3.7.5

Require multifactor authentication to establish non-local maintenance sessions via external network connections and terminate such connections when non-local maintenance is complete.

DISCUSSION

Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through an external network. The authentication techniques employed in the establishment of these non-local maintenance and diagnostic sessions reflect the network access requirements in 3.5.3.

ASSESSMENT OBJECTIVE

Determine if:

3.7.5[a] multifactor authentication is used to establish non-local maintenance sessions via external network connections.

3.7.5[b] non-local maintenance sessions established via external network connections are terminated when non-local maintenance is complete.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: System maintenance policy; procedures addressing non-local system maintenance; system security plan; system design documentation; system configuration settings and associated documentation; maintenance records; diagnostic records; other relevant documents or records].

Interview: [SELECT FROM: Personnel with system maintenance responsibilities; personnel with information security responsibilities; system or network administrators].

Test: [SELECT FROM: Organizational processes for managing non-local maintenance; mechanisms implementing, supporting, and managing non-local maintenance; mechanisms for strong authentication of non-local maintenance diagnostic sessions; mechanisms for terminating non-local maintenance sessions and network connections].