PE.L2-3.10.6
Alternative Work Sites
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee PE.L2-3.10.6 in the reference catalog with its NIST cross-references
Official requirement
Enforce safeguarding measures for CUI at alternate work sites.
Assessment objectives
a. safeguarding measures for CUI are defined for alternate work sites; and
b. safeguarding measures for CUI are enforced for alternate work sites.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Apply controlled-information safeguards at alternate work sites.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Many of your company ’s project managers work remotely as they often travel to sponsor locations or even work from home. Because the projects on which they work require access to CUI, you must ensure the same level of protection is afforded as when they work in the office. You ensure that each laptop is deployed with patch management and anti- virus software protection [b]. Because data may be stored on the local hard drive, you have enabled full-disk encryption on their laptops [b]. When a remote staff member needs access to the internal network you require VPN connectivity that also disconnects the lapto p from the remote network (i.e. , prevents split tunneling) [b]. The VPN requires multifactor authentication to verify remote users are who they claim to be [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Physical and environmental protection policy; procedures addressing alternate work sites for personnel; system security plan; list of safeguards required for alternate work sites; assessments of safeguards at alternate work sites; other relevant documents or records
Common mistakes
Assuming an employee's home office falls outside the organization's protection responsibilities.