CMMC Practice Requirement:

Monitor and control remote access sessions.

CMMC Requirement Explanation:

Allowing users to remotely access your system presents inherent risks. By requiring that they authenticate before connecting and by encrypting the connection you can reduce risk. By limiting which users and systems can remotely connect to your network you also reduce cyber risk. By enabling logging on your VPN you can monitor who and what is remotely accessing your network.

Example CMMC Implementation:

Encrypt your VPN connections. Only allow authorized users and devices to connect to your network via a VPN. Ensure that your VPN is configured to log which users and devices have connected to the VPN. Force your remote connections to pass through your intrusion detection system so that you can monitor the connection.


- Scenario 1:

John, an employee at your company is working from home. He logs into his company provided computer and then signs into the VPN via the client installed on his computer. His VPN connection is encrypted and passes through your intrusion detection system before entering your network.

Discover Our NIST SP 800-171 Solutions:


Compliance Accelerator

For contractors seeking compliance

Quantum Assessor

For IT service providers

Supply Chain Verifier

For contractors seeking to verify partner compliance