Mechanisms exist to restrict the execution of privileged commands and access to security-relevant information via remote access only for compelling operational needs.
Does the organization restrict the execution of privileged commands and access to security-relevant information via remote access only for compelling operational needs?