Remote access refers to the use of information systems from outside the organization's premises, most often with a laptop computer. For classified information, remote access is permitted only for classification level IV information.

The organization has established procedures for implementing the following protections:

• terminal devices, storage media, and communication connections used in remote access outside security areas are protected with encryption solutions that provide sufficient security for the relevant classification level
• remote access to information systems is not possible without traffic encryption that is sufficiently secure for protecting information of the relevant classification level
• unencrypted portable storage devices (such as hard drives, USB sticks, and similar devices) may be used only if they are never left unattended outside approved security areas.