AC-17(01) Monitoring and Control
NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
All changes in this version
Title
Monitoring and Control
Control
Employ automated mechanisms to monitor and control remote access methods.
Discussion
Monitoring and control of remote access methods allows organizations to detect attacks and help ensure compliance with remote access policies by auditing the connection activities of remote users on a variety of system components, including servers, notebook computers, workstations, smart phones, and tablets. Audit logging for remote access is enforced by [AU-2](#au-2) . Audit events are defined in [AU-2a](#au-2_smt.a).
Related controls
au-12, au-14, au-2, au-6
STIG rules that implement this control 34
Apple iOS/iPadOS 26 V1R3
- AIOS-26-010900 CAT III Apple iOS/iPadOS 26 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device.
- AIOS-26-011000 CAT II Apple iOS/iPadOS 26 must implement the management setting: disable Allow MailDrop.
Apple iOS/iPadOS 27 V1R1
- AIOS-27-010200 CAT III Apple iOS/iPadOS 27 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device.
- AIOS-27-010300 CAT II Apple iOS/iPadOS 27 must implement the management setting: disable Allow MailDrop.
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001002 CAT II The macOS system must be configured to audit all login and logout events.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001002 CAT II The macOS system must be configured to audit all login and logout events.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-251010 CAT II Ubuntu 22.04 LTS must have an application firewall installed in order to control remote access methods.
- UBTU-22-251015 CAT II Ubuntu 22.04 LTS must enable and run the Uncomplicated Firewall (ufw).
- UBTU-22-652015 CAT II Ubuntu 22.04 LTS must monitor remote access methods.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100300 CAT II Ubuntu 24.04 LTS must have an application firewall installed in order to control remote access methods.
- UBTU-24-100310 CAT II Ubuntu 24.04 LTS must enable and run the Uncomplicated Firewall (ufw).
- UBTU-24-200090 CAT II Ubuntu 24.04 LTS must monitor remote access methods.
Google Android 16 COBO Y26M10
- GOOG-16-008700 CAT II Google Android 16 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Google Android 17 COBO Y26M06
- GOOG-17-007300 CAT II Google Android 17 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Microsoft Windows 11 V2R11
- WN11-AU-000065 CAT II The system must be configured to audit Logon/Logoff - Logoff successes.
- WN11-UR-000090 CAT II The "Deny log on through Remote Desktop Services" user right on Windows 11 workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.
Microsoft Windows Server 2022 V2R11
- WN22-AU-000190 CAT II Windows Server 2022 must be configured to audit logon successes.
- WN22-AU-000200 CAT II Windows Server 2022 must be configured to audit logon failures.
- WN22-DC-000410 CAT II Windows Server 2022 Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
- WN22-MS-000120 CAT II Windows Server 2022 Deny log on through Remote Desktop Services user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems.
Microsoft Windows Server 2025 V1R4
- WN25-AU-000190 CAT II Windows Server 2025 must be configured to audit logon successes.
- WN25-AU-000200 CAT II Windows Server 2025 must be configured to audit logon failures.
- WN25-DC-000410 CAT II The Windows Server 2025 "Deny log on through Remote Desktop Services" user right on domain controllers must be configured to prevent unauthenticated access.
- WN25-MS-000120 CAT II The Windows Server 2025 "Deny log on through Remote Desktop Services" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200531 CAT II RHEL 10 must have the "firewalld" service set to active.
- RHEL-10-200532 CAT II RHEL 10 must employ a deny-all, allow-by-exception policy for allowing connections to other systems.
- RHEL-10-200647 CAT II RHEL 10 must monitor all remote access methods.
- RHEL-10-500215 CAT II RHEL 10 must log Secure Shell (SSH) connection attempts and failures to the server.
- RHEL-10-800000 CAT II RHEL 10 must control remote access methods.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-251010 CAT II RHEL 9 must have the firewalld package installed.
- RHEL-09-251015 CAT II The firewalld service on RHEL 9 must be active.
- RHEL-09-255030 CAT II RHEL 9 must log SSH connection attempts and failures to the server.
- RHEL-09-652030 CAT II All RHEL 9 remote access methods must be monitored.
Samsung Android 16 COBO Y26M10
- KNOX-16-007700 CAT II Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.