CMMCpedia
Work with me

Requirements / Physical Protection (PE)

PE.L2-3.10.6

Alternative Work Sites

Official Source Material

SPRS score value
1 point.
POA&M eligibility
Eligible at a conditional assessment.
Level 1
Not a Level 1 requirement.

Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.

Enforce safeguarding measures for CUI at alternate work sites.

Determine if:

  1. [a] safeguarding measures for CUI are defined for alternate work sites; and
  2. [b] safeguarding measures for CUI are enforced for alternate work sites.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

A remote work policy is the backbone of both objectives.

CUI is Controlled Unclassified Information, the government information your contract obliges you to protect. Objective [a] asks that safeguarding measures for it are defined for alternate work sites. A policy naming the approved site types and the required protections defines them. Objective [b] asks that they are enforced. Training with a signed acknowledgment plus the technical controls that travel with the laptop enforce them.

The measures that matter travel with the device and the habits.

Encrypt the whole disk, and require a screen lock. Reach your environment through a VPN, an encrypted connection into your network, or through conditional access, sign-in rules that admit only trusted users and devices. Bar household use of the device, and lock up any printed CUI. Enforce the technical half through management tooling such as Microsoft Intune, so the control does not depend on the user remembering.

Calibrate to CUI, not to classified.

CUI at an alternate work site needs a controlled environment: walls, a door that closes, and screens positioned away from casual view. It does not need a windowless room or defenses against surveillance. Rules imported from classified handling produce a policy nobody follows, and an unenforced rule fails [b].

Decide the coffee shop question by policy.

Working with CUI in public spaces is easiest to prohibit outright: homes and hotel rooms with a lockable door qualify as work sites. The airport lounge does not. A written line enforced through training does the job. A geolocation project does the same job at many times the cost.

Cloud-native and fully remote organizations own this requirement outright.

A provider's data center controls can cover much of the rest of this family, but no provider controls your employee's kitchen table. For a fully remote organization every work location is an alternate work site, which makes this small requirement most of your physical protection story. Give it the corresponding weight.

What falls short

  • A policy that tells remote workers to use good judgement. Objective [a] asks for defined measures, and judgement is not a definition.
  • Defined measures with nothing making them happen. Without enforced device controls or a training and acknowledgment trail, [b] has no evidence.

Edge cases

  • Printing CUI at home is either prohibited in the policy or comes with the full paper lifecycle: locked storage while the paper exists, and approved destruction when it should not. Decide which, and write it down.
  • A government facility used as a work site brings the government's own controls. Note the arrangement in your system security plan instead of inventing home-office rules for it.

Over-engineering

  • Home inspections for remote workers. Objectives [a] and [b] are defined measures, enforced through device configuration and an acknowledgement each worker signs.
  • A safe and a locked cabinet shipped to every home office. Calibrate the measures to CUI, and prohibit home printing if paper is the problem.