What this requirement asks
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
This is a CMMC Level 2 requirement in the Maintenance family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (2)
- 3.7.5[a] — multifactor authentication is used to establish nonlocal maintenance sessions via external network connections
- 3.7.5[b] — nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete
What an assessor examines
Examine:
- System maintenance policy
- procedures addressing nonlocal system maintenance
- system security plan
- system design documentation
- system configuration settings and associated documentation
- maintenance records
- diagnostic records
- other relevant documents or records
Interview:
- Personnel with system maintenance responsibilities
- personnel with information security responsibilities
- system or network administrators
Test:
- Organizational processes for managing nonlocal maintenance
- mechanisms implementing, supporting, and managing nonlocal maintenance
- mechanisms for strong authentication of nonlocal maintenance diagnostic sessions
- mechanisms for terminating nonlocal maintenance sessions and network connections
Evidence that defends it
Show tickets and recorded sessions if applicable
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.