Access Control 3.1.12 (3.1.12)

Do any employees, contractors, or administrators access your systems remotely from outside your physical office?

What methods do people use to connect remotely (VPN, remote desktop, web portal, direct internet access)?

Does this control require monitoring of user activities during remote sessions, or just logging connections and disconnections?

The control requires both. 'Monitor and control' implies visibility into active sessions and the ability to detect policy violations or threats during sessions, not just at connection time. While logging connections is necessary, organizations should also monitor for suspicious activities during sessions, such as unusual data access, privilege escalation, or policy violations. The level of session activity monitoring may vary based on risk, with privileged sessions typically requiring more detailed monitoring.

If we use a VPN with strong encryption, do we still need to monitor remote access sessions?

Yes. While VPNs provide confidentiality for data in transit, this control specifically requires monitoring and controlling the sessions themselves. The supplemental guidance acknowledges that encrypted VPNs may allow treating connections as internal networks for some purposes, but monitoring requirements still apply. You must log who connects, when, from where, and have the ability to detect and respond to unauthorized or suspicious remote access regardless of encryption.

What is the difference between monitoring remote access sessions and monitoring the network for malicious code?

These are separate but related activities. This control (AC-12) focuses on monitoring who is accessing systems remotely, ensuring sessions comply with policies, and maintaining the ability to terminate sessions. Network monitoring for malicious code (SI-4, SI-3) focuses on detecting threats in network traffic. The supplemental guidance notes that VPN encryption can make malware detection more difficult, which is why both types of monitoring are important and may require different technical approaches.

How frequently must remote access logs be reviewed to satisfy this control?

The control does not specify a particular frequency, but 'monitor' implies ongoing or regular review, not sporadic or ad-hoc checks. The appropriate frequency depends on your risk profile, volume of remote access, and available resources. Many organizations review logs daily or weekly, with automated alerting for high-risk events enabling real-time response. During assessment, you must demonstrate that reviews occur regularly, are documented, and are sufficient to detect unauthorized access or policy violations in a timeframe appropriate to your risk.

Does this control apply to employees accessing cloud applications like Microsoft 365 from home?

Yes, if those cloud applications are in your CMMC scope and contain CUI. Remote access includes any access from external networks, regardless of whether you own the infrastructure. You must monitor who accesses cloud systems containing CUI, from where, and when. This may require implementing a CASB, using cloud-native monitoring tools, or obtaining monitoring evidence from your cloud service provider. The key is demonstrating visibility and control over remote access to CUI, regardless of where systems are hosted.

Can we satisfy this control by reviewing VPN logs once per month?

Monthly review alone is likely insufficient to satisfy the 'monitor' requirement, which implies more frequent or continuous oversight. While monthly reviews may be part of your process, you should also have real-time or near-real-time alerting for high-risk events (failed authentication attempts, unusual access patterns, privileged access). The combination of automated alerting and regular log review demonstrates active monitoring. An assessor will evaluate whether your monitoring frequency is adequate to detect and respond to threats and policy violations in a reasonable timeframe.