Enforce safeguarding measures for CUI at alternate work sites
📖 What This Means
This control requires ensuring that Controlled Unclassified Information (CUI) is protected when employees work from alternate locations, such as home offices, co-working spaces, or temporary sites. It means implementing physical security measures equivalent to those at primary work locations. For example, if employees access CUI from home, they must use secure storage solutions like locked cabinets and ensure their workspace is free from unauthorized access. Another example is when traveling; employees must use privacy screens and secure laptops to prevent shoulder surfing. The goal is to maintain the same level of physical protection for CUI, regardless of location.
🎯 Why It Matters
Failing to protect CUI at alternate work sites increases the risk of unauthorized access, theft, or exposure. For instance, in 2019, a defense contractor employee left a laptop containing sensitive data unattended in a coffee shop, leading to a data breach. Such incidents can result in significant financial penalties, loss of contracts, and reputational damage. From the DoD/CMMC perspective, safeguarding CUI at all locations is critical to maintaining national security and ensuring contractor trustworthiness. This control mitigates risks associated with remote work and ensures compliance with federal regulations.
✅ How to Implement
- 1. Use virtual desktops (e.g., AWS Workspaces, Azure Virtual Desktop) to centralize CUI access.
- 2. Enforce multi-factor authentication (MFA) for remote access to cloud resources.
- 3. Implement endpoint protection (e.g., Microsoft Defender, CrowdStrike) to secure devices accessing CUI.
- 4. Configure VPNs with encryption for secure remote connections.
- 5. Monitor remote access logs and alert on suspicious activity.
📋 Evidence Examples
Remote Work Policy
Encryption Configuration Screenshots
Remote Access Logs
Training Records
Workspace Inspection Reports
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For PE.L2-3.10.6 ("Enforce safeguarding measures for CUI at alternate work sites"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe the physical security controls protecting CUI systems, including badge access, visitor management, physical access logging, and alternate work site requirements. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"PE.L2-3.10.6 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to enforce safeguarding measures for cui at alternate work sites. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"PE.L2-3.10.6 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to enforce safeguarding measures for cui at alternate work sites. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"PE.L2-3.10.6 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all physical locations where CUI is processed or stored
- • Document physical access control mechanisms (badge readers, locks, cameras)
- • Specify CUI area boundaries within each facility
- • Ensure this control covers all systems within your defined CUI boundary where enforce safeguarding measures for cui at alternate work sites applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Physical Protection Policy
- 📄 Badge access logs
- 📄 Visitor logs
- 📄 Alternate work site approval forms
- 📄 Evidence artifacts specific to PE.L2-3.10.6
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will physically inspect CUI areas, test badge access controls, review visitor logs, and verify that terminated employees' badges are deactivated promptly.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do you have a documented remote work policy?
Question 2: Are all devices used remotely encrypted?
Question 3: Are privacy screens provided for laptops?
Question 4: Are VPNs required for remote access?
Question 5: Are remote access logs monitored regularly?
⚠️ Common Mistakes (What Auditors Flag)
1. No remote work policy
2. Unencrypted devices
3. No privacy screens
4. Missing VPN enforcement
5. Inadequate log monitoring
📚 Parent Policy
This practice is governed by the Physical Protection Policy