AC-17 (4)

Access ControlRev 5organization

Remote Access

Baselines:ModerateHigh

Control Statement

(a) Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignment: organization-defined needs] ; and (b) Document the rationale for remote access in the security plan for the system.

Supplemental Guidance

Remote access to systems represents a significant potential vulnerability that can be exploited by adversaries. As such, restricting the execution of privileged commands and access to security-relevant information via remote access reduces the exposure of the organization and the susceptibility to threats by adversaries to the remote access capability.

Related Controls (3)

AC-6 SC-12 SC-13

CCI Identifiers (7)

CCI-000070Authorize the execution of privileged commands via remote access only in a format that provides assessable evidence for organization-defined needs.CCI-002317Defines the needs for when the execution of privileged commands via remote access is to be authorized.CCI-002318Defines the needs for when access to security-relevant information via remote access is to be authorized.CCI-002319Document the rationale for authorization of the execution of privilege commands via remote access.CCI-002320Document the rationale for authorization of access to security-relevant information via remote access.CCI-002316Authorize access to security-relevant information via remote access only in a format that provides assessable evidence for organization-defined needs.CCI-001437The organization documents the rationale for the execution of privileged commands and access to security-relevant information in the security plan for the information system.

Linked STIG Checks (1)

Across 1 STIGs. Click to expand.