SOC2-CC6-REMOTE-ACCESS
Remote Access VPN Policy
What this control does
Policy and technical enforcement requiring VPN use for access to internal systems and production environments from outside the corporate network.
Implementation guidance
Deploy a split-tunnel or full-tunnel VPN (WireGuard, Tailscale, Cisco AnyConnect) for all remote access to production systems. Require MFA for VPN authentication. Log all VPN sessions. Prohibit use of personal devices on the production VPN without MDM enrollment.
Requirements satisfied
Why it matters
Unencrypted or unauthenticated remote access exposes production systems to credential theft, man-in-the-middle attacks, and lateral movement by attackers on compromised home networks. Without mandatory VPN and MFA enforcement, a single compromised device or weak password can grant an attacker direct access to databases, APIs, and customer data.
Evidence to collect
- VPN policy document specifying split-tunnel or full-tunnel mode, MFA requirement, and device enrollment rules
- VPN gateway configuration (Cisco AnyConnect, WireGuard, Tailscale) showing MFA enforcement and session logging enabled
- Sample VPN session logs covering 30+ days, showing user, timestamp, source IP, and session duration
- MDM enrollment policy and screenshots of device compliance check triggered before VPN connection
Testing procedure
Request a list of all VPN users and cross-reference against active employees; verify MFA is enforced at VPN login (test failed login without MFA credential). Review VPN logs for the last 30 days and confirm all sessions include user identity, timestamp, and source IP. Attempt to connect a non-MDM-enrolled device to the production VPN and confirm it is denied. Interview an engineer to verify they cannot bypass the VPN to reach production systems (e.g., direct SSH to private IP) from home.
Common gotchas
Teams often deploy VPN but leave it optional or bypass it for "convenience," requiring ongoing access reviews and process audits. Split-tunnel VPN is faster but risks users accessing production over unencrypted local networks—require full-tunnel for production, split-tunnel only for non-sensitive resources, and enforce this at the VPN gateway level, not by user honor system.