Control 3.1.15

★What This Means in Plain English

Running admin commands or accessing sensitive security data from a remote location requires specific authorization. Organizations must define who can perform privileged operations remotely and under what conditions.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• Microsoft Entra PIM requiring explicit role activation before remote admin operations
• Privileged Access Workstations (PAWs) required for all remote administrative actions
• Arctic Wolf SIEM logging all remote privileged command execution with alerting
• FortiGate VPN policies restricting admin-level access to specific authorized source IPs
• ComplianceArmor documenting all personnel authorized for remote privileged access

🔎Assessment Guidance

Assessors will verify that remote privileged access requires specific authorization, test that only approved individuals can execute privileged commands remotely, review logs of remote admin sessions, and confirm documentation of authorized remote admin users.

⚠Common Implementation Gaps

• No distinction between remote standard and privileged access
• Privileged commands executable from any remote location
• No logging of remote privileged command execution
• Lack of policy defining who may remotely administer systems
• VPN providing unrestricted access to admin interfaces

⇄Cross-Framework Mapping