Control statement
- a.Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and
- b.Authorize each type of remote access to the system prior to allowing such connections.
Discussion
Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of [CA-3](#ca-3) . Enforcing access restrictions for remote access is addressed via [AC-3](#ac-3).
From control text to operational evidence
Use Remote Access as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to identity, authorization, least privilege, session boundaries, and access lifecycle governance.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- access approvals and entitlement records
- role and group configuration exports
- periodic access review results
- authentication and authorization logs
Common failure patterns
- standing privileges that outlive business need
- shared or orphaned accounts
- access rules implemented differently across systems
- approvals that cannot be traced to actual permissions
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- AC-17a.
- AC-17a.[01]usage restrictions are established and documented for each type of remote access allowed;
- AC-17a.[02]configuration/connection requirements are established and documented for each type of remote access allowed;
- AC-17a.[03]implementation guidance is established and documented for each type of remote access allowed;
- AC-17b.each type of remote access to the system is authorized prior to allowing such connections.
Examine
- Access control policy
- procedures addressing remote access implementation and usage (including restrictions)
- configuration management plan
- system configuration settings and associated documentation
- remote access authorizations
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for managing remote access connections
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Remote access management capability for the system
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Related defensive techniques
D3FEND maps this base control or one of its enhancements to the following defensive techniques. The ontology relation label is preserved and does not by itself prove implementation or effectiveness.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
AC-17(1) — Monitoring and Control
Employ automated mechanisms to monitor and control remote access methods.
Official discussion
Monitoring and control of remote access methods allows organizations to detect attacks and help ensure compliance with remote access policies by auditing the connection activities of remote users on a variety of system components, including servers, notebook computers, workstations, smart phones, and tablets. Audit logging for remote access is enforced by [AU-2](#au-2) . Audit events are defined in [AU-2a](#au-2_smt.a).
Assessment objectives and methods
- AC-17(01)[01]automated mechanisms are employed to monitor remote access methods;
- AC-17(01)[02]automated mechanisms are employed to control remote access methods.
Examine
- Access control policy
- procedures addressing remote access to the system
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system monitoring records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developers
Test
- Automated mechanisms monitoring and controlling remote access methods
Related controls
AC-17(2) — Protection of Confidentiality and Integrity Using Encryption
Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
Official discussion
Virtual private networks can be used to protect the confidentiality and integrity of remote access sessions. Transport Layer Security (TLS) is an example of a cryptographic protocol that provides end-to-end communications security over networks and is used for Internet communications and online transactions.
Assessment objectives and methods
cryptographic mechanisms are implemented to protect the confidentiality and integrity of remote access sessions.
Examine
- Access control policy
- procedures addressing remote access to the system
- system design documentation
- system configuration settings and associated documentation
- cryptographic mechanisms and associated configuration documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developers
Test
- Cryptographic mechanisms protecting confidentiality and integrity of remote access sessions
Related controls
AC-17(3) — Managed Access Control Points
Route remote accesses through authorized and managed network access control points.
Official discussion
Organizations consider the Trusted Internet Connections (TIC) initiative [DHS TIC](#4f42ee6e-86cc-403b-a51f-76c2b4f81b54) requirements for external network connections since limiting the number of access control points for remote access reduces attack surfaces.
Assessment objectives and methods
remote accesses are routed through authorized and managed network access control points.
Examine
- Access control policy
- procedures addressing remote access to the system
- system design documentation
- list of all managed network access control points
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms routing all remote accesses through managed network access control points
Related controls
AC-17(4) — Privileged Commands and Access
- (a)Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Organization-defined: organization-defined needs] ; and
- (b)Document the rationale for remote access in the security plan for the system.
Official discussion
Remote access to systems represents a significant potential vulnerability that can be exploited by adversaries. As such, restricting the execution of privileged commands and access to security-relevant information via remote access reduces the exposure of the organization and the susceptibility to threats by adversaries to the remote access capability.
Organization-defined parameters (3)
Assessment objectives and methods
- AC-17(04)(a)
- AC-17(04)(a)[01]the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence;
- AC-17(04)(a)[02]access to security-relevant information via remote access is authorized only in a format that provides assessable evidence;
- AC-17(04)(a)[03]the execution of privileged commands via remote access is authorized only for the following needs: [Organization-defined: needs requiring remote access];
- AC-17(04)(a)[04]access to security-relevant information via remote access is authorized only for the following needs: [Organization-defined: needs requiring remote access];
- AC-17(04)(b)the rationale for remote access is documented in the security plan for the system.
Examine
- Access control policy
- procedures addressing remote access to the system
- system configuration settings and associated documentation
- security plan
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms implementing remote access management
Related controls
AC-17(5) — Monitoring for Unauthorized Connections
This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.
AC-17(6) — Protection of Mechanism Information
Protect information about remote access mechanisms from unauthorized use and disclosure.
Official discussion
Remote access to organizational information by non-organizational entities can increase the risk of unauthorized use and disclosure about remote access mechanisms. The organization considers including remote access requirements in the information exchange agreements with other organizations, as applicable. Remote access requirements can also be included in rules of behavior (see [PL-4](#pl-4) ) and access agreements (see [PS-6](#ps-6)).
Assessment objectives and methods
information about remote access mechanisms is protected from unauthorized use and disclosure.
Examine
- Access control policy
- procedures addressing remote access to the system
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for implementing or monitoring remote access to the system
- system users with knowledge of information about remote access mechanisms
- organizational personnel with information security responsibilities
Related controls
AC-17(7) — Additional Protection for Security Function Access
This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.
AC-17(8) — Disable Nonsecure Network Protocols
This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.
AC-17(9) — Disconnect or Disable Access
Provide the capability to disconnect or disable remote access to the system within [Organization-defined: time period].
Official discussion
The speed of system disconnect or disablement varies based on the criticality of missions or business functions and the need to eliminate immediate or future remote access to systems.
Organization-defined parameters (1)
Assessment objectives and methods
the capability to disconnect or disable remote access to the system within [Organization-defined: time period] is provided.
Examine
- Access control policy
- procedures addressing disconnecting or disabling remote access to the system
- system design documentation
- system configuration settings and associated documentation
- security plan, system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developers
Test
- Mechanisms implementing capability to disconnect or disable remote access to system
AC-17(10) — Authenticate Remote Commands
Implement [Organization-defined: mechanisms] to authenticate [Organization-defined: remote commands].
Official discussion
Authenticating remote commands protects against unauthorized commands and the replay of authorized commands. The ability to authenticate remote commands is important for remote systems for which loss, malfunction, misdirection, or exploitation would have immediate or serious consequences, such as injury, death, property damage, loss of high value assets, failure of mission or business functions, or compromise of classified or controlled unclassified information. Authentication mechanisms for remote commands ensure that systems accept and execute commands in the order intended, execute only authorized commands, and reject unauthorized commands. Cryptographic mechanisms can be used, for example, to authenticate remote commands.
Organization-defined parameters (2)
Assessment objectives and methods
[Organization-defined: mechanisms] are implemented to authenticate [Organization-defined: remote commands].
Examine
- Access control policy
- procedures addressing authentication of remote commands
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developers
Test
- Mechanisms implementing authentication of remote commands
Related controls
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.