Authorize remote execution of privileged commands and remote access to security-relevant information
📖 What This Means
This control requires organizations to formally approve and document who can remotely execute high-level (privileged) commands or access sensitive security information from outside the network. Think of it like needing a signed permission slip before letting someone remotely control critical systems or view security logs. For example, an IT admin might need approval to reset passwords remotely, or a security analyst might require authorization to pull firewall logs from home. The goal is to prevent unauthorized changes or data leaks by ensuring only trusted personnel can perform these sensitive actions remotely.
🎯 Why It Matters
Uncontrolled remote privileged access is a top attack vector for data breaches. Attackers often exploit poorly managed remote access to escalate privileges and steal data. For example, the 2020 SolarWinds breach involved attackers gaining remote access to privileged accounts. The DoD specifically requires this control because CUI (Controlled Unclassified Information) must be protected from unauthorized remote access. A single compromised privileged account can cost organizations $4.5M on average (IBM Cost of a Data Breach 2023). This control mitigates insider threats and external attacks by ensuring accountability for sensitive remote actions.
✅ How to Implement
- 1. In AWS/Azure/GCP, create IAM policies that explicitly list which roles/users can perform privileged actions remotely (e.g., 'ec2:StopInstances' in AWS)
- 2. Enable Just-In-Time (JIT) access for privileged roles using tools like Azure PIM or AWS IAM Access Analyzer
- 3. Configure Conditional Access policies (Azure) or IAM Conditions (GCP) to require MFA and device compliance checks for remote privileged access
- 4. Use CloudTrail (AWS), Azure Activity Logs, or GCP Audit Logs to monitor all remote privileged commands
- 5. Document approval process for remote privileged access in your cloud security policy
📋 Evidence Examples
Remote Privileged Access Policy
Approved Access Request Forms
IAM Role Configuration Screenshot
Privileged Session Logs
MFA Configuration Screenshot
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For AC.L2-3.1.15 ("Authorize remote execution of privileged commands and remote access to security-relevant information"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how access to CUI systems is controlled, including the specific IAM tools, policies, and processes used. Reference your Access Control Policy and identify the systems in scope. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"AC.L2-3.1.15 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to authorize remote execution of privileged commands and remote access to security-.... The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"AC.L2-3.1.15 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to authorize remote execution of privileged commands and remote access to security-.... Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"AC.L2-3.1.15 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all access points to CUI systems (VPN, direct network, cloud portals)
- • Document which IAM system manages access (Azure AD, AWS IAM, on-prem AD)
- • Map user roles to system access levels
- • Ensure this control covers all systems within your defined CUI boundary where authorize remote execution of privileged commands and remote access to security-relevant information applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Access Control Policy
- 📄 IAM configuration documentation
- 📄 Access request and approval records
- 📄 Evidence artifacts specific to AC.L2-3.1.15
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will verify that access controls are implemented as described, test whether unauthorized users are blocked, and review access logs for evidence of enforcement.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do we have a documented policy that defines who can remotely execute privileged commands?
Question 2: Are all remote privileged access attempts logged with user, action, and timestamp?
Question 3: Is manager approval required before granting remote privileged access?
Question 4: Are privileged remote sessions automatically terminated after 30 minutes of inactivity?
Question 5: Do we review remote privileged access logs quarterly?
⚠️ Common Mistakes (What Auditors Flag)
1. Using shared admin accounts for remote access
2. Missing documentation of approval for specific individuals
3. Not logging the actual commands executed remotely
4. Allowing permanent remote privileged access
5. No separation between approval and execution roles
📚 Parent Policy
This practice is governed by the Access Control Policy