Revision in progress. NIST issued a pre-draft call for comments on Rev. 3 in 2020; no draft text has been published.
Key concepts
The guide recommends building a threat model, securing every component of the remote access solution and setting policy for organization-issued and personally owned devices. It compares remote access methods and covers the full life cycle of a remote access deployment.
How it is organized
- Overview: threat modeling and assuming external networks are hostile
- Remote access methods: tunneling and VPN, application portals, remote desktop, direct application access
- Telework client device security: district-issued versus personal devices
- Security across the remote access life cycle
What a school district should take from it
- Remote desktop exposed directly to the internet is a frequent target for attackers; put it behind a VPN or gateway with MFA.
- Vendor remote access to district systems needs the same controls as staff access.
How to use it in your district
- Inventory every way into the network from outside, including vendor and building-system remote access.
- Require MFA on VPN and remote access gateways.
- Close or restrict direct remote desktop exposure.
- Write a short policy for using personal devices with district data.
Common misconceptions
- A VPN by itself makes remote access safe.
- The VPN, the device connecting and the accounts used all need protection, including MFA.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- PR.AAIdentity Management, Authentication, and Access Control
- PR.IRTechnology Infrastructure Resilience
- PR.PSPlatform Security
Tools in the program portal
- Team and accessNamed accounts, roles and authenticator MFA
- Vulnerability alertsKnown exploited vulnerabilities that match your systems
- Cyber insurancePolicy conditions, questionnaire and Breach Day card
Related publications
- SP 800-114 Rev. 1Working from home safely (staff guide)
- SP 800-207Zero trust architecture
Citation and source
SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security. National Institute of Standards and Technology. 2016. https://doi.org/10.6028/NIST.SP.800-46r2.
Replaces: SP 800-46 Rev. 1 (2009).
Topics: Network security, Devices and malware. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.