Add remote work security policy

policies/remote-work.md

@@ -0,0 +1,22 @@
+# Remote Work Security Policy
+
+**Version:** 2.2  |  **Owner:** HR  |  **Classification:** Internal
+
+## Requirements
+
+All remote workers must:
+- Use a company-managed device or approved BYO device with MDM enrolled
+- Connect via VPN (WireGuard or GlobalProtect) for access to internal resources
+- Use MFA on all work accounts
+- Ensure home networks have WPA2/WPA3 and unique passwords
+- Lock screens when stepping away (timeout: max 5 minutes)
+
+## Prohibited in remote work
+
+- Using public Wi-Fi without VPN
+- Printing confidential documents at home
+- Allowing family members to use work devices
+
+## Equipment return
+
+Company equipment must be returned within 5 working days of leaving.