implementation must assume weaker local trust. In practice, that pushes teams toward identity-centric access, stronger authentication, and evidence that controls are enforced consistently rather than informally.

Which controls matter most when devices and networks are not managed?

Identity becomes the control plane. Centralised identity, MFA, and tightly governed provisioning reduce dependence on the security quality of the home network or personal device. If a user can authenticate from anywhere, the security question becomes whether that access is bounded, monitored, and revocable fast enough to contain abuse.

Endpoint monitoring also matters, but the expectation should be realistic. On unmanaged devices, you often cannot rely on full device control, so the control design should prioritise session control, conditional access, device trust checks where available, and alerting on unusual behaviour. The aim is not perfect visibility, it is enough visibility to detect when remote access no longer matches the approved risk posture.

That is why control families such as NIST SP 800-53 Rev 5 Security and Privacy Controls remain useful here, especially for access control, identification and authentication, audit logging, and system integrity. Teams can also use the CIS Controls v8 to structure account management, access control, logging, and vulnerability management around remote endpoints.

How should evidence change for a distributed workforce?

Evidence collection must prove operation over time, not just design on paper. Auditors typically want to see that the same controls applied across employees, locations, and access paths during the audit period. That means retaining identity logs, MFA enforcement records, joiner-mover-leaver evidence, access review results, endpoint or device-trust records where available, and monitoring alerts that show the controls actually produced decisions.

The most common mistake is to document a policy for remote work but fail to preserve the operational proof that the policy was applied consistently. A remote-access control that cannot be evidenced is usually treated as a weaker control, even if the underlying security intent is sound. Teams should also make sure evidence explains exceptions, because unmanaged environments often rely on exceptions that are acceptable only when they are tracked and time-bound.

For broader control mapping and implementation guidance, ISO/IEC 27001:2022 Information Security Management and ISO/IEC 27002:2022 Information Security Controls are useful because they tie policy, access control, authentication, and logging back to repeatable governance. For teams looking for practical operational references, the NCSC UK Advice and Guidance and SANS Security Resources are helpful for remote-access and SOC operating patterns.

Risk and Threat Considerations

Remote work on unmanaged networks and devices increases the chance of session hijacking, credential theft, and unobserved policy drift. The main security issue is not that employees are remote, but that the organisation has less control over the environment that authenticates, connects, and stores active session material.

Failure mechanism: If access depends on a device the organisation cannot harden or monitor, attackers can target credentials, token reuse, malicious Wi-Fi, or compromised endpoints to reach approved systems without defeating the core business application directly.

Impact: A compromise in the remote access path can create broad exposure because the attacker inherits legitimate access, which can affect confidential data, audit integrity, and the credibility of the control environment.

Practitioner Guidance

What to prioritise: Put identity and access governance ahead of endpoint perfection. If you cannot fully manage the device, narrow the blast radius through strong authentication, short-lived access, fast deprovisioning, and clear session monitoring.

What to verify: Test the control as auditors will see it. Verify that MFA is enforced, that revoked access actually disappears quickly, and that logs can tie each remote access event to a real identity, timestamp, and approval state.

Practitioner takeaway: For SOC 2, remote work is acceptable when control enforcement and evidence remain consistent across environments. The standard is not “trusted workplace,” it is “trusted control outcome.”

Related resources from NHI Mgmt Group

• How should security teams adapt access controls when remote work becomes a permanent operating model?
• How should security teams enforce access controls when employees use managed and unmanaged devices for web apps?
• How should security teams protect sensitive data in remote work environments where users collaborate from unmanaged devices and networks?
• How should security teams adapt insider risk controls when employees work onsite, offsite, and hybrid in the same organisation?