AC.L2-3.1.13
Remote Access Confidentiality
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.13 in the reference catalog with its NIST cross-references
Official requirement
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
Assessment objectives
a. cryptographic mechanisms to protect the confidentiality of remote access sessions are identified; and
b. cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Protect the confidentiality of remote-access sessions using cryptography.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are responsible for implementing a remote network access capability for users who access CUI remotely. In order to provide session confidentiality, you decide to implement a VPN mechanism and select a product that has completed FIPS 140 validation [a,b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing remote access to the system; system security plan; system design documentation; system configuration settings and associated documentation; cryptographic mechanisms and associated configuration documentation; system audit logs and records; other relevant documents or records
Common mistakes
Assuming remote access is encrypted without checking the configured protocol and path.