AC.2.015 — Authorize Remote Execution of Privileged Commands

CMMC Level 2SPRS if unmet: -1MEDIUM priority~5h to implement

Authorize remote execution of privileged commands and access to security-relevant information via remote access only for documented operational needs.

What AC.2.015 means in plain English

If an IT admin needs to make important system changes or run powerful commands while working remotely — like installing software, changing configurations, or accessing security settings — that should only be allowed when there's a specific documented reason. You can't just let admins do anything remotely at any time without oversight. There should be a process for approving and tracking these remote privileged actions.

The assessment question

“Is there a documented process for authorizing and tracking when IT administrators perform privileged functions (like changing system settings, installing software, or accessing security configurations) via remote access, rather than those activities being unrestricted?”

How to implement AC.2.015

Create a simple Remote Privileged Access Request form (a Word document or Google Form works) that requires: requester name, date/time, system to be accessed, reason for privileged remote access, and manager approval.
Implement a just-in-time (JIT) approach: admin accounts should not be permanently enabled for remote access. The admin requests access, gets approved, performs the task, and access is revoked. Microsoft Entra PIM (Privileged Identity Management) automates this.
For vendor remote access, require a written work order or ticket before any vendor connects remotely with privileged access. The business owner or designated manager must approve.
Enable and review audit logs for all remote privileged command executions. In Windows Event Log, Event IDs 4672 (special privileges assigned to new logon) and 4673 (privileged service called) capture these events.
Document in your System Security Plan the specific operational needs that justify remote privileged access, who is authorized to approve it, and the review schedule for those authorizations.

Evidence your assessor will ask for

Written Remote Privileged Access Policy or procedure
Sample completed remote privileged access request/approval form
Audit log entries showing remote privileged command executions
Microsoft Entra PIM configuration screenshot (if using M365)
List of personnel authorized to approve remote privileged access

Does AI prompt monitoring help with this control? Honestly, no.

AC.2.015 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Access Control controls

AC.1.001

Limit System Access to Authorized Users

AC.1.002

Limit System Access to Authorized Transaction Types

AC.2.003

Control CUI Flow per Authorizations

AC.2.004

Separate Duties to Reduce Risk

AC.2.005

Employ Least Privilege

AC.2.006

Use Non-Privileged Accounts for Non-Security Functions

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment