AC-17 Remote access
Requires each type of remote access to the system to be governed by documented usage restrictions, connection and configuration requirements and implementation guidance, and to be explicitly authorized before any remote
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- VPN or remote gateway configuration showing the required settings in force · Identity provider / directory
periodic reviewEvidence produced at each review
- Authorization records approving each remote access method before use · Identity provider / directory
governing documentDocuments that govern the control
- Remote access standard listing each permitted access type and its restrictions · Policy repository / GRC workspace
- Inventory of remote access paths including vendor and administrative routes · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Vendor support tools provide a remote path that was never authorized as a remote access type
- Restrictions written for the VPN only, while remote desktop and cloud consoles go untreated
- No record of authorization, only the technical fact that the method works
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAC-16 Security and Privacy Attributes. Provide the means to associate [organization-defined] with [organization-defined] for information in storage, in process, and/or in transmission; Ensure that the attribute associations are made and retained with the information; Establish · AC-18 Wireless access