Non-console Access

Applies to. Three controls hang on this term. 2.2.7 requires all non-console administrative access to be encrypted with strong cryptography, which is why Telnet and plain HTTP management pages are out for administering in-scope systems. 8.4.1 requires MFA for non-console access into the CDE by personnel with administrative access, and 8.4.2 extends MFA to all non-console access into the CDE, from inside the network as well as from outside. The term covers every network path to a management interface: SSH, remote desktop, web administration pages, vendor management protocols and hypervisor consoles reached over the network.

Example. A merchant's network administrator manages the CDE firewall from a workstation on the office LAN, over SSH, with a password and a one-time code. Nothing about that session is remote access, since it never leaves the entity's network, but it is non-console administrative access into the CDE: the SSH encryption meets 2.2.7 and the second factor meets 8.4.1 and 8.4.2. If the same firewall also accepted Telnet from the LAN, that path would fail 2.2.7 even though it is internal.

Limits. Non-console is not a synonym for remote. Remote access is the subset of sessions that start outside the entity's network; non-console access includes those and every internal network session too. Console access, the other side of the line, means a keyboard and screen or serial cable physically attached to the system. A KVM-over-IP device or a hypervisor's virtual console served through a web page is non-console access, whatever the vendor calls it. The encryption rule is about administrative sessions; ordinary users connecting to an application are governed by other controls.