AO coverage. Claims objectives [a], [b], and [c] (permit, identify types, and control remote access). Objective [d] (monitor sessions) is only partially covered here: VPN connect/disconnect and failed auth are logged for all users; full session recording applies to privileged jump paths. Deep content monitoring for every standard remote user is out of scope for this example.

Paths.

1. Standard CUI user: SSO from a compliant, encrypted device; Conditional Access blocks unmanaged devices.
2. On-prem lab / file share: Full-tunnel VPN with device certificate + phishing-resistant user auth; split tunnel off for CUI routes.
3. Privileged remote admin: Must land on a PAW or brokered jump host; commands/sessions logged to SIEM; direct RDP from home PCs is blocked by network policy.

Session control. Idle VPN disconnect ≤ 12 hours with re-auth. Concurrent VPN sessions per user limited to 1 unless ticketed (contractors sometimes need 2).

Monitoring (partial for [d]). VPN connect/disconnect and failed auth stream to SIEM; alert on impossible travel and on privileged jump sessions outside change windows. Standard-user session content is not recorded.

Maintenance. Monthly review of VPN accounts with no use in 45 days (disable). Quarterly test that unmanaged device cannot obtain CUI SSO or VPN.

Accepted gap. A field tablet used at a customer site cannot join MDM. It uses a dedicated remote browser isolation session to a single allow-listed app; no local download. Exception renewed annually.

• Conditional Access + compliance policies
• VPN profile (tunnel type, cert auth, session limits)
• Network rules denying direct RDP from Internet
• Jump host session-log sample in SIEM
• Unmanaged-device deny test ticket