NIST 800-171 R3 03.01.12 Remote Access at a Glance
- Family: 03.01 Access Control (AC)
- Requirement ID: 03.01.12 Remote Access
- Assessment Objectives (AOs): Nine (9) determination statements
- Organization-Defined Parameters (ODPs): None (0). This requirement contains no organization-defined values
- Source NIST 800-53 R5 Controls: AC-17, AC-17(03), AC-17(04)
- NIST 800-171 R3 Kill Chain Phase: Phase 17, Layered Network Defenses
Remote Access governs how users reach your system from outside your network, and in R3 it is a consolidation point rather than a single narrow control. Where Account Management (03.01.01) and Access Enforcement (03.01.02) decide who gets in and how authorizations apply, Remote Access (03.01.12) sets the rules for connections that come in over external networks like the internet. It does four things: establish usage, configuration, and connection requirements for each type of allowable remote access, authorize each type before connections are established, route remote access through authorized and managed access control points, and authorize the remote execution of privileged commands and remote access to security-relevant information. Per the NIST discussion, routing remote access through managed access control points reduces the risk of unauthorized access that could lead to unauthorized disclosure of Controlled Unclassified Information (CUI).
A common difficulty with this requirement is treating it as the same "monitor remote sessions" control they met in R2. R3 folded several separate R2 remote access requirements into this one and added new authorization objectives. The result is a heavier lift than the single requirement number suggests, with net-new work around authorizing each access type, routing through authorized control points, and explicitly authorizing privileged commands and security-relevant information over remote connections.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
- The National Institute of Standards and Technology (NIST) withdrew R2 on May 14, 2024, the same day R3 was published. The withdrawal notice states that R2 "has been withdrawn (archived), and is provided solely for historical purposes," so it will never receive another correction or clarification from NIST.
- R2 remains the contractual standard for the Department of Defense (DoD) and the Defense Industrial Base (DIB). Cybersecurity Maturity Model Certification (CMMC) assessments reference it directly: per Title 32 of the Code of Federal Regulations (CFR), section 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."
- The rulemaking points the other direction. The proposed Controlled Unclassified Information (CUI) rule for the Federal Acquisition Regulation (FAR), published June 23, 2026 as part of the Revolutionary FAR Overhaul, would apply CUI safeguarding requirements government wide rather than only to DoD contracts, and it sets the baseline at R3. That rule is not final, and DoD has separately signaled an interim rule to move CMMC to R3.
What Does NIST 800-171 R3 03.01.12 Actually Require?
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.01.12 Remote Access. Only the formatting has been adjusted for readability. This requirement has four (4) lettered parts:
- a. Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access.
- b. Authorize each type of remote system access prior to establishing such connections.
- c. Route remote access to the system through authorized and managed access control points.
- d. Authorize the remote execution of privileged commands and remote access to security-relevant information.
The source controls are AC-17, AC-17(03), and AC-17(04) from NIST 800-53. There are no Organization-Defined Parameters (ODPs). Per the NIST discussion, monitoring and controlling remote access lets organizations detect attacks and enforce remote access policies, and restricting the remote execution of privileged commands and remote access to security-relevant information reduces exposure to adversaries. You can read the requirement directly at NIST 800-171 R3, 03.01.12 (p. 14).
What Are the Organization-Defined Parameters (ODPs) Associated with NIST 800-171 R3 03.01.12?
None (0). Requirement 03.01.12 contains no bracketed assignment, so there is no organization-defined value to select and nothing for the DoD to specify. The requirement applies as written.
Your System Security Plan (SSP) narrative for 03.01.12 therefore records how the requirement is implemented rather than a parameter you chose.
What Are the Assessment Objectives (AOs) For NIST 800-171 R3 03.01.12?
NIST 800-171A R3 breaks 03.01.12 into nine (9) determination statements, and it has no Organization-Defined Parameters (ODPs). These AOs are:
- A.03.01.12.a[01]: types of allowable remote system access are defined.
- A.03.01.12.a[02]: usage restrictions are established for each type of allowable remote system access.
- A.03.01.12.a[03]: configuration requirements are established for each type of allowable remote system access.
- A.03.01.12.a[04]: connection requirements are established for each type of allowable remote system access.
- A.03.01.12.b: each type of remote system access is authorized prior to establishing such connections.
- A.03.01.12.c[01]: remote access to the system is routed through authorized access control points.
- A.03.01.12.c[02]: remote access to the system is routed through managed access control points.
- A.03.01.12.d[1]: remote execution of privileged commands is authorized.
- A.03.01.12.d[2]: remote access to security-relevant information is authorized.
The nine (9) objectives decompose the four requirement parts into separately assessed facts. Note that part a becomes four (4) AOs (define the types, then establish usage, configuration, and connection requirements for each), part c splits into authorized control points and managed control points, and part d splits into privileged commands and security-relevant information. Each carries its own evidence. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.01.12 (p. 17).
