What it asks for. Security measures should be in place when personnel work remotely, to protect information accessed, processed or stored outside the organisation's premises. Rules for remote working should be defined.
In practice. A remote working policy sets out where work may be done, which devices may be used and how connections are secured, for example through managed devices, multi factor authentication and secure access services. It also covers home office matters such as privacy from others in the household, printing and disposal of paper. Working from other countries is addressed, since it can raise legal and data transfer issues. Evidence includes the policy, technical configurations, staff acknowledgements and training records.
Common gaps. Policies written during emergency remote working are often never revisited. Unmanaged personal devices, home printers and staff working from abroad without approval are typical weaknesses.