AC.L2-3.1.15
Privileged Remote Access
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.15 in the reference catalog with its NIST cross-references
Official requirement
Authorize remote execution of privileged commands and remote access to security-relevant information.
Assessment objectives
a. privileged commands authorized for remote execution are identified;
b. security-relevant information authorized to be accessed remotely is identified;
c. the execution of the identified privileged commands via remote access is authorized; and
d. access to the identified security-relevant information via remote access is authorized.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Authorize remote privileged commands and remote access to security-relevant information.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your company’s Access Control Policy permits certain work roles to remotely perform a limited set of privileged commands from company -owned computers [a] . You implement controls to enforce who can remotely execute a privileged command , which privileged commands they can execute, and who is allowed access to security relevant information such as audit log configuration settings [a,c,d].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing remote access to the system; system configuration settings and associated documentation; system security plan; system audit logs and records; other relevant documents or records
Common mistakes
Approving general remote access without considering privileged remote activity separately.