CMMC Practice Requirement:

Enforce safeguarding measures for “Controlled Unclassified Information” (CUI) at alternate work sites.

CMMC Requirement Explanation:

It is not uncommon for employees to work from home. An employee's Home is an "alternate worksite". Other alternate work sites may include government facilities and client sites. This practice seeks to ensure that you still protect CUI outside of your facility.

Example CMMC Implementation:

Encrypt your workstations to protect CUI. Ensure that you can deploy software updates to your remote employee's systems. Have the capability to secure remote systems at the same or similar level that you can for devices in your facility. This includes deploying updates, security policy settings, and being able to monitor the system when it is connected to your VPN. You may even decide to restrict the use of printers to prevent employees from printing CUI at home.


- Scenario 1:

Your company allows its employees to work from home once a week. To ensure that CUI on their systems is secure you encrypt their workstations, require them to connect to them VPN upon logging into their system, and deploy all software updates as scheduled.

Discover Our NIST SP 800-171 Solutions:


Compliance Accelerator

For contractors seeking compliance

Quantum Assessor

For IT service providers

Supply Chain Verifier

For contractors seeking to verify partner compliance