Assessment Methods and Objects for NIST 800-171 R3 03.01.12
Examine: access control policy and procedures; procedures for remote system access; remote system access configuration and connection requirements; configuration management plan; system configuration settings; remote access authorizations; system audit records; system design documentation; procedures for remote access to the system; system monitoring records; list of managed network access control points; system security plan.
Interview: personnel with responsibilities for managing remote access connections; personnel with information security responsibilities; system administrators.
Test: mechanisms for monitoring and controlling remote access methods; mechanisms for routing remote accesses through managed access control points; remote access management capability for the system.
How Does NIST 800-171 R3 03.01.12 Map From NIST 800-171 R2?
03.01.12 maps from NIST 800-171 R2 requirement 3.1.12 (monitor and control remote access sessions), and it also absorbs elements of the R2 requirements that used to sit beside it: 3.1.13 (cryptographic protection of remote access), 3.1.14 (route remote access through managed access control points), and 3.1.15 (authorize remote execution of privileged commands and remote access to security-relevant information):
- A.03.01.12.a[01] and A.03.01.12.c[02] map directly to elements of R2 3.1.12 and 3.1.14.
- A.03.01.12.a[02] and A.03.01.12.a[03] map indirectly to elements of R2 3.1.12, 3.1.13, and 3.1.15.
- A.03.01.12.b, A.03.01.12.c[01], A.03.01.12.d[1], and A.03.01.12.d[2] are net new for R3.
- A.03.01.12.a[04] has no clear mapping to any R2 AO.
Mapped against the nine (9) AOs, two (2) are direct (minimal effort), two (2) are indirect (moderate effort), four (4) are net new, and one (1) has no clear mapping, with the last two (2) categories both counting as significant effort. This is one of the heavier transitions in the family. Do not treat it as the R2 "monitor remote sessions" control with a new number. R3 pulled four R2 remote access requirements together and then added explicit authorization objectives, so five of the nine (9) objectives are significant effort.
How Does NIST 800-171 R3 03.01.12 Map to NIST 800-53 R5 and the SCF?
Source Controls in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.01.12 through the following SCF controls:
- AST-34 Jump Server
- CFG-04 Secure Baseline Configurations
- HRS-06.1 Rules of Behavior
- HRS-06.3 Technology Use Restrictions
- IAC-06 Role-Based Access Control (RBAC)
- MNT-12 Remote Maintenance
- NET-02 Network Security Controls (NSC)
- NET-03 Boundary Protection
- NET-26 Remote Access
- NET-26.1 Remote Access Pathways
- NET-26.4 Remote Access Monitoring & Control
- NET-26.5 Remote Access Cryptographic Protections
- NET-26.6 Remote Access Privileged Commands & Sensitive Data Access
- NET-27 Work From Anywhere (WFA) - Telecommuting Security
- SEA-04 Alignment With Enterprise Architecture
- SEA-05 Secure Engineering Principles
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
Common Pitfalls with NIST 800-171 R3 03.01.12
The following are issues teams may encounter rather than certainties. They are about the new authorization objectives and the consolidation, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
- Authorize each access type before connection. A.03.01.12.b is net new. You need evidence that each type of remote access was authorized before connections were allowed, not just that remote access is monitored.
- Two properties for access control points. A.03.01.12.c[01] (authorized) and A.03.01.12.c[02] (managed) are separate objectives. Routing through a managed point that was never authorized, or an authorized point that is not managed, leaves a gap.
- Privileged commands and security-relevant information are called out. A.03.01.12.d[1] and A.03.01.12.d[2] are net new and separate. Remotely running privileged commands and remotely reaching security-relevant information each require explicit authorization.
- Define the types first. A.03.01.12.a[01] requires you to define the types of allowable remote access, and the usage, configuration, and connection requirements attach to those types. Connection requirements (a[04]) have no clear R2 predecessor, so expect to build that from scratch.
What Is Reasonable Evidence For NIST 800-171 R3 03.01.12?
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.01.12 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.01.12 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
- E-AST-12 Secure Baseline Configurations Reviews. A review process to ensure secure baseline configurations (sbc) are current and applicable (e.g., system configuration settings and associated documentation).
- E-AST-13 Secure Baseline Configurations - Cloud-Based Services. Secure baseline configurations for all deployed types of cloud-based services or applications.
- E-AST-14 Secure Baseline Configurations - Databases. Secure baseline configurations for all deployed types of databases.
- E-AST-15 Secure Baseline Configurations - Embedded Technologies. Secure baseline configurations for all deployed types of embedded technologies.
- E-AST-16 Secure Baseline Configurations - Major Applications. Secure baseline configurations for all deployed types of major applications.
