What PE.L2-3.10.6 asks for CUI outside the office
Defense contractors increasingly have employees who handle controlled unclassified information (CUI) from home offices, hotel rooms, client sites and airport lounges, places the company does not own or control. PE.L2-3.10.6 requires the organization to protect CUI at those alternate work sites, and it has two parts that assessors test separately: defining the safeguards that apply at alternate work sites, and enforcing them. The assessment objectives in NIST SP 800-171A (June 2018) reflect this split, so a written remote work policy alone does not satisfy the requirement if nobody can show the safeguards are actually applied.
Definition is the easier half. The organization writes down which safeguards apply, such as locked storage for paper, encrypted laptops, approved remote access paths, screen privacy and rules for printing or travel. Enforcement is harder because the organization does not control the room. Someone has to confirm that each remote device meets the standard, that access is limited to authorized people, that activity is logged where the organization can review it, and that exceptions are caught. Plan for the enforcement evidence early, such as device compliance reports, access logs and signed acknowledgments from staff who work remotely. Confirm with your assessor which artifacts they expect to see for your environment.
PE.L2-3.10.6 is a 1-point requirement in the CMMC scoring methodology. Under 32 CFR 170.21, a 1-point requirement that is not on the exclusion list may be placed on a plan of action and milestones (POA&M) for Conditional Level 2 status, provided the score is at least 88 of 110 and closeout is due within 180 days. That option does not remove the obligation. Confirm the current status of CMMC phases and assessment requirements with your contracting officer and the DoW CIO About CMMC page before you decide how to plan, because the rollout schedule has changed.
Which alternate work sites and staff are in scope for 3.10.6
Before you write safeguards, decide where CUI can actually be viewed, stored or processed outside your facility. Each of the decisions below changes which sites, people and devices the 3.10.6 safeguards must cover, and each should be recorded in your system security plan.
Defining what counts as an alternate site
An alternate work site is any location outside your controlled facility where people work with CUI, including employees' homes, coworking spaces, customer premises and temporary offices. Write the definition into your policy so it is clear which locations need safeguards. Ask each manager to list where staff actually work, since a site nobody reported is one nobody protects. Include storage locations too, such as a home office cabinet holding printed drawings.
Mapping roles and CUI access
Not every employee who works remotely touches CUI. Build a list of roles that reach CUI systems or documents from outside the facility, such as engineers, program staff, administrators and contractors with remote accounts. Tie each role to the specific repositories, mailboxes and file shares it can open. This list becomes the population your assessor will interview and the scope your safeguards must cover.
Contractor-owned and personal devices
Decide whether personal laptops, phones and printers at home count as in scope when they reach CUI, and whether subcontractor-owned equipment is included. If personal devices are allowed, you must show how they are enrolled, encrypted and separated from personal use. If they are banned, enforce that with conditional access and block local downloads. Document the decision and the enforcement method, because the choice drives your device inventory and logging scope.
Travel and hotel use
Travel creates the highest-risk alternate site because devices leave your control in airports, hotels and vehicles. Define whether CUI may be carried on laptops or USB media during travel, and whether staff may open CUI on hotel networks or public Wi-Fi. Consider a rule that limits travel to view-only access or requires full-disk encryption and a locked device. Ask your assessor how they expect you to evidence travel safeguards.
Printing and paper at home
Printed CUI at a home site is often overlooked. Decide whether printing from home is permitted at all, and if so, which printers are approved and how paper is stored and destroyed. Locked file drawers are a common physical safeguard for paper and removable media. Confirm with your own policy and program requirements what disposal method is acceptable before staff start printing.
Reviewing scope with an assessor early
Scope decisions made late tend to be expensive to reverse. Walk through your alternate site list, role list and device rules with your assessment team before you finalize the system security plan. Ask your C3PAO or consultant to confirm how they will test each site category, and whether they expect interviews, sampled sites or documentation for every location. Record the answers so the scope matches what the assessor will examine.
