Assessment objective [a] for AC.L2-3.1.13 requires the assessor to determine if "The cryptographic mechanisms used to protect the confidentiality of remote access sessions are identified." This identification is a formal specification that must be documented. The organization's Access Control Policy establishes the requirement for such mechanisms. The associated procedures and, more critically, the system design documentation (including the System Security Plan or SSP) will explicitly define and identify the specific cryptographic protocols, algorithms, and configurations (e.g., TLS 1.3, FIPS 140-2 validated modules) used to meet the policy's mandate. These documents serve as the primary evidence or "specification" for the assessment.

A. Interviews with security administrators: Interviews are a method to confirm documented specifications and verify implementation, but the verbal statements themselves do not constitute the formal, documented identification required by the assessment objective.
B. Interviews of personnel responsible for remote access: Similar to interviewing administrators, this is a verification activity. The personnel's understanding is important but is not the official specification the organization is required to maintain.
C. Remote access authorizations: These documents specify who is permitted remote access. They typically do not detail the underlying cryptographic technologies used to protect the communication channel itself.

1. NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information.

Reference: Section 3, Control 3.1.13, Potential Assessment Methods and Objects.

Details: For assessment objective [a], the "EXAMINE" method explicitly lists "access control policy; procedures addressing remote access; system security plan; system design documentation; [and] system configuration settings and associated documentation" as the objects to be reviewed to determine if mechanisms are identified. This directly supports that documentation is the required specification.

2. Cybersecurity Maturity Model Certification (CMMC) Program, CMMC Assessment Process (CAP) v5.1.1.

Reference: Section 4.2.1, Phase 1 – Plan and Prepare for the Assessment.

Details: The CAP outlines that a primary pre-assessment activity is the review of the Organization Seeking Certification's (OSC) documentation, including the System Security Plan (SSP). The SSP is where the implementation of each CMMC practice, including the identification of cryptographic mechanisms, is formally described.

3. NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations.

Reference: Control AC-17, Remote Access.

Details: The discussion for this control, which is the basis for CMMC's AC.L2-3.1.13, emphasizes the use of "cryptographic mechanisms, for example, Virtual Private Networks (VPNs)" and notes that these selections are documented in the system security plan. This reinforces that the SSP and design documents are the correct location for this specification.