Mapped to NIST 800-171 Requirement: 3.1.12
CMMC Assessment Objective: AC.L2-3.1.12[d]
What This Objective Means
Now that you’ve defined your remote access policy (AC.L2-3.1.12[b]) and written procedures to support it (AC.L2-3.1.12[c]), this final objective focuses on ensuring your system configurations actually enforce those expectations.
The goal is to confirm that your remote access tools and services:
• Use multi-factor authentication (MFA)
• Require encryption (e.g., TLS, IPsec)
• Lock or terminate idle sessions
• Log access events and session activity
• Are limited to authorized users, devices, and networks
Why It Matters
Policy and procedure mean nothing without enforcement. Misconfigured systems can allow:
• Unauthorized users to bypass security measures
• Unencrypted connections to transmit CUI
• Sessions to remain active long after users are disconnected
This objective makes sure your systems are doing what your documentation says they should.
How to Implement It
• Review system settings for remote access platforms (e.g., VPNs, RDP gateways, cloud consoles)
• Confirm:
◦ MFA is required before access
◦ Encryption is enabled and enforced
◦ Session inactivity timeouts and logoff rules are in place
◦ Logging and monitoring are active
• Match these configurations to your policy and procedures
• Apply consistent settings across all systems that support CUI-related remote access
Evidence the Assessor Will Look For
• Screenshots of VPN or remote desktop configuration panels
• Group Policy or MDM settings enforcing timeout, MFA, or encryption
• Network security appliance configs (e.g., firewall rules, remote access policies)
• Logs showing remote access sessions and lockouts
• Testing or validation that policy-aligned controls are active and enforced
Common Gaps
• Inconsistent settings between systems (e.g., VPN enforces MFA, but RDP doesn’t)
• Policy and procedures written, but configurations left at default
• MFA or encryption settings misconfigured or turned off for “trusted” users or locations
How Cuick Trac Helps
Cuick Trac supports this control by:
• Providing a secure-by-default remote access infrastructure
• Enforcing MFA, session timeouts, and encryption automatically
• Logging and monitoring all remote activity for accountability
• Aligning technical enforcement with your documented remote access policies
With Cuick Trac, compliance isn’t just configured once—it’s enforced continuously.
Final CTA
Your policy says what should happen. Your configuration proves it does.
Schedule a Cuick Trac demo and validate your remote access controls at the system level.