Require Multi-Factor Authentication for Nonlocal Maintenance

NIST SP 800-171 Rev 2 requirement 3.7.5 mandates that organizations require multi-factor authentication to establish nonlocal maintenance sessions conducted over external network connections, ensuring that remote maintenance personnel cannot access systems using single-factor credentials alone. Nonlocal maintenance refers to any maintenance activity performed by individuals who are not physically present at the system being maintained, typically executed via remote access technologies such as VPN, RDP, SSH, or vendor-specific remote support tools. The practice has two distinct assessment objectives: first, MFA must be enforced at session establishment for all such connections; second, the nonlocal maintenance session must be explicitly terminated once the maintenance task is complete, preventing persistent unauthorized access. This requirement is grounded in the broader NIST 800-171 maintenance family, which recognizes that remote access for maintenance purposes represents a high-risk attack vector if not properly controlled. Both the authentication strength and the session lifecycle must be actively managed to satisfy this practice.