Remote Access AC-17

Access Control · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds AC-17 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-17 (Remote Access) covers how you authorize, monitor, and encrypt connections that reach the system from outside its boundary - SSH (Secure Shell), a VPN (Virtual Private Network), or an admin console. It carries from Low into Moderate, where remote sessions must ride encrypted channels routed through managed access points.

What good looks like

Authorize each type of remote access before it is allowed, and document what is permitted.
Require encrypted channels for every remote session - no cleartext administration.
Route remote access through a small number of managed access points rather than exposing every host.
Monitor and log remote sessions, and limit which privileged commands can run remotely.
Enforce session controls such as attempt caps and an idle timeout so a stray session cannot linger.

Framework mapping

NIST CSF 2.0 — PR.AA-05 — Access permissions and authorizations are managed, incorporating least privilege
CIS Controls v8 — Control 12.7 — Remote devices connect over a secure, authenticated channel

How to move it toward Implemented

This is met on VM 607: /etc/ssh/sshd_config.d/00-hardening.conf disables root login, turns off password auth in favor of keys, allows only BLUEADMIN, and caps attempts (MaxAuthTries 3, LoginGraceTime 20).
The required negative test - password login refused - proves the encrypted, key-only channel is actually enforced.
To reach 'Completed', attach the hardening config plus that negative-test result as asset-scoped evidence, naming AC-17 in the Requirement field.
To go further, add an idle timeout (ClientAliveInterval) and, in a real deployment, front admin access with a bastion to satisfy the managed-access-point intent of AC-17(3).