Security requirement
- a.Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access.
- b.Authorize each type of remote system access prior to establishing such connections.
- c.Route remote access to the system through authorized and managed access control points.
- d.Authorize the remote execution of privileged commands and remote access to security-relevant information.
Discussion
Remote access is access to systems (or processes acting on behalf of users) that communicate through external networks, such as the internet. Monitoring and controlling remote access methods allows organizations to detect attacks and ensure compliance with remote access policies. Routing remote access through managed access control points enhances explicit control over such connections and reduces susceptibility to unauthorized access to the system, which could result in the unauthorized disclosure of CUI. Remote access to the system represents a significant potential vulnerability that can be exploited by adversaries. Restricting the execution of privileged commands and access to security-relevant information via remote access reduces the exposure of the organization and its susceptibility to threats by adversaries. A privileged command is a human-initiated command executed on a system that involves the control, monitoring, or administration of the system, including security functions and security-relevant information. Security-relevant information is information that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce the system security policy or maintain isolation of code and data. Privileged commands give individuals the ability to execute sensitive, security-critical, or security-relevant system functions.
Implementation perspective
Treat Remote Access as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to approved identities, least privilege, remote access, information flow, and the full account lifecycle.
- Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
- Resolve every organization-defined parameter through an approved governance and tailoring process.
- Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
- Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
- Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.
Questions to ask
- Which CUI assets, data flows, users, and services are protected by this requirement?
- Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
- Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
- What change, incident, or threshold should trigger reassessment?
Evidence and validation
- access authorization and approval records
- account inventories and entitlement exports
- access review results
- authentication and authorization logs
Common failure patterns
- CUI access that exceeds mission need
- shared or orphaned accounts
- remote access paths outside the approved boundary
- access reviews that cannot be reconciled to deployed permissions
Assessment objectives and methods
Assessment objectives (9)
- a.
types of allowable remote system access are defined.
- a.
usage restrictions are established for each type of allowable remote system access.
- a.
configuration requirements are established for each type of allowable remote system access.
- a.
connection requirements are established for each type of allowable remote system access.
- b.
each type of remote system access is authorized prior to establishing such connections.
- c.
remote access to the system is routed through authorized access control points.
- c.
remote access to the system is routed through managed access control points.
- d.
remote execution of privileged commands is authorized.
- d.
remote access to security-relevant information is authorized.
Examine
- access control policy and procedures
- procedures for remote system access
- remote system access configuration and connection requirements
- configuration management plan
- system configuration settings
- remote access authorizations
- system audit records
- system design documentation
- procedures for remote access to the system
- system monitoring records
- list of managed network access control points
- system security plan
- other relevant documents or records
Interview
- personnel with responsibilities for managing remote access connections
- personnel with information security responsibilities
- system administrators
Test
- mechanisms for monitoring and controlling remote access methods
- mechanisms for routing remote accesses through managed access control points
- remote access management capability for the system
Source NIST SP 800-53 controls
These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.
Authoritative sources
- NIST SP 800-171 Revision 3 official publication ↗
- NIST SP 800-171A Revision 3 official publication ↗
- NIST OSCAL Content release used for this import ↗
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.