03.10.06: Alternative Work Sites

Beyond CMMC Level 1

The free web app covers the 17 CMMC Level 1 practices. This requirement is part of the full NIST 800-171 set — get the desktop app to work on all 110 requirements with SPRS scoring. Previously saved data is shown read-only below, and your data always remains exportable in full.

Get the desktop app

Security Requirements for 03.10.06 Alternative Work Sites

Alternate work sites may include government facilities or the private residences of employees. Organizations may define different security requirements for specific alternate work sites or types of sites depending on the work-related activities conducted at those sites.[SP 800-46] and [SP 800-114] provide guidance on enterprise and user security when teleworking.

Assessment GuidanceExamine 0/6

How an assessor determines this requirement is met. Source: CMMC Assessment Guide – Level 2, Version 2.13 (NIST SP 800-171 Rev. 2).

Discussion

Many people work from home or travel as part of their job. Define and implement safeguards to account for protection of information beyond the enterprise perimeter. Safeguards may

include physical protections, such as locked file drawers, as well as electronic protections such as encryption, audit logging, and proper access controls.

Examples

Example 1
Many of your company’s project managers work remotely as they often travel to sponsor locations or even work from home. Because the projects on which they work require access to CUI, you must ensure the same level of protection is afforded as when they work in the office. You ensure that each laptop is deployed with patch management and anti-virus software protection [b]. Because data may be stored on the local hard drive, you have enabled full-disk encryption on their laptops [b]. When a remote staff member needs access to the internal network you require VPN connectivity that also disconnects the laptop from the remote network (i.e., prevents split tunneling) [b]. The VPN requires multifactor authentication to verify remote users are who they claim to be [b].

Assessment Methods

Examine

The process of reviewing, inspecting, observing, studying, or analyzing assessment objects (e.g., policies, procedures, plans, system designs, mechanisms) to facilitate understanding, achieve clarification, or obtain evidence.Example: An assessor reads the access control policy and inspects system configuration settings to confirm they match.

Not all of the evidence listed is required to meet this requirement — check the items your organization has collected.

Physical and environmental protection policy
Procedures addressing alternate work sites for personnel
System security plan
List of safeguards required for alternate work sites
Assessments of safeguards at alternate work sites
Other relevant documents or records

Interview

The process of holding discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or identify the location of evidence.Example: An assessor asks a system administrator to describe how user accounts are approved, reviewed, and disabled.

Personnel approving use of alternate work sites
Personnel using alternate work sites
Personnel assessing controls at alternate work sites
Personnel with information security responsibilities

Test

The process of exercising assessment objects (e.g., activities, mechanisms) under specified conditions to compare actual behavior with expected behavior.Example: An assessor attempts to sign in with a disabled account to confirm that access is denied.

Organizational processes for security at alternate work sites
Mechanisms supporting alternate work sites
Safeguards employed at alternate work sites
Means of communications between personnel at alternate work sites and security personnel

Potential Assessment Considerations

Do all alternate sites where CUI data is stored or processed meet the same physical security requirements as the main site [b]?
Does the alternate processing site provide information security measures equivalent to those of the primary site [b]?

Key References

NIST SP 800-171 Rev. 2 3.10.6

Overview