Mapped to NIST 800-171 Requirement: 3.13.8
CMMC Assessment Objective: SC.L2-3.13.8[b]
What This Control Means
After identifying encrypted remote sessions (SC.L2-3.13.8[a]), this objective ensures you record those details in your:
• System Security Plan (SSP)
• Remote Access Policy
• Network architecture diagrams
• Configuration management documentation
You must be able to show how, where, and with what technologies remote access to CUI systems is encrypted and protected.
Why It Matters
Without documentation:
• Assessors cannot verify your remote access protections
• Internal teams may unknowingly use unencrypted methods
• Monitoring remote access risks becomes extremely difficult
• Users may connect to CUI without triggering required controls
Proper documentation ensures remote access is intentional, secured, and monitored.
How to Implement It
1. Document All Remote Access Methods For each method, record:
• Tool or platform used (e.g., OpenVPN, Cisco AnyConnect, Microsoft RDP)
• Encryption protocol enforced (e.g., TLS 1.2+, IPsec, SSH)
• Authentication methods (e.g., MFA, certificates)
• Systems or networks accessed remotely
• Ownership and maintenance responsibility
2. Link to CUI Data Paths
• Show which remote access methods connect to systems containing CUI
3. Reference Security Standards
• Note compliance with NIST, FIPS 140-2/140-3, or other cryptographic standards
4. Update Regularly
• Capture new tools, clients, or access paths introduced through system changes
Evidence the Assessor Will Look For
• SSP entries describing encrypted remote access
• Remote Access Policy specifying encryption requirements
• Diagrams showing secure tunnels or gateways
• System or device settings screenshots enforcing encryption
• Audit trails of remote access connection types and encryption verification
Common Gaps
• Remote access used but not documented
• Encryption details missing from SSP or security policies
• Legacy remote access methods (e.g., unencrypted RDP) still allowed without documentation
• No defined owner for managing or reviewing remote access security
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Documenting every remote access method tied to CUI systems
• Tracking encryption settings, protocols, and compliance status
• Linking encrypted session documentation to system and user inventories
• Generating audit-ready records of secure remote access paths
• Alerting if undocumented or unauthorized remote access methods are detected
With Cuick Trac, your encrypted remote access methods are not only protected—they’re documented and verifiable.
Final CTA
Security isn’t complete until it’s captured on paper too.
Schedule a Cuick Trac demo to document your encrypted remote access sessions and maintain CMMC compliance.