Requirement text: AC.2.015: Route remote access via managed access control points.
DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Routing remote access through managed access control points enhances explicit,
organizational control over such connections, reducing the susceptibility to unauthorized
access to organizational systems resulting in the unauthorized disclosure of CUI.
CMMC CLARIFICATION
You can limit the number of remote access control points. This reduces the attack surface
for organizations. Route all remote access sessions through as few points as possible. This:
• allows for better visibility into the traffic coming into the network;
• simplifies network management; and
• increases the ability to monitor and control the connections.
Example
You are the IT administrator for a company with many locations. Several employees at
different locations need to connect to the network while working remotely. Each location
has its own connection to the internet. Since each company location has a direct connection
to headquarters, you decide to route all remote access through the headquarters location. All
remote traffic comes to one location. You have to monitor the traffic on only one device,
rather than one per location. The company will not have to buy as much equipment.
References
• NIST SP 800-171 Rev 1 3.1.14
• CIS Controls v7.1 15.5, 15.10
• NIST CSF v1.1 PR.AC-3, PR.PT-4
• CERT RMM v1.2 TM:SG2.SP2
• NIST SP 800-53 Rev 4 AC-17(3)