Remote Access

Applies to. The term is defined by where the session starts: outside the entity's network. That covers staff working from home, an IT contractor supporting a server and a vendor maintaining a payment system, whatever technology they use to get in. 8.4.3 requires MFA for all remote access from outside the entity's network that could access or impact the CDE. 8.2.7 governs the accounts third parties use for remote access: enabled only for the period needed, disabled otherwise, and monitored for unexpected activity. 8.2.3 adds a rule for service providers that reach into customer premises: unique authentication factors for each customer. 3.4.2 adds that where remote-access technologies are used, technical controls must prevent copying or relocating PAN, except for personnel with documented authorisation and a defined business need.

Example. A payment-terminal service provider supports many merchant sites and connects to each site's back-office server remotely when a fault is logged. Under 8.2.3 it cannot use one shared credential across all sites; each site gets its own. Each merchant, for its part, enables the provider's account only while the ticket is open and checks the session log afterwards, which is what 8.2.7 asks of the merchant.

Limits. Remote access is narrower than non-console access. An administrator using SSH from a desk on the internal network is using non-console access but not remote access; the same session from home is both. The MFA in 8.4.3 is therefore not the whole MFA story: administrative access into the CDE has its own MFA rule in Requirement 8 regardless of where the session starts. Remote access is also not defined by the technology used: a VPN, a remote desktop gateway and a vendor's remote-support software are all remote access if the session originates outside the entity's network. And a site-to-site link between two networks the entity controls is not remote access at all.