How an assessor tests the safeguards at alternate sites
This table walks through how an assessor tests PE.L2-3.10.6, row by row, from the two SP 800-171A objectives to the evidence requested and the findings that most often cause a requirement to fail. Read it as a preparation checklist: each row names what the assessor will ask for and what the organization should have final and ready before the assessment begins.
| Assessment element | What the assessor does | Evidence to have ready |
|---|---|---|
| Objective 1: define safeguards | Confirms the organization has defined the safeguards required for CUI at alternate work sites, including remote and traveling staff | Written alternate work site standard listing required physical and electronic safeguards, approved and in final form |
| Objective 2: enforce safeguards | Tests whether the defined safeguards are actually applied at homes and travel locations, not only written down | Records showing each alternate site or user meets the standard, such as acknowledgments, configuration exports and device checks |
| Interviews | Speaks with people who approve, use or assess alternate sites, such as managers, remote staff and security staff | Staff briefed on the rules, approvers who can explain their decisions, and a consistent story across roles |
| Physical safeguard tests | Checks protections such as locked file drawers or secured storage for printed CUI at the sites in scope | Site attestation forms, photos or inspection records where permitted, and a rule for storing printed CUI |
| Electronic safeguard tests | Checks encryption of CUI-bearing devices, audit logging and access controls for systems used from alternate sites | Device encryption status, logging configuration, access control settings and sample log entries |
| Sampling and scope | Selects a sample of alternate work sites and users and traces each one back to the standard | Current roster of remote and traveling users, scoped to the system security plan boundary |
| Common finding: no defined standard | Requirement fails the first objective when the organization relies on informal practice | Formal, final standard approved by the accountable owner, not a draft |
| Common finding: standard not enforced | Requirement fails the second objective when sites or devices do not meet the standard and no one checks | Periodic verification records and documented exception handling |
How to implement alternate work site safeguards in sequence
This sequence moves from knowing where CUI leaves the office to proving that the safeguards work at each site. Each step produces a record that an assessor can check against the two assessment objectives for PE.L2-3.10.6: defining the safeguards and enforcing them.
Inventory where CUI is used off-site
Start by listing every place CUI is handled outside the main facility, including employee homes, travel locations, client sites and vehicles. Identify who works there, which systems and files they touch, and whether copies are stored locally or synced to devices. Work with system owners and HR, and confirm the list against the system security plan boundary. The output is a dated inventory of alternate work sites, roles and CUI data flows that the rest of the sequence depends on.
Write the approved safeguard list
Define the physical and electronic safeguards each site type must meet, such as locked storage for paper and removable media, screen privacy, encrypted devices, managed access to the CUI enclave, and audit logging. Assign an owner for approving sites and exceptions. Record the list in the system security plan or a referenced standard, because assessors look for a defined set of safeguards before they test enforcement. The output is an approved, version-controlled safeguard standard that names the approver.
Configure encryption at rest and in transit
Enable encryption for CUI stored on laptops, mobile devices and file repositories, and for connections from alternate sites to the organization's systems. Confirm which keys are held by the organization and how they are rotated and recovered. Note that some platforms encrypt file contents but not file names or folder structure, so test what an unencrypted copy would reveal. The output is a configuration baseline with screenshots or exported settings for each encrypted store and tunnel.
Enforce access control and remote boundaries
Restrict CUI access from alternate sites to managed, authenticated devices and named roles, and deny by default at the network edge. Use the firewall or gateway to allow only the required destinations, and block other paths. Verify that a personal device or an unmanaged network cannot reach the CUI environment. The output is a tested access matrix with rule exports and the results of at least one attempted access from an unapproved configuration.
Enable logging and review alternate site activity
Turn on logging for logins, file access, sync events and firewall rule matches from alternate sites, and send them to a central store that the organization controls. Set a review routine, named owner and escalation path for anomalies such as access from new locations. Confirm log retention matches the organization's audit policy. The output is a log source list, a sample of reviewed events with reviewer sign-off, and a record of any findings.
Train staff on site safeguards
Brief everyone who works at an alternate site on the approved safeguards, reporting duties for lost devices and incidents, and the consequences of bypassing controls. Include managers who approve sites. Track completion by person and role, and refresh the training when the safeguard standard changes. The output is a training record that links each participant to the safeguard version they were taught, plus signed acknowledgments where the organization requires them.
