Control Remote Access

Answer four questions in one policy.

Objective [a] asks whether remote access is permitted. Objective [b] asks which types: VPN, access to cloud services over the internet, vendor support sessions. Objective [c] asks how each is controlled: managed devices only, multifactor authentication, conditional access, device health checks at connection. Objective [d] asks how each is monitored: which logs exist, who reviews them, how often. That document, with the configurations and review records behind it, is the whole requirement.

Define what counts as remote in your environment and defend it in writing.

Whether an established VPN session from a company-owned laptop is still remote access has no settled answer among assessors. Take the durable position. The tunnel is a type of permitted remote access, so list it under [b], then control and monitor it. If you then treat traffic inside the established tunnel as internal, document that treatment and its rationale. The requirement's own discussion says encrypted VPNs do not make access non-remote. They let you treat the connection like an internal network once controlled.

Cloud access is remote access for this requirement.

Sessions to Microsoft 365 or any internet-reached service matter when those services hold CUI, the controlled unclassified information your contract requires you to protect. TLS, the standard encryption on web connections, plus conditional access policies requiring compliant devices are your [c]. The identity provider's sign-in logs and their review are your [d]. A fully cloud organization with no office still has types to identify under [b]: name the TLS access paths and the gateway or conditional access layer that fronts them.

Monitoring means a person looks at the logs.

Collection is not monitoring. Write the review procedure for VPN and sign-in logs. Run it at a frequency matched to your risk. Keep the artifacts: a ticket closing the review, an alert and its disposition, an email summarizing findings. An assessor asks for the procedure and then asks for proof it ran.

No CUI over the remote link does not scope this requirement out.

Remote access used for system maintenance is still remote access to an in-scope system, and the requirement applies. The only way to scope it out is to prevent remote access entirely and have the policy and configuration that prove it.