IAM-33—Remote Maintenance: Authentication Sessions

>Control Description

Vendor accounts used for remote access are enabled only during the time period needed, disabled when not in use, and monitored while in use.

Theme

Technology

Type

Preventive

Policy/Standard

Remote Access Procedure

>Implementation Guidance

1. Ensure that vendor accounts that are used for remote access, have the following configurations: -Enabled only for the time period needed -Disabled when not in use -Monitored when in use

>Testing Procedure

1. Validate that vendor accounts that are used for remote access, have the following configurations: -Enabled only for the time period needed -Disabled when not in use -Monitored when in use