Verify enforcement and retain evidence
Sample alternate sites and users to confirm the safeguards are actually in place, including physical storage, device encryption status, access restrictions and log flow. Record each check, the person who performed it, and any gap with a corrective action. Retain the final evidence in the form assessors accept, because a requirement counts as met only when the evidence is final rather than a draft. The output is a completed verification report mapped to both assessment objectives, ready for an independent assessor to examine.
How physical and electronic safeguards fit together at a home or travel site
The CMMC Assessment Guide for Level 2 describes safeguards for remote and traveling staff in two layers. The physical layer covers things like locked file drawers, so paper and removable media holding CUI are not left in the open at a home office or in a hotel room. The electronic layer covers encryption, audit logging and access controls on the systems that touch CUI. An assessor will expect to see both layers applied to the same site, and the organization owns the decision about which safeguards apply to which kind of site. Write that decision down before anyone works from home for the first time, because the assessor will look for the defined list of safeguards and then test whether those safeguards are actually in use.
In a typical arrangement, the remote workstation is the endpoint where CUI is displayed and processed. It connects through a VPN or access gateway into the organization's environment, and CUI is stored in file storage that sits inside the boundary, not on the laptop's local disk. The gateway is the natural place to enforce who may connect, from which devices, and under which conditions, while the workstation should have full-disk encryption and a session lock. Logs are produced in several places: the gateway records connection attempts, the file server records access to CUI files, and the endpoint records local sign-ins and, where configured, file activity. Confirm with your own administrators which of these sources exist in your environment and whether they are forwarded to a central log store, since a log that stays on a single laptop is hard to review and easy to lose.
Some of the tooling that can support these layers is open source. OPNsense can pass, block or reject traffic by source, destination, port and protocol and can log each rule match, which gives you evidence of the gateway boundary. Nextcloud's server-side encryption protects file contents at rest with keys held on the server, but it does not encrypt file names or folder structure, so the assessor's question about what an outsider could learn from a stolen storage volume needs its own answer. OpenBao's transit secrets engine can encrypt application data and rotate versioned keys, which may matter where key management is part of your design. Each of these is a choice you must confirm against the requirement and your own system security plan, and an independent assessor will decide whether the evidence meets the objectives.
Which evidence shows alternate site safeguards are enforced
An assessor testing PE.L2-3.10.6 checks two things: that the organization defined safeguards for CUI at alternate work sites, and that those safeguards are enforced there. The cards below list the artifacts that show both, and each one needs an owner and a refresh cycle so it is current when the assessor arrives.
Approved alternate work site standard
This is the written standard that defines which safeguards apply to CUI at homes and travel locations, such as locked storage, full-disk encryption, screen privacy, and rules for printing and discussing CUI. It is the first document an assessor reads, because the first assessment objective asks whether the safeguards were defined. Check that it names an approver, a version and an effective date, and that it matches what remote staff actually do. Review it at least once a year and after any change to tooling or contract scope.
Signed staff acknowledgments
Each person who works from an alternate site should sign an acknowledgment of the standard before receiving CUI access, and sign again when the standard changes. Records should tie each signature to a named person, a role and a date. Assessors often sample a few remote users and compare their signatures against the current version, so a missing or outdated acknowledgment is an easy finding. Keep acknowledgments in the same system as your training and onboarding records so they are easy to pull.
Device and encryption configuration records
Configuration baselines and exports show that laptops and mobile devices used off site have disk encryption enabled, screen locks set, and remote wipe available. Pair these with a current inventory that lists which devices hold CUI and where they are located. Confirm the export method with your endpoint management tooling, since the way it records encryption status varies by platform. Re-export on a schedule, and always after a device is replaced or reassigned.
Firewall and remote access logs
Logs from the VPN gateway, the firewall and the remote access layer show which devices connected, from which networks, and what they reached. OPNsense can log each rule match and display the result in its live log view, which helps you show that deny rules were enforced for off-site traffic. Retain these logs for the period your audit policy defines and review them for failed logins and unusual source locations. Confirm with your logging platform how long logs are retained before an assessor asks for them.
