This objective ensures that your organization’s access control policy explicitly addresses remote access, including who is allowed, what methods are approved, and what security requirements (e.g., encryption, multi-factor authentication) must be enforced.