What is the requirement for service providers that have remote access to customer premises?

What is the requirement for service providers that have remote access to customer premises?

• A. Use a unique authentication credential for each customer.
• B. Reuse a single credential across multiple customers.
• C. Share login credentials across technicians for efficiency.
• D. Only apply to privileged access accounts.

Answer: (A)

Unique authentication credentials for each customer is required because it enforces strict separation of access and enables precise tracking of who connected to which customer environment. When service providers have remote access to customer premises, giving everyone a single shared login or reusing the same credential across multiple customers creates a single point of failure. If that credential is compromised, every connected customer is at risk, and it becomes impossible to attribute actions to a specific person or to revoke access for one customer without affecting others. Sharing login credentials among technicians eliminates individual accountability and undermines logging and auditing. Having separate credentials per customer supports traceability so every remote session can be linked to a particular user and a specific customer, allowing timely revocation, auditing, and accountability. It also helps enforce the principle of least privilege by ensuring access rights are scoped to the individual customer rather than a generic, blanket credential. This requirement applies regardless of privilege level, not only for privileged accounts.

Unique authentication credentials for each customer is required because it enforces strict separation of access and enables precise tracking of who connected to which customer environment. When service providers have remote access to customer premises, giving everyone a single shared login or reusing the same credential across multiple customers creates a single point of failure. If that credential is compromised, every connected customer is at risk, and it becomes impossible to attribute actions to a specific person or to revoke access for one customer without affecting others. Sharing login credentials among technicians eliminates individual accountability and undermines logging and auditing.

Having separate credentials per customer supports traceability so every remote session can be linked to a particular user and a specific customer, allowing timely revocation, auditing, and accountability. It also helps enforce the principle of least privilege by ensuring access rights are scoped to the individual customer rather than a generic, blanket credential. This requirement applies regardless of privilege level, not only for privileged accounts.