Application and storage access records
Where CUI lives in a collaboration platform, server-side encryption and access logs show protection in use. Nextcloud server-side encryption protects file contents at rest, but it does not encrypt file names or folder structure, so your evidence should say so and show how that gap is handled. Export audit entries for file access by remote users, and keep the encryption configuration as a dated record. Assessors look for proof that the controls run in practice, not only that they are switched on.
Periodic review and exception records
A dated review record shows that someone checked the alternate site safeguards on a set schedule, compared device and user lists to the standard, and recorded findings. Exceptions, such as a staff member who needs a temporary workaround, belong in the same record with an approver, an expiry date and a closure note. Assessors test whether reviews happen and whether findings were fixed. Ask your internal reviewers to sign each review, and link any open exception to your plan of action so it stays visible between assessments.
What meeting 3.10.6 costs in money and effort
Most of the technical cost for 3.10.6 sits in configuring the devices that leave the office. Each laptop, phone and remote access path needs full-disk encryption, managed settings that block local copies of CUI, and a secure way to reach internal systems. Costs depend on how many endpoints are in scope and whether devices are already under central management. Open-source components can cover parts of this work, but the organization still pays for the engineering hours to deploy and test them.
- Endpoint encryption: Enabling and verifying disk encryption on every device that can hold CUI, including the proof that it is turned on.
- Server-side encryption for shared files: Configuring Nextcloud server-side encryption for data at rest, noting that file names and folder structure stay visible.
- Remote access controls: Setting up VPN or gateway rules, often on OPNsense, so home connections reach only approved systems.
- Key handling: Storing encryption keys in a controlled service such as OpenBao, which adds setup and rotation work.
- Device exceptions: Tracking personal or shared devices that cannot meet the standard, which usually means restricting them.
Ask the partner to list every device class and remote path in scope, and to state which items are configuration work and which are licensed products you must buy yourself.
3.10.6 expects you to show that safeguards at alternate work sites actually operate, so logs of access and remote activity become a recurring cost. Logging adds storage, retention periods that you define, and the time someone spends reviewing events. The volume of data grows with the number of users and the length of retention. A small set of well-scoped logs is usually cheaper to run and easier to defend than a broad collection nobody reviews.
- Log collection: Forwarding firewall, file server and remote access logs to a central store, which needs initial configuration and ongoing maintenance.
- Storage and retention: Holding logs for the period your policy defines, with costs that scale with volume.
- Review effort: Time spent checking logs for unusual remote access, which is recurring staff work rather than a one-time task.
- Alerting: Rules that flag failed logins or access from unexpected locations, along with the tuning they need over time.
- Log protection: Restricting who can alter or delete audit data, which often requires separate administrative accounts.
Ask the partner to state the log sources, retention period and review frequency assumed in the quote, because these drive both storage and staff cost.
Much of the effort for 3.10.6 is organizational. You must define the safeguards for alternate work sites, decide which roles may work remotely, and make sure staff follow the rules. Writing the policy is a one-time task, but training, acknowledgments and periodic reviews recur. Staff time is often the largest cost because it is spread across security, HR, IT and managers, and it is rarely tracked as a separate budget line.
- Policy drafting: Defining the safeguards, approved locations and travel rules, usually a one-time effort with later revisions.
- Role decisions: Deciding which employees, contractors and travel scenarios are covered, which needs managers and HR.
- Training: Building or buying material for remote and traveling staff, then repeating it as roles change.
- Acknowledgments and exceptions: Collecting signed rules and documenting approved exceptions, a recurring administrative task.
- Periodic review: Confirming the safeguards still match how people work, which repeats on a schedule you set.
Ask for the number of roles and locations in scope and for the expected hours on each task, so you can see which costs fall on your own staff.
Assessment cost depends on how much evidence the assessor must examine. For 3.10.6, the assessor checks both that safeguards are defined and that they are enforced, so they may interview people who approve, use or assess alternate work sites and test the safeguards there. The more remote locations and roles you have, the more samples the assessor may select. Preparing clean, final evidence before the assessment reduces rework and the time spent answering follow-up questions.
