3.1.12

5.7.3.4 The organization shall require encrypted connectivity to all corporate IT resources and require VPN connectivity with multi-factor authentication for all remote access into corporate networks.

5.8.3.1 The organization shall provision accounts with the minimum functionality necessary for tasks and shall restrict administrator privileges to an as-required basis.

5.8.3.2 The organization shall remove accounts and/or functionality when users no longer require these for their tasks.

5.8.3.3 The organization shall only permit administrator accounts to perform administrative activities (and not user-level activities such as accessing email or browsing the web).

5.8.3.4 The organization should consider the implementation of a centralized authorization control system.