Remote maintenance shall only occur after prior approval, monitoring to avoid unauthorised access, and approval of the outcome of the maintenance activities as described in approved processes or procedures.
The organization shall require that diagnostic services pertaining to remote maintenance be performed from a system that implements a security capability comparable to the capability implemented on the equivalent organization's critical system.
The organization shall make sure that strong authenticators, record keeping, and session termination for remote maintenance is implemented.
Remote maintenance and repair of an organization's assets must be performed so that it is approved, logged, and performed in a manner that prevents unauthorized access. The person conducting the remote maintenance and repair must be required to perform multi-step authentication.
The organization shall ensure that the monitoring and management of remote connections is automated, that remote connections are encrypted to ensure their integrity and reliability, and that remote connections pass only through approved and managed Network Access Control (NAC).
The organization must also make possible for the remote connections to be closed within a specified time.
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