- Defined safeguards: A current written list of required measures for alternate work sites, the baseline the assessor checks first.
- Enforcement samples: Records showing encryption, logging and access controls operate on sampled devices and accounts.
- Interviews: Time for the assessor to speak with approvers, remote users and reviewers.
- Final-form evidence: Work that is still in draft does not count as met, so finishing documents before the assessment matters.
- Assessor fees: Charged by the certification body or assessor, separate from any implementation work.
Ask the assessor, not the implementation partner, how sampling is decided, and confirm that the partner's quote excludes assessor fees unless stated otherwise.
No price is supplied for this requirement, so the figures a buyer can compare come from a written scope rather than a published rate. DeployOpen does not publish a price list, and a quote follows from the agreed scope. Separate the one-time setup from the recurring upkeep in every proposal, and ask each provider to name what they do and what you must do yourself. Cost usually rises with more endpoints, more remote locations, longer log retention, stricter review cycles and a larger number of exceptions to track.
- One-time setup: Encryption rollout, policy drafting, initial training and the first evidence package.
- Recurring upkeep: Log review, training refreshers, exception tracking, periodic policy review and license renewals.
- Scope inputs: Device count, remote roles, travel scenarios, log sources and retention period.
- Ownership split: What the organization owns, what the implementation partner prepares, and what the independent assessor decides.
- Quote terms: Deliverables, timelines, exclusions and change handling, all written before work starts.
Request a written scope and quote that lists each category above with a separate line for one-time and recurring work, and confirm which licenses or assessor fees are excluded.
Which open-source tools support alternate site evidence
This table compares four open-source tools that can produce evidence for safeguards at alternate work sites, such as traffic logs, encrypted file stores and key rotation records. Each row states the license from the supplied facts, the evidence the tool generates and what the team must confirm in its own deployment. A tool produces evidence only when it is configured and documented for CUI handling, so the configuration checks matter as much as the product choice.
| Tool | Evidence it produces for 3.10.6 | License and limits to confirm |
|---|---|---|
| OPNsense (firewall) | Rule-level logs of each pass, block or reject match, plus aliases that group approved remote endpoints for review | BSD-2-Clause. Confirm that rule logging is enabled on the rules covering remote and travel access and that logs are retained and reviewed |
| Nextcloud (CUI file storage) | Server-side encryption of file contents at rest, with keys held on the server, and access records for files holding CUI | AGPL-3.0-only. File names and folder structure are not encrypted, so confirm that CUI identifiers are not carried in names, and document where keys are stored |
| OpenBao (key management) | Transit encryption records, versioned encryption keys and key rotation history for data used off site | MPL-2.0. Confirm the key rotation schedule, the access policies on the transit engine and how key material is protected and backed up |
| Coraza (web application firewall) | Blocked-request logs for attacks such as SQL injection, cross-site scripting and code injection against web apps reached from alternate sites | Apache-2.0. Confirm that the OWASP Core Rule Set is loaded, that blocked events feed a log store, and that the integration with your proxy is tested |
Who owns the controls, who prepares evidence and who assesses
Your organization owns PE.L2-3.10.6. Only you can decide which safeguards apply to alternate work sites, which kinds of CUI may leave the main facility, which roles may work remotely and which travel situations are allowed. Those decisions have to be written down, approved by a named owner and reflected in the system security plan. An assessor will interview the people who approve and use alternate work sites, so the policy must match what staff actually do.
- Safeguard decisions: Define the approved physical and electronic measures for home offices and travel, such as locked storage, screen privacy, encryption and access restrictions.
- Approval and scope: Name who authorizes an alternate work site and which CUI categories and systems it may touch.
- Staff acknowledgments: Collect signed acknowledgments that employees understand the rules, including how they store printed material and what they do when traveling.
- Spot checks and exceptions: Run periodic checks that the rules are followed and record every exception with an approver and an end date.
- Plan ownership: Keep the decisions current when roles, locations or tools change.
Before engaging anyone, