12.3.9 activation requirement: when should remote-access technologies be activated?

12.3.9 activation requirement: when should remote-access technologies be activated?

• A. Activation should occur only when needed by vendors and business partners, with immediate deactivation after use
• B. Activation must be continuous at all times
• C. Activation is optional
• D. Activation should be performed by end users on demand

Answer: (A)

Controlling when remote-access is activated for third parties and ensuring it is turned off as soon as it’s no longer needed is about minimizing the time window during which access to sensitive systems is possible. By enabling remote access only for vendors and business partners when they need to perform specific tasks and immediately deactivating it afterwards, you reduce the risk of unauthorized use, maintain tighter control, and uphold least-privilege and need-to-know principles. This approach also supports proper logging and monitoring of who accessed what and when, which is essential for accountability. Keeping remote access active at all times creates a persistent exposure that attackers could exploit. Making activation optional would allow inconsistent or skipped controls, undermining security. Letting end users initiate activation places the responsibility and risk on individuals without centralized governance and could lead to unmanaged, potentially insecure access.

Controlling when remote-access is activated for third parties and ensuring it is turned off as soon as it’s no longer needed is about minimizing the time window during which access to sensitive systems is possible. By enabling remote access only for vendors and business partners when they need to perform specific tasks and immediately deactivating it afterwards, you reduce the risk of unauthorized use, maintain tighter control, and uphold least-privilege and need-to-know principles. This approach also supports proper logging and monitoring of who accessed what and when, which is essential for accountability.

Keeping remote access active at all times creates a persistent exposure that attackers could exploit. Making activation optional would allow inconsistent or skipped controls, undermining security. Letting end users initiate activation places the responsibility and risk on individuals without centralized governance and could lead to unmanaged, potentially insecure access.