NIST 800-53 REV 5 • ACCESS CONTROL
AC-17 — Remote Access
Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and Authorize each type of remote access to the system prior to allowing such connections.
Supplemental Guidance
Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of [CA-3](#ca-3) . Enforcing access restrictions for remote access is addressed via [AC-3](#ac-3).
Practitioner Notes
Remote access — VPN, RDP, SSH, cloud access — must be documented, authorized, and controlled. If someone can access your systems from outside the office, you need clear rules about who, how, and under what conditions.
Example 1: Document all authorized remote access methods in your SSP. Configure your VPN appliance (Cisco AnyConnect, Palo Alto GlobalProtect) to require certificate-based authentication plus MFA. Restrict VPN access to the AD security group VPN-Authorized-Users and review membership quarterly.
Example 2: In Azure AD Conditional Access, create a policy for remote access that requires compliant devices (enrolled in Intune, encryption enabled, AV running) and MFA. Block access from countries where your organization has no presence using the Named Locations feature.