Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon

Browse

98 controls

03.01.12Remote accessITSP.10.171Access control

Official Requirement

A. Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access. B. Authorize each type of remote system access prior to establishing such connections. C. Route remote access to the system through authorized and managed access control points. D. Authorize remote execution of privileged commands and remote access to security-relevant information.

Source: Canadian Centre for Cyber Security ITSP.10.171 (2025), adapted from NIST SP 800-171 Rev. 3

In Plain English

Remote access (VPN, SSH, RDP, cloud console, etc.) must be formally authorized, documented, and routed through managed control points. Each type of remote access needs defined requirements. Privileged commands executed remotely require separate authorization. No direct remote access to systems that bypasses your access control infrastructure.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon
View in Map →

Help us build what matters.

Vote for the next framework, subscribe for updates, and let us know if you'd contribute.

Truvo CyberTruvo CyberBuilt and maintained by Truvo Cyber
Authors·Connect with us
Updated: Mar 22, 2026Reviewed: Mar 22, 2026v1.0.0
Share this tool

The Trust Services Criteria referenced in this tool are published by the American Institute of Certified Public Accountants (AICPA) and incorporate principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Criteria descriptions are reproduced for reference purposes. All implementation guidance, evidence recommendations, and control language are original work by Truvo Cyber. ISO 27001 and ISO 42001 are standards published by the International Organization for Standardization (ISO). Framework and standard names are the property of their respective owners. This tool is not affiliated with, endorsed by, or certified by AICPA, COSO, or ISO.

© 2026 Truvo Cyber. All rights reserved.

On-premises implementation and evidence

Managed remote access with authorized control points

Implementation steps

  1. Deploy a VPN concentrator as the single managed access control point for all remote access; prohibit direct RDP/SSH from the Internet
  2. Configure the VPN to require MFA and enforce split-tunneling policies as appropriate
  3. Use jump servers or bastion hosts for remote administrative access to servers and infrastructure
  4. Log all remote access sessions and review logs for unauthorized access or anomalous patterns

Tools / systems

Evidence artifacts

Evidence frequency: Continuous logging; quarterly authorization review