Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

ac-17(4)

remote access  | privileged commands / access

assessment objective:

Determine if the organization:

ac-17(4)(a)

ac-17(4)(a)[1]

defines needs to authorize the execution of privileged commands and access to security-relevant information via remote access;

ac-17(4)(a)[2]

authorizes the execution of privileged commands and access to security-relevant information via remote access only for organization-defined needs; and

ac-17(4)(b)    

documents the rationale for such access in the information system security plan.

potential assessment methods and objects:

Examine: [select from: Access control policy; procedures addressing remote access to the information system; information system configuration settings and associated documentation; security plan; information system audit records; other relevant documents or records].

Interview: [select from: System/network administrators; organizational personnel with information security responsibilities].

Test: [select from: Automated mechanisms implementing remote access management].