03.01.12 Remote Access

This policy outlines the requirements for secure remote access to systems and data within the organization. It covers the establishment, authorization, and management of remote access connections, including restrictions, configurations, and security controls to protect sensitive information. This policy applies to all personnel, contractors, and third-party users who require remote access to organizational systems.

• A.03.01.12.a[01]: types of allowable remote system access are defined.
• A.03.01.12.a[02]: usage restrictions are established for each type of allowable remote system access.
• A.03.01.12.a[03]: configuration requirements are established for each type of allowable remote system access.
• A.03.01.12.a[04]: connection requirements are established for each type of allowable remote system access.
• A.03.01.12.b: each type of remote system access is authorized prior to establishing such connections.
• A.03.01.12.c[01]: remote access to the system is routed through authorized access control points.
• A.03.01.12.c[02]: remote access to the system is routed through managed access control points.
• A.03.01.12.d[1]: remote execution of privileged commands is authorized.
• A.03.01.12.d[2]: remote access to security-relevant information is authorized.