The organization:
Authorizes the execution of privileged commands and access to security-relevant information via remote access only for [Assignment: organization-defined needs]; and
Documents the rationale for such access in the security plan for the information system.
