I have another question about the policy for mobile devices and teleworking. Where exactly is my question: Area Teleworking Comment:"In smaller companies this doesn’t need to be documented. It should be sufficient to identify existing rules.“ What does „identifying of existing rules“ mean? Does it mean to create another document (in addition to the policy) which describes the teleworking rules what the company defines?
I'm assuming this question refers to the Mobile Device and Teleworking Policy template, section 4.
Considering that, the "identifying of existing rules“ means that for smaller companies you do not need additional detailed plans or procedures, you can simply define phrases identifying the rules used by the organization directly in the policy. This way you have less documentation to worry about. Here is an example considering one of the items of this section (the text on brackets is the identification of the rule):
- prevention of unauthorized access by persons living or working on the location where the telework ing activity is performed [by means of locking the door to the room where the activity is performed every time the employee is absent from the work place].