AC.2.014 — Route Remote Access via Managed Access Control Points

CMMC Level 2SPRS if unmet: -3HIGH priority~10h to implement

Route remote access via managed access control points.

What AC.2.014 means in plain English

All remote access to your network should funnel through a single, controlled entry point — like a VPN gateway or firewall — rather than having multiple different ways in that are hard to monitor. Think of it like your physical shop having one front door with a lock and camera, rather than ten different unlocked entrances scattered around the building.

The assessment question

“Does all remote access to your company's network and systems go through a single managed entry point (such as a VPN or firewall with access control), rather than multiple unmonitored pathways like open RDP ports, unsecured file-sharing services, or direct internet-exposed servers?”

How to implement AC.2.014

Audit your current remote access paths: ask your IT person or a consultant to list every way someone can connect to your network from outside. Common hidden pathways include open RDP ports, TeamViewer left running, FTP servers, and remote printer software.
Consolidate all remote access through a single VPN gateway. If you have a business-grade router/firewall (Fortinet, SonicWall, Cisco, Ubiquiti — typically $200-$800), enable the built-in VPN feature and require all remote workers to use it.
Block all other inbound remote access at your firewall: close all inbound ports except what is explicitly needed. Run a free external port scan at Shields Up (grc.com/shieldsup) to identify any unexpected open ports.
Require your IT support vendors to access your systems through the VPN or through an approved, auditable remote support tool (AnyDesk, Splashtop) rather than via their own direct connection methods.
Document the single approved remote access path in your Remote Access Policy and System Security Plan.

Evidence your assessor will ask for

Network diagram showing the single managed remote access entry point
Firewall rule export or screenshot showing only VPN port is open externally (no RDP, FTP, etc.)
VPN gateway configuration screenshot
Port scan results confirming no unexpected open ports
Written Remote Access Policy requiring use of the approved access point

Does AI prompt monitoring help with this control? Honestly, no.

AC.2.014 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Access Control controls

AC.1.001

Limit System Access to Authorized Users

AC.1.002

Limit System Access to Authorized Transaction Types

AC.2.003

Control CUI Flow per Authorizations

AC.2.004

Separate Duties to Reduce Risk

AC.2.005

Employ Least Privilege

AC.2.006

Use Non-Privileged Accounts for Non-Security Functions

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment

NIST 800-171 Controls · Access Control