Nonlocal Maintenance

Nonlocal maintenance is someone fixing your systems across an external network connection.

Your MSP, the managed service provider that runs IT for you, remoting into a server is nonlocal maintenance. So is a firewall vendor connecting to the management interface, and so are you administering the environment from home. The two objectives are simple: the session starts with multifactor authentication, a second proof of identity beyond the password [a], and ends when the work does [b].

Put the multifactor challenge on the path the maintenance rides.

A VPN, an encrypted connection into your network, satisfies [a] when it requires multifactor authentication. So does a remote access tool that enforces it, or an administrative portal behind conditional access in Microsoft Entra ID, sign-in rules that check the user and device. What fails is a management port reachable from the internet with a password alone.

Get the MSP's multifactor story in writing.

When an external provider maintains your systems through its own tooling, its technicians' authentication into that tooling is your [a] evidence. Require it in the service agreement. Capture it in the provider's responsibility matrix, the document that splits security duties between you, so the assessor sees whose control it is and how it is met.

Terminate means the session closes when the work is finished.

Log out and disconnect at the end of each session, and back the habit with idle timeouts in the remote access tool so an abandoned session closes itself. The termination settings plus a sampled session log answer [b].

A persistent management connection needs a deliberate answer.

Remote monitoring and management platforms hold a standing connection that is never complete in the requirement's sense. Document the platform as part of the system, put multifactor authentication on its console, and terminate operator sessions rather than the agent connection. Write that reading into your system security plan, the document that says how each requirement is met, so the assessor is not left to invent one.