Skip to content
ControlVerdict
Sign in
AC.L2-3.1.13CMMC Level 2Level 2

Remote Access Confidentiality

Submit your own example

Practice statement

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.1.13.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    cryptographic mechanisms to protect the confidentiality of remote access sessions are identified; and

    1 example covers this

  2. [b]

    cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    AC.L2-3.1.13Remote Access Confidentiality
    Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

    • [a]

      cryptographic mechanisms to protect the confidentiality of remote access sessions are identified; and

    • [b]

      cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.

    TLS 1.2+ and approved ciphers on every remote access path

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Remote Access Confidentiality objectives.

    Identified mechanisms. Remote paths use TLS 1.2+ (SaaS/IdP) or IPsec/IKE suites approved on the crypto inventory (VPN). TLS 1.0/1.1 disabled on terminators.

    Implemented. VPN portal and gateways enforce the approved proposal. Published internal tools sit behind a reverse proxy with the same cipher policy; direct exposure is blocked.

    Maintenance. Quarterly cipher scan of external listeners. After appliance upgrades, re-validate proposals on a canary gateway.

    Accepted gap. A customer-mandated partner portal only offers older TLS. Staff use remote browser isolation from a PAW; no local client to that portal.

    What the evidence looks like

    • Crypto inventory entries for VPN and TLS terminators
    • VPN crypto proposal / portal TLS config
    • External TLS scan output
    • Partner portal RBI exception

    Environment

    SSO + GlobalProtect-class VPN; reverse proxies for any published internal tools.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.