Which policy requirement applies to activation of remote-access technologies used by vendors and business partners?

• A. Activate remote-access technologies continuously for vendors and business partners.
• B. Activate remote-access technologies only when needed by vendors and business partners, with immediate deactivation after use.
• C. Never allow remote-access technologies for vendors.
• D. Activate remote-access technologies daily regardless of need.

Answer: (B)

The key idea is controlling third-party access with least privilege and time-bounded use. Remote-access capabilities should be granted only for the specific task that vendors or business partners need to perform, and they should be deactivated immediately after that session ends. This keeps the window of opportunity for misuse as small as possible and makes access easier to monitor and audit.

Activating remote access only when needed and turning it off right away minimizes risk from compromised credentials or misused sessions. In contrast, keeping access always on increases exposure, preventing timely revocation, while never allowing remote access would hinder legitimate work. Granting access on a daily basis regardless of necessity adds unnecessary overhead without improving security.