AC-17(01) Monitoring and Control

Self-assessed, not audited

We hold no certification or authorization. The status below is our own assessment, kept as OSCAL in Git; it is not an auditor's finding. "Planned" means not built.

Control statement

Employ automated mechanisms to monitor and control remote access methods.

Guidance

Monitoring and control of remote access methods allows organizations to detect attacks and help ensure compliance with remote access policies by auditing the connection activities of remote users on a variety of system components, including servers, notebook computers, workstations, smart phones, and tablets. Audit logging for remote access is enforced by AU-2. Audit events are defined in AU-2a.

Implementation

Cloudflare Tunnel and WARP access

Monitoring of remote access sessions: Cloudflare keeps logs, but nothing collects or reviews them yet.

Status: planned.

All controls. Source: OSCAL component definition reti-platform and NIST SP 800-53 Rev 5 (public domain).