Alternative Work Sites

A remote work policy is the backbone of both objectives.

CUI is Controlled Unclassified Information, the government information your contract obliges you to protect. Objective [a] asks that safeguarding measures for it are defined for alternate work sites. A policy naming the approved site types and the required protections defines them. Objective [b] asks that they are enforced. Training with a signed acknowledgment plus the technical controls that travel with the laptop enforce them.

The measures that matter travel with the device and the habits.

Encrypt the whole disk, and require a screen lock. Reach your environment through a VPN, an encrypted connection into your network, or through conditional access, sign-in rules that admit only trusted users and devices. Bar household use of the device, and lock up any printed CUI. Enforce the technical half through management tooling such as Microsoft Intune, so the control does not depend on the user remembering.

Calibrate to CUI, not to classified.

CUI at an alternate work site needs a controlled environment: walls, a door that closes, and screens positioned away from casual view. It does not need a windowless room or defenses against surveillance. Rules imported from classified handling produce a policy nobody follows, and an unenforced rule fails [b].

Decide the coffee shop question by policy.

Working with CUI in public spaces is easiest to prohibit outright: homes and hotel rooms with a lockable door qualify as work sites. The airport lounge does not. A written line enforced through training does the job. A geolocation project does the same job at many times the cost.

Cloud-native and fully remote organizations own this requirement outright.

A provider's data center controls can cover much of the rest of this family, but no provider controls your employee's kitchen table. For a fully remote organization every work location is an alternate work site, which makes this small requirement most of your physical protection story. Give it the corresponding weight.