Mapped to NIST 800-171 Requirement: 3.1.12
CMMC Assessment Objective: AC.L2-3.1.12[b]
What This Objective Means
This objective focuses on ensuring that remote access is governed by written policy. Your policy should define:
• What constitutes remote access (e.g., VPN, remote desktop, web apps)
• Who is authorized to use remote access
• What systems or services may be accessed remotely
• What security controls must be in place (e.g., MFA, encryption, session logging)
Without clear policy direction, remote access decisions may be inconsistent or insecure.
Why It Matters
If remote access isn’t defined in your policy:
• Admins and users may enable access methods on their own
• Security settings may vary between tools or departments
• Third-party or vendor access may go unregulated
Policies provide the foundation for consistent, secure remote access governance.
How to Implement It
• Review and revise your access control policy to include a dedicated section on remote access
• Define the following:
◦ Approved remote access technologies
◦ Authorization requirements
◦ Security configurations (e.g., use of VPN, encryption, session timeout)
◦ Restrictions (e.g., no remote access to certain systems)
• Reference relevant procedures and technical controls
• Ensure the policy is approved, version-controlled, and communicated to stakeholders
Evidence the Assessor Will Look For
• A current access control policy that includes a section dedicated to remote access
• Definitions of authorized tools and user roles permitted remote access
• References to MFA, session controls, encryption, or connection logging
• Policy change logs or update history
Common Gaps
• Policy covers general access but does not mention remote access
• Remote access allowed in practice but not governed by policy
• No mention of required security features like MFA or encrypted connections
How Cuick Trac Helps
Cuick Trac supports this control by:
• Providing a compliant default remote access policy for its secure enclave
• Restricting all remote access to pre-approved, secure methods
• Enforcing strong access controls including MFA and session monitoring
• Helping organizations align their broader access policies with CMMC expectations
With Cuick Trac, secure remote access isn’t just practiced—it’s documented, controlled, and enforced.
Final CTA
Remote access should be planned—not improvised.
Schedule a Cuick Trac demo and strengthen your policy foundation for secure off-site access.