Remote Working Policy¶

Purpose. Soon is fully remote — there are no offices, and remote working is the default, not an exception to be individually approved. This policy sets the security baseline every person must meet wherever they work, so that customer workforce data and Soon systems stay protected outside a controlled office environment.

1. Scope¶

All Soon employees and contractors, at every location they work from: home, co-working spaces, public places, or while travelling. It covers the devices, networks, and surroundings used for Soon work.

2. Policy¶

2.1 Devices¶

Work is done only on a company-managed device, or a device that verifiably meets the same baseline (full-disk encryption, screen lock, automatic updates, anti-malware) per the Mobile Device Policy.
Screen lock is enabled with a maximum 5-minute timeout, and the screen is locked whenever the device is left unattended.
No work data on personal, unmanaged devices: no syncing work email or files, no storing customer data, no signing in to production systems from them.

2.2 Accounts and access¶

All work applications are accessed via SSO where supported, with MFA per the risk-tiered posture in the Access Control Policy (always required for sensitive systems such as AWS and GitHub).
Credentials live in the password manager, never in browsers on shared devices or in plain-text notes.

2.3 Home network¶

Home Wi-Fi must use WPA2 or better, with a non-default router admin password.
Work devices should not be exposed to the network's other users' devices where the router supports isolation; sensitive administration (e.g. AWS console) must never happen over an open/unencrypted network — use a personal hotspot or VPN instead.

2.4 Public spaces and travel¶

Position screens so they cannot be overlooked when handling customer data; use a privacy filter if regularly working in public.
No sensitive calls (customer data, security matters, credentials) within earshot of strangers.
Devices are never left unattended in public and are carried as hand luggage when travelling.

2.5 Video calls¶

Check what is visible on screen before sharing — close tabs and notifications that may expose customer data or credentials.
Verify participants before discussing confidential matters; use waiting rooms or authenticated links for external calls.
Record calls only with participants' knowledge and store recordings in approved company storage.

2.6 Household and surroundings¶

Work sessions are locked or ended before others (family, housemates) can view the screen; confidential material is not left visible on shared displays.
Lost or stolen devices, or any suspected exposure, are reported immediately per the Information Security Event Reporting Procedure.

3. Roles & responsibilities¶

Everyone — meets this baseline at every work location and reports deviations or losses immediately.
Security responsible — maintains the device baseline and verifies enforcement (MDM/IdP settings).
Olaf Jacobson (management) — approves any exception in writing, with an expiry date.

Change log¶

Version	Date	Author	Comments
0.1	2025-06-07	Olaf Jacobson	First draft document
0.2	2026-07-18	Andrea Cardinali	Rewritten lean and Soon-specific (ISMS overhaul). Remote-by-default premise.