Back to Control Explorer



Control Acronym



Physical Protection

CMMC Level


800-171 Control #


CMMC Description

Enforce safeguarding measures for CUI at alternate work sites.

CMMC Clarification

Most organizations focus on securing their corporate network and devices. Today many organizations have mobile staff who work from home or travel as part of their job. This means the organization needs to define and implement safeguards to account for protection of information beyond the enterprise perimeter. Safeguards may include physical protections, such as locked file drawers, as well as electronic protections. Example In your organization many of the project managers work remotely as they often travel to sponsor locations or even work from home. Since the projects they work require access to Controlled Unclassified Information (CUI) the organization must ensure the same level of protection is afforded as when they work in the office. Each laptop is deployed with patch management and anti-virus software protection. Since data may be stored on the local hard drive you have enabled full-disk encryption on their laptops. When the remote staff member needs access to the internal network you require VPN connectivity that also disconnects the laptop from the remote network (i.e., prevents split tunneling). The VPN requires multifactor authentication to verify the user is who they claim to be.

800-171 Description

Enforce safeguarding measures for CUI at alternate work sites.

800-171 Discussion

Alternate work sites may include government facilities or the private residences of employees. Organizations may define different security requirements for specific alternate work sites or types of sites depending on the work-related activities conducted at those sites. [SP 800-46] and [SP 800-114] provide guidance on enterprise and user security when teleworking.

Other Source Discussion


CIS Control References

NIST 800-53 Control Ref.

NIST SP 800-53 Rev 4 PE-17

CMMC Derived

NIST CSF Control References

NIST 800-171 References

NIST SP 800-171 Rev 1 3.10.6

Applicable FAR Clause

NIST CSF Control Reference

CERT RMM Reference


Modification of NIST 800-171B Reference

NIST 800-171B Reference

UK NCSCCyber Reference

AS ACSC Reference


Assessment Sub-Criteria 1

PE.3.136.[a] safeguarding measures for CUI are defined for alternate work sites; and

Assessment Sub-Criteria 2

PE.3.136.[b] safeguarding measures for CUI are enforced for alternate work sites.

Assessment Sub-Criteria 3

Assessment Sub-Criteria 4

Assessment Sub-Criteria 5

Assessment Sub-Criteria 6

Assessment Sub-Criteria 7

Assessment Sub-Criteria 8

Assessment Sub-Criteria 9

Assessment Sub-Criteria 10

Assessment Sub-Criteria 11

Assessment Sub-Criteria 12

Assessment Sub-Criteria 13

Assessment Sub-Criteria 14

Assessment Sub-Criteria 15