MA.2.115 — Require multifactor authentication for nonlocal maintenance

CMMC Level 2SPRS if unmet: -3HIGH priority~5h to implement

Require MFA to establish nonlocal maintenance sessions via external networks and terminate such connections when nonlocal maintenance is complete.

What MA.2.115 means in plain English

When your MSP or IT support person connects to your systems remotely over the internet — not from inside your office — they must use MFA to authenticate, just like your employees do. No remote access over the internet should be possible with just a password. Additionally, when the remote maintenance session is done, the connection must be cleanly terminated — not left open or set to auto-reconnect indefinitely. This control is specifically about remote (nonlocal) access for maintenance purposes, separate from regular employee remote work.

The assessment question

“Do all remote maintenance connections (MSP, vendor, IT support) require MFA — and are these sessions explicitly terminated upon completion of maintenance rather than left open indefinitely?”

How to implement MA.2.115

Require your MSP to use MFA on their admin accounts before initiating any remote session to your systems — get this confirmed in writing as part of your MSP contract.
Use a remote access tool that supports MFA natively: ConnectWise Control, Splashtop Business, and TeamViewer Business all support MFA for technician accounts.
Configure your VPN (if used for remote maintenance) to require MFA — compatible with Azure AD MFA using RADIUS integration for most commercial VPN products.
Establish a policy that remote maintenance sessions must be terminated within 15 minutes of completing the maintenance task — no persistent backdoors or always-on remote sessions.
Review your remote access logs monthly to confirm all sessions were properly terminated and no unauthorized remote connections occurred.

Evidence your assessor will ask for

MSP contract or addendum confirming MFA requirement for remote access
Remote access tool configuration showing MFA enforcement on technician accounts
Remote access session logs showing session start, activity, and clean termination
System Maintenance Policy section specifying MFA and session termination requirements

Does AI prompt monitoring help with this control? Honestly, no.

MA.2.115 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Maintenance controls

MA.2.111

Perform maintenance on organizational systems

MA.2.112

Provide controls on tools and personnel for maintenance

MA.2.113

Ensure equipment removed for offsite maintenance is sanitized

MA.2.114

Check media containing diagnostic programs for malicious code

MA.2.116

Supervise maintenance activities without required access authorization

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment

NIST 800-171 Controls · Maintenance