What are the requirements for remote access to CUI systems?

• A. Remote access must use secure channels, MFA, least privilege, and monitoring.
• B. Remote access can be approved with a single password.
• C. Remote access should be disabled for all users.
• D. Remote access requires only IP whitelisting.

Answer: (A)

Remote access to CUI systems must be protected by multiple, complementary controls that guard both the path and the person using it. Using secure channels means all data in transit is encrypted and protected from eavesdropping or tampering, typically via VPNs or encrypted connections with strong protocols. Multi-factor authentication adds a second form of verification beyond a password, so even if credentials are stolen, an attacker can’t gain access without the additional factor. Enforcing least privilege limits each user to only what is necessary for their role, reducing the potential impact of any compromised account. Ongoing monitoring and auditing of remote sessions provide visibility, detect unusual activity, and support rapid response to incidents. These elements together create a defense-in-depth approach that is considered essential for safeguarding CUI when remote access is permitted. In contrast, relying on a single password is insufficient, completely disabling remote access is impractical for many workflows, and IP whitelisting alone does not address authentication, authorization, or ongoing monitoring.