Remote Access Policy
Remote Access Policy
Section titled “Remote Access Policy”Authorized By: Chief Information Security Officer (CISO)
Purpose/Overview
Section titled “Purpose/Overview”Remote access to the corporate network is essential for productivity but introduces significant risk. The purpose of this policy is to define the rules and requirements for connecting to Safire’s network from any external host. These measures are intended to minimize the risk of unauthorized access and protect Safire from potential harm, including the loss or exposure of Controlled Unclassified Information (CUI).
This policy applies to all employees, contractors, and vendors utilizing remote access technologies (e.g., VPN, Virtual Desktop, Cloud Portals) to connect to Safire’s network. It applies to company-owned devices and any approved personal devices.
Policy
Section titled “Policy”Authorization and Governance
Section titled “Authorization and Governance”- Privilege: Remote access is a privilege, not a right. It may be revoked at any time for non-compliance or security concerns.
- Managed Access Points: All remote access must be routed through managed, monitored access points (e.g., VPN Concentrators, SASE gateways) approved by IT. Backdoor or unmanaged remote access methods are strictly prohibited.
Technical Requirements (NIST 800-171)
Section titled “Technical Requirements (NIST 800-171)”To comply with CMMC standards, all remote connections must adhere to the following:
- Multi-Factor Authentication (MFA): MFA is mandatory for all remote access sessions (NIST 3.5.3). No exceptions.
- FIPS Encryption: Remote access mechanisms (VPNs) must use FIPS 140-2 (or higher) validated cryptographic modules to protect the confidentiality of the session (NIST 3.13.11).
- No Split Tunneling: Split tunneling is prohibited (NIST 3.13.7). All network traffic from the remote device must be routed through the Safire security gateway to ensure traffic inspection and filtering.
- Session Timeouts: Remote sessions must automatically disconnect after a defined period of inactivity (e.g., 30 minutes) (NIST 3.1.11).
Device Requirements
Section titled “Device Requirements”- Company-Owned Devices: Remote access should primarily be conducted via Safire-issued, managed laptops containing corporate EDR (Endpoint Detection and Response) and patch management agents.
- Personal Devices (BYOD): Personal devices are prohibited from establishing a full network VPN connection unless they are enrolled in the company’s Mobile Device Management (MDM) system and meet all security baselines (Patched OS, Antivirus, Encryption).
- Alternative: Unmanaged personal devices may only access resources via a secure Virtual Desktop Infrastructure (VDI) or web portal where data does not reside on the local device.
User Responsibilities
Section titled “User Responsibilities”- Credential Protection: Authorized Users must protect their login credentials and MFA tokens. Accessing the network from public kiosks or shared computers is prohibited.
- Physical Security: Users must ensure that their remote screen cannot be viewed by unauthorized persons (e.g., family members, strangers in coffee shops) while processing CUI.
- Reporting: Users must immediately report any suspicion of compromised credentials or lost devices to the IT Helpdesk.
Compliance
Section titled “Compliance”Compliance Measurement
Section titled “Compliance Measurement”The policy owner will verify compliance through VPN logs, firewall traffic analysis, and configuration audits of remote access gateways. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.
Exceptions
Section titled “Exceptions”Any exceptions must be approved by the Policy Owner in advance.
Non-Compliance
Section titled “Non-Compliance”An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
Related Standards, Policies, Plans, and Procedures
Section titled “Related Standards, Policies, Plans, and Procedures”- Access Control Policy
- Identification and Authentication Policy
- Acceptable Use Policy
- Mobile Device Management (MDM) Policy
Referenced Terms
- CUI
- Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.
Revision History
- 2026-08-20 — Darren Rush
- Merge pull request #2 from safire-dev/dev (
16cb681)