Avoid treating Secure remote access as a one-time purchase or checklist item. Tie it to the intended outcome—protects off-site connections with strong authentication and encrypted transport—assign accountability, measure coverage and effectiveness, review exceptions, and update it when threats, systems or business requirements change.

ISO/IEC 27001:2022: https://www.iso.org/standard/27001