AC.L2-3.1.13 Remote Access Confidentiality
Apply cryptographic protection to remote access sessions so session confidentiality is preserved in transit.
3
artefacts
1
held by a system
2
at each review
moderate
to go live
Key management / PKI
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Remote access encryption configuration showing protocol and cipher settings · Key management / PKI
periodic reviewEvidence produced at each review
- Evidence that weak or plaintext remote protocols are disabled · Identity provider / directory
- Certificate or key management records for the remote access service · Key management / PKI
governing documentDocuments that govern the control
none for this control
First move
Start with the 1 of 3 artefacts that already live in a system (Key management / PKI); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Legacy plaintext protocols still enabled as fallback
- Encryption terminated at an intermediary leaving segments in clear
- Cipher suites unreviewed and outdated
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAC.L2-3.1.12 Control Remote Access · AC.L2-3.1.14 Remote Access Routing