# CMMC 2.0 AC.2.015 Route remote access via managed access control points.

- Source: https://support.icompaas.com/support/solutions/articles/62000229415-cmmc-2-0-ac-2-015-route-remote-access-via-managed-access-control-points-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CMMC](https://support.icompaas.com/support/solutions/62000112530) › [2.0](https://support.icompaas.com/support/solutions/folders/62000168778)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Level 2**

  

**Description:**

Routing remote access through managed access control points enhances explicit, organizational control over such connections, reducing the susceptibility to unauthorized access to organizational systems resulting in the unauthorized disclosure of CUI.  

  

**Priority:** High 

  

**Domain: ACCESS CONTROL (AC)** 

  

**Services Associated with AWS:** 

-   AWS Virtual Private Network (VPN), AWS Direct Connect, AWS Transit Gateway

  

**Services Associated with Azure:**

-   Azure Firewall
-   Azure Bastion
-   Azure Virtual Network (VNet)
-   Azure Private Link
-   Azure ExpressRoute

  

Objective Evidence: 

-   Administrative: documented policies, standards & procedures 
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations 
-   Technical: screen shot of firewall/VPN settings

  

Possible Technology Considerations:

-   **VPN Concentrator Secure Baseline Configurations (SBC)** 

  

**What needs to be answered:**

**Is remote access only maintained by the IT department and routed through a limited number of managed access control points?**  

  

**Checks for AWS**

-   Ensure Routing of Remote Access Via Managed Control Points  
    Description: This check confirms that remote access is routed through managed access control points, enhancing organizational control over such connections and reducing the susceptibility to unauthorized access.

  

**Checks for Azure**

-   Ensure Cryptographic Protection of Remote Access Sessions in Azure Key Vault:  
    Description: This check verifies that cryptographic mechanisms are used to maintain the confidentiality of remote access sessions in Azure Key Vault. Cryptographic standards should include FIPS-validated cryptography and NSA-approved cryptography.
-   Validate Cryptographic Protection for Remote Access Sessions in Azure Virtual Network (VNet):  
    Description: This check confirms that cryptographic protection is implemented to maintain the confidentiality of remote access sessions in Azure Virtual Network (VNet). Cryptographic standards should adhere to FIPS-validated cryptography and NSA-approved cryptography.
-   Check Cryptographic Protection for Remote Access Sessions in Azure Disk Encryption:  
    Description: This check ensures that cryptographic protection is applied to maintain the confidentiality of remote access sessions in Azure Disk Encryption. Cryptographic standards should meet the requirements of FIPS-validated cryptography and NSA-approved cryptography.
-   Verify Cryptographic Protection for Remote Access Sessions in Azure Storage Service Encryption:  
    Description: This check verifies that cryptographic protection is in place to maintain the confidentiality of remote access sessions in Azure Storage Service Encryption. Cryptographic standards should align with FIPS-validated cryptography and NSA-approved cryptography.
-   Ensure Cryptographic Protection of Remote Access Sessions in Azure VPN Gateway:  
    Description: This check ensures that cryptographic mechanisms are employed to maintain the confidentiality of remote access sessions in Azure VPN Gateway. Cryptographic standards should include FIPS-validated cryptography and NSA-approved cryptography.
-   Validate Cryptographic Protection for Remote Access Sessions in Azure Information Protection:  
    Description: This check confirms that cryptographic protection is implemented to maintain the confidentiality of remote access sessions in Azure Information Protection. Cryptographic standards should adhere to FIPS-validated cryptography and NSA-approved cryptography.

  

**More Details:** Remote access is managed via a controlled access point.

## Related compliance guidance

- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): The CUI requirements CMMC Level 2 assesses, the SPRS score, POA&M rules and the phased DFARS rollout.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The federal catalogue 800-171 is derived from — useful when a contract also cites a FedRAMP baseline.