I recently helped a new person at our company. We use N-Able to connect to machines, which has prompt/notification turned off by default. I've never considered it extensively, though it crossed my mind in passing. Either way, this particular user was very disquieted by the fact that there was no notification at all, but it also seemed as though she expected to be able to deny me access to her system.
N-Able connection options, pretty robust, and can do what she's asking:
Further, she said she was told by IT at her previous company that unprompted connections are illegal, and that to comply with some standard (like HIPAA, but not HIPAA, she didn't know what standard, obviously) it was required to at least let users know. I know that I would never tell a user something like that unless I were absolutely sure it was true, so that gave me pause.
This is a corporate system which is subject to monitoring, and has the appropriate disclosures at login to tell the users this; though I'm not even sure this is required by law, more of a formality and good practice as I understand.
Am I way off? I've been doing this for a long time, and have worked in extremely stringent, high security environments, and I've never had to have a prompt to get permission to connect, but have worked where there was a notification that I was on. In the Marine Corps, we had a pop-up to let users know, but I never had to get a click from the user to allow me to connect. Sure, verbal or email permission is always granted prior to connecting, but anything more seems excessive.
Are there any standards that I am unaware of that outline base user rights? Do I need to update my policy?