- E-AST-17 Secure Baseline Configurations - Minor Applications. Secure baseline configurations for all deployed types of minor applications.
- E-AST-18 Secure Baseline Configurations - Mobile Devices. Secure baseline configurations for all deployed types of mobile devices.
- E-AST-19 Secure Baseline Configurations - Network Devices. Secure baseline configurations for all deployed types of network devices.
- E-AST-20 Secure Baseline Configurations - Server Class Systems. Secure baseline configurations for all deployed types of server-class operating systems.
- E-AST-21 Secure Baseline Configurations - Workstation Class Systems. Secure baseline configurations for all deployed types of workstation-class operating systems.
- E-HRS-22 Rules of Behavior. Personnel management practices to define "acceptable use" or "rules of behavior" criteria that specify acceptable and unacceptable user behaviors.
- E-IAC-02 Defined Roles & Authorizations (RBAC). Defined access control-specific roles (e.g., role based access control (rbac)) that affect both logical and physical access authorizations.
- E-IAC-14 Remote Access Authorizations. Authorization for users to connect via remote access methods.
- E-MNT-06 Remote Maintenance Records. Remote maintenance sessions, including pre-approval, notification, cryptographic protection, disconnect verification and audit records.
- E-NET-03 Work From Anywhere (WFA) Guidance (remote workers). Administrative and technical measures that are enforced at "alternate work sites" which includes working from home or working while traveling on business.
- E-NET-04 Network Security Controls (NSC). The organization's network security controls (e.g., boundary protections, content filtering, wireless infrastructure, etc.).
- E-NET-07 External System Accessibility. A list of technology assets, applications and/or services (taas) accessible from third-party entities.
- E-NET-08 Internal Boundaries. Key internal boundaries.
- E-NET-09 Network Access Control Points. Network access control points.
- E-SEA-02 Security Architecture. Security architecture-related documentation.
- E-TDA-02 Secure Engineering & Data Privacy (SEDP). A secure engineering & data privacy (sedp) program. this is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.
- E-TDA-08 Secure Engineering Principles (SEP). Defined secure engineering principles used to ensure sensitivity, integrity, availability & safety (cias) concerns are properly addressed in the design and implementation of technology assets, applications and/or services (taas).
- E-TDA-09 Security Architecture View. Documented evidence that identifies security-relevant system elements and their interfaces: • define security context, domains, boundaries, and external interfaces of the system; • align the architecture with (a) the system security objectives and requirements, (b) security design characteristics; and • establish traceability of architecture elements to user and system security requirements.
Alongside these, keep the System Security Plan (SSP) narrative for 03.01.12.
Timeline Considerations for NIST 800-171 R3 03.01.12
With five (5) of the nine (9) AOs at significant effort (four net new and one with no clear mapping), 03.01.12 deserves real transition time. A realistic sequence:
- Define the types of allowable remote access (A.03.01.12.a[01]).
- Establish usage, configuration, and connection requirements for each type (A.03.01.12.a[02] through a[04]), building the connection requirements that have no R2 predecessor.
- Authorize each type of remote access before connections are established (A.03.01.12.b), the net-new authorization objective.
- Route remote access through access control points that are both authorized and managed (A.03.01.12.c[01] and c[02]).
- Authorize the remote execution of privileged commands and remote access to security-relevant information (A.03.01.12.d[1] and d[2]).
- Collect evidence for all nine (9) AOs, keeping the per-type requirements, the authorizations, the routing, and the privileged-command controls distinct.
Frequently Asked Questions About NIST 800-171 R3 03.01.12
How many assessment objectives does NIST 800-171 R3 03.01.12 have? NIST 800-171A R3 breaks 03.01.12 into nine (9) assessment objectives. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 controls does NIST 800-171 R3 03.01.12 come from? AC-17, AC-17(03), AC-17(04).
How many Organization-Defined Parameters (ODPs) does NIST 800-171 R3 03.01.12 have? None (0). The requirement contains no bracketed assignment, so there is no organization-defined value and nothing for the DoD to specify.
Where does NIST 800-171 R3 03.01.12 sit in the NIST 800-171 R3 Kill Chain? Phase 17, Layered Network Defenses. The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
Bottom Line on NIST 800-171 R3 03.01.12
03.01.12 Remote Access sets the usage, configuration, and connection rules for remote access, authorizes each type before connection, routes it through authorized and managed control points, and authorizes remote privileged commands and access to security-relevant information. It maps from R2 3.1.12 but absorbs 3.1.13, 3.1.14, and 3.1.15, and five of its nine (9) assessment objectives are significant effort because they are net new or lack a clear R2 mapping. The recurring problem is treating it as the old "monitor remote sessions" control. Define your remote access types, authorize each one, route through authorized and managed control points, and explicitly authorize remote privileged commands and security-relevant information.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
