ZTZeroTrustAV
Free from ZeroTrustAV · v1.0

The 15-Minute AV Remote-Access Self-Check

Ten yes/no questions for AV integrators and the IT teams who inherit AV networks. No tools needed — just your firewall admin, your remote-support lead, and 15 minutes.

Score 1 point for every honest "Yes." If you don't know, it's a "No."

Exposure

  1. 1.☐ Yes / No — There are zero port forwards or NAT rules pointing at AV devices (control processors, DSPs, codecs, displays, room PCs).

  2. 2.☐ Yes / No — No AV device has a public IP or sits in a "DMZ."

  3. 3.☐ Yes / No — If someone scanned this site's public IPs today, no AV web UI, SSH, Telnet, or vendor control port would answer.

Identity

  1. 4.☐ Yes / No — Every person who connects remotely uses their own account. No "avtech," "integrator," or shared VPN login.

  2. 5.☐ Yes / No — All remote access requires MFA.

  3. 6.☐ Yes / No — No unattended remote-control tool (TeamViewer, AnyDesk, VNC, etc.) relies on a static password that former staff might know.

Time and evidence

  1. 7.☐ Yes / No — Subcontractor and vendor access expires automatically (end date, or approval per session).

  2. 8.☐ Yes / No — You can show, for last month, who connected to which device and when.

  3. 9.☐ Yes / No — When a tech left, you changed the device admin passwords they knew — and you can show when.

  4. 10.☐ Yes / No — The client could cut all of your remote access in under 15 minutes without calling you.

Your score: 0 / 10 (0 of 10 answered)

Your score

ScoreWhat it means
9–10Strong. Document it — it's a selling point with IT/security buyers.
6–8Common. Fix any "No" on questions 1–5 first; those are the doors that are open right now.
0–5Treat remote access as an active risk. Start with removing port forwards and shared accounts.

What "good" looks like

  • Outbound-only connectors instead of inbound ports (e.g. Cloudflare Tunnel / cloudflared).
  • An identity check with MFA in front of every device UI (e.g. Cloudflare Access).
  • Access that expires and logs by default.
  • A written kill switch the client controls.

Want the full version?

The AV Remote Access Zero Trust Kit ($49) includes the 25-point audit with scoring, a step-by-step Cloudflare Tunnel + Access starter for AV gear (with AV-network gotchas), a contractor access policy template, a client handover template, and a "prove access was removed" test checklist.

$49 AV Remote Access Zero Trust Kit · v1.0
Audit · Tunnel + Access starter · Contractor policy · Handover · Removal test
→ Get the kit ($49)

ZeroTrustAV is independent and not affiliated with Cloudflare or any AV manufacturer. This self-check is a quick review aid, not a security assessment.