3.7.5

Requirement

Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.

Discussion

Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through an external network. The authentication techniques employed in the establishment of these nonlocal maintenance and diagnostic sessions reflect the network access requirements in 3.5.3.

NIST 800-171A Assessment Guidance

Examine

[SELECT FROM: System maintenance policy; procedures addressing nonlocal system maintenance; security plan; system design documentation; system configuration settings and associated documentation; maintenance records; diagnostic records; other relevant documents or records].
Interview

[SELECT FROM: Personnel with system maintenance responsibilities; personnel with information security responsibilities; system or network administrators].
Test

[select from: Organizational processes for managing nonlocal maintenance; mechanisms implementing, supporting, and managing nonlocal maintenance; mechanisms for strong authentication of nonlocal maintenance diagnostic sessions; mechanisms for terminating nonlocal maintenance sessions and network connections].

ID	Assessment Objectives
3.7.5[b]	Nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete.
3.7.5[a]	Multifactor authentication is required to establish nonlocal maintenance sessions via external network connections.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!