Mapped to NIST 800-171 Requirement: 3.13.15
CMMC Assessment Objective: SC.L2-3.13.15
What This Control Means
You must ensure no direct, unmanaged remote access to your systems.
Instead, all remote connections must:
• Pass through controlled and monitored points (VPN, secure gateways)
• Authenticate users before granting access
• Apply encryption and session monitoring
• Log activities for review and incident response
This prevents direct exposure of internal systems and protects CUI from remote access threats.
Why It Matters
Without managed control points:
• Remote access could bypass security layers
• Attackers could exploit open ports, misconfigurations, or weak endpoints
• User activity would be invisible or unlogged
• CUI systems would be directly exposed to the internet—dramatically increasing risk
Routed, controlled access ensures protection, visibility, and enforcement.
How to Implement It
1. Deploy Managed Remote Access Solutions Examples:
• VPN concentrators (e.g., IPsec VPNs, SSL VPNs)
• Remote Desktop Gateways (RDP over RD Gateway)
• Cloud-based Secure Access Service Edge (SASE) platforms
• Zero Trust Network Access (ZTNA) solutions
2. Configure Routing and Enforcement
• Require all remote users to connect via managed access points
• Disable direct inbound access to internal systems from the internet
3. Apply Security Policies at Access Points
• Enforce:
◦ Multi-Factor Authentication (MFA)
◦ Device posture checking (e.g., antivirus installed, OS updated)
◦ Encryption standards (TLS, IPsec)
4. Monitor and Log All Remote Sessions
• Capture:
◦ Connection start/end times
◦ Source IPs and device information
◦ Accessed resources and session activity
5. Update Documentation and Policies
• Include routing and access point enforcement details in your SSP and Remote Access Policy
Evidence the Assessor Will Look For
• Network architecture diagrams showing remote access routing through managed points
• VPN, RDP Gateway, or ZTNA configuration files
• SSP entries describing access point requirements and controls
• Logs demonstrating session routing and monitoring
• Policies mandating use of approved remote access methods only
Common Gaps
• Users allowed to RDP or SSH directly to internal IPs without a gateway
• VPN services configured but not mandatory for all remote connections
• Cloud consoles accessible directly without SSO/MFA or IP whitelisting
• No centralized logging or monitoring of remote session activity
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Mapping remote access sessions and ensuring routing through approved control points
• Monitoring remote session logs, authentication, and device health checks
• Alerting on unauthorized access attempts or misrouted sessions
• Documenting remote access routing for compliance and security audits
• Enforcing policy alignment with NIST 800-171 and CMMC Level 2 best practices
With Cuick Trac, remote access to CUI systems is controlled, visible, and verifiably secure.
Final CTA
Remote access should be a gateway—not a backdoor.
Schedule a Cuick Trac demo to secure and monitor all remote access to your CUI environment with confidence.