AC-17—Remote Access
>Control Description
Ever more frequently, supply chains are accessed remotely. Whether for the purpose of development, maintenance, or the operation of information systems, enterprises should implement secure remote access mechanisms and allow remote access only to vetted personnel. Remote access to an enterprise’s supply chain (including distributed software development environments) should be
limited to the enterprise or contractor personnel and only if and as required to perform their tasks. Remote access requirements – such using a secure VPN, employing multi-factor authentication, or limiting access to specified business hours or from specified geographic locations – must be properly defined in agreements. Enterprises should require their prime contractors to implement this control and flow down this requirement to relevant sub-tier contractors. Departments and agencies should refer to Appendix F to
implement this guidance in accordance with Executive Order 14028, Improving the Nation’s Cybersecurity
>Cross-Framework Mappings
Ask AI
Configure your API key to use AI features.