Remote IdP global admin
Changing MFA policies from home requires PAW + PIM elevation + recorded session — the ‘additional protection’ AC-17(7) sought, implemented via modern controls.
Additional Protection for Security Function Access
Critical Risk
Complex
High Cost
AC-17(7) historically called for additional protection for remote access to security functions. In NIST SP 800-53 Rev. 5 the enhancement is withdrawn (capabilities covered through other controls such as AC-17(4), AC-6, IA-2, and related). Healthcare organizations should still add stronger safeguards when security-relevant functions — IdP admin, EHR security workbench, firewall, SIEM — are reachable remotely, and document the Rev. 5 mapping so SSP rows are not left empty.
Control Objective
Apply heightened protections whenever security functions that guard ePHI are exercised remotely, while noting AC-17(7) withdrawal and inheritance to surviving controls.
Implementation Guidance
- SSP note: AC-17(7) withdrawn; inherit additional remote protections via AC-17(4), AC-6, IA-2(1)/phishing-resistant MFA, PAW, and PAM.
- Require dedicated privileged accounts and managed admin workstations for remote security admin.
- Prefer no direct remote access to security consoles — use PAM brokers with recording.
- Step-up authentication and shorter session lifetimes for security-function remote use.
- Geo/device conditional access on IdP and cloud security portals.
- Dual authorization for especially sensitive remote security changes where feasible (AC-3(2)).
- Continuous monitoring of remote security-admin sessions (AC-17(1)/SI-4).
- Keep operational runbooks even if the enhancement ID is withdrawn.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
EHR security workbench offsite
Role design changes blocked from general VPN; only via privileged VDI with clipboard limits.
Firewall rule changes after hours
Network security engineers use PAM to the management plane; standing any-VPN admin to firewalls is removed.
Best Practices
- Document withdrawal and control inheritance clearly.
- Never equate withdrawn with ‘do nothing.’
- PAW + PAM for remote security functions.
- Phishing-resistant MFA.
- Session recording and short TTLs.
- Align with AC-17(4) privileged remote rules.
Common Gaps & Violations
- Marking AC-17(7) N/A and allowing casual remote Domain Admin.
- Security consoles on the general employee VPN pool.
- No extra authentication for cloud Owner roles.
- Shared security-admin passwords for remote after-hours work.
- Missing SSP crosswalk for withdrawn enhancement.
Required Documentation
- SSP mapping: AC-17(7) withdrawn → implementing controls
- Privileged remote security-function procedures
- PAW/PAM requirements for security admins
- Conditional access policies for admin portals
- Sample recorded privileged sessions
How to Test & Validate
- Confirm SSP withdrawal language and mapped controls.
- Attempt security-console access from a standard remote session; expect deny.
- Verify MFA/PIM for remote security roles.
- Review who has remote rights to IdP/EHR security.
- Validate session recording on a test admin change.
Audit Considerations
Withdrawn status is not a free pass. Auditors still expect additional protection for remote security administration affecting ePHI — show the inherited control set.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(a)(1) Access Control — security functions that manage ePHI access need strongest remote limits.
- 164.312(d) Person or Entity Authentication — stronger authentication for remote security admin.
- 164.308(a)(3) Workforce Security — supervise workforce performing security functions remotely.
- 164.312(b) Audit Controls — remote security-function use must be logged.
Compliance Tips
- Keep a withdrawn-enhancements appendix in the SSP with ‘how we still meet the intent.’
- Prioritize IdP, EHR security, and backup-admin remote paths.
- Tabletop a compromised remote security-admin scenario.
Frequently Asked Questions
Is AC-17(7) still active in Rev. 5?
No — it is withdrawn. Implement equivalent protections through related controls and document the mapping.
What ‘additional protections’ should we keep?
PAW, PAM, phishing-resistant MFA, tighter authorization, monitoring, and shorter sessions for remote security functions.
Does withdrawal mean remote security admin is fine on any laptop?
No. The risk remains; only the control number changed.
References & Resources
- NIST SP 800-53 Rev. 5 — AC-17(7) [Withdrawn]
- Related controls: AC-17(4), AC-6, IA-2, AU-2, SI-4
Related Guidelines
Related controls that commonly accompany AC-17(7).
Need Help Implementing AC-17(7)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.