AC.L2-3.1.14
Remote Access Routing
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.14 in the reference catalog with its NIST cross-references
Official requirement
Route remote access via managed access control points.
Assessment objectives
a. managed access control points are identified and implemented; and
b. remote access is routed through managed network access control points.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Route remote access through managed access-control points.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You manage systems for a company that processes CUI at multiple locations, and several employees at different locations need to connect to the organization’ s networks while working remotely. Because each company location has a direct connection to headquarters, you decide to route all remote access through the headquarters location [a]. All remote traffic is routed through a single location to simplify monitoring [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing re mote access to the system; system security plan; system design documentation; list of all managed network access control points; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records
Common mistakes
Allowing direct remote connections that bypass the managed gateway.