PRACTICAL WORKBOOK
Remote Access: Check Exposure and Update Plans
Prioritise VPNs, remote desktop and internet-facing services in your inventory.
01 / Define the scope
02 / Check and Record Evidence
Confirm the scope first, then expand each item to check it. For 'Completed', enter an owner and evidence; for 'Not applicable', enter a reason. Progress reflects record status only, not a security score.
Data is processed only on this page and is not uploaded or saved automatically. Before leaving, download the HTML and confirm it has been saved; open that file later to continue. Do not enter passwords, verification codes or complete sensitive configurations.
Expand one item to focus on it, or view all items at once. Printing includes every item.
Confirm external entry points and owners
PendingMore information needed
List VPNs, remote desktops, cloud administration platforms and supplier connections, confirming their purpose and owner.
Suggested evidence: asset inventory identifier, service name, owner and latest check date.
Close connections that are no longer needed
PendingMore information needed
Confirm purposes with service owners before disabling unused services, expired supplier accounts and unnecessary public RDP.
Suggested evidence: change tickets, deactivation records and connection verification after closure.
Check Versions and Official Patches
PendingMore information needed
Record installed versions, official advisories, patch status and support deadlines. Prioritise according to exposure and the risk of known exploitation.
Suggested evidence: version inventory, advisory links, planned maintenance date and post-update validation records.
Protect remote logins
PendingMore information needed
Check whether remote entry points enforce multi-factor authentication, and review exempt accounts and recovery methods.
Suggested evidence: policy name, coverage, test date and outstanding exceptions.
Restrict management interfaces
PendingMore information needed
Management interfaces should be available only to authorised staff through controlled entry points. Restrict source addresses and access policies for your environment.
Suggested evidence: policy or rule identifiers, plus results of tests for allowed and denied connections.
Separate Everyday and Administrative Permissions
PendingMore information needed
Use separate administrator accounts. Give remote sessions only the permissions needed for the work, and record temporary privilege elevation.
Suggested evidence: role review records, permission expiry dates and revocation test results.
Confirm someone follows up on alerts
PendingMore information needed
Check that login and configuration change logs are accessible, and identify who owns alerts for unusual logins or large numbers of failures.
Suggested evidence: log locations, test alert times and recipient acknowledgements.
Validate changes and recovery arrangements
PendingMore information needed
Work within an approved change window. Keep protected configuration backups and rollback steps, then test both normal operations and denied access.
Suggested evidence: change approval, test results, rollback plan and service owner confirmation.
Schedule the next review
PendingMore information needed
Record unfinished items, interim measures and deadlines. Recheck when staff, services or suppliers change.
Suggested evidence: approved exceptions, improvement owners and the next review date.