CCI-000063

Implementation Guidance

The organization being inspected/assessed defines and documents the allowed methods of remote access to the information system. The methods should be defined IAW ports, protocols, and service requirements, as well as access control requirements for any STIGs applicable to the technology in use. DoD has determined the allowed methods of remote access are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented methods to ensure the organization being inspected/assessed defines allowed methods of remote access to the information system. DoD has determined the allowed methods of remote access are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated access control policy 2.) Sampling of individuals that have received remote-access training 3.) Signed user agreements pertaining to remote access 3.) Documents that outline how both users and administrators will gain access, including network diagram that identifies remote-access capability.