NIST 800-171 3.1.15 (AC.L2-3.1.15): Privileged Remote Access

What 3.1.15 means in practice

Administrative commands and security settings may be used from outside the network only where that use has been specifically authorized. List which privileged commands and which security-relevant information may be reached remotely and by whom, and grant that access deliberately, often through a privileged access workstation or a jump host.

SPRS points and the CMMC POA&M

What an assessor checks for 3.1.15

NIST SP 800-171A gives 4 determination statements for 3.1.15, each found satisfied or other than satisfied. Determine if:

1. 3.1.15[a] privileged commands authorized for remote execution are identified.
2. 3.1.15[b] security-relevant information authorized to be accessed remotely is identified.
3. 3.1.15[c] the execution of the identified privileged commands via remote access is authorized.
4. 3.1.15[d] access to the identified security-relevant information via remote access is authorized.

NIST SP 800-171A (June 2018), assessment objectives for 3.1.15

Evidence that shows 3.1.15 is met

• A list of the privileged commands and security-relevant information approved for remote use.
• Authorization records for the administrators allowed to use them remotely.
• Configuration of the privileged access path, such as a jump host or a privileged access management tool, with its session logs.

How PolicyCortex gathers the evidence

No PolicyCortex collector reads the evidence for 3.1.15. Your team provides the evidence listed above.