3.10.6

Requirement

a. Determine alternate work sites allowed for use by employees.
b. Employ the following security requirements at alternate work sites: [Assignment: organization-defined security requirements].

Discussion

Alternate work sites include the private residences of employees or other facilities designated by the organization. Alternate work sites can provide readily available alternate locations during contingency operations. Organizations can define different security requirements for specific alternate work sites or types of sites, depending on the work-related activities conducted at the sites. Assessing the effectiveness of the requirements and providing a means to communicate incidents at alternate work sites supports the contingency planning activities of organizations.

NIST 800-171A r3 Assessment Guidance

Examine

[SELECT FROM: physical protection policy and procedures; procedures for alternate work sites for personnel; list of security requirements for alternate work sites; assessments of security requirements at alternate work sites; system security plan; other relevant documents or records]
Interview

[SELECT FROM: processes for security at alternate work sites; mechanisms for supporting alternate work sites; security requirements employed at alternate work sites; means of communication between personnel at alternate work sites and security personnel]
Test

[SELECT FROM: personnel approving the use of alternate work sites; personnel using alternate work sites; personnel assessing security requirements at alternate work sites; personnel with information security responsibilities]

ID	Assessment Objectives
A.03.10.06.a	alternate work sites allowed for use by employees are determined.
A.03.10.06.b	the following security requirements are employed at alternate work sites: .
A.03.10.06.ODP[01]	security requirements to be employed at alternate work sites are defined.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!