Remote access, meaning any access originating outside the system or outside its network including other networks at the same site, is allowed only if the regulator authorises it and is performed by a secured method, can be disabled, accepts only connections the firewall and system settings permit, and is limited to the application functions users need for their duties, with no unauthorised remote user administration and no unauthorised access to the operating system or databases beyond retrieval through existing functions; each implementation is reviewed case by case with regulator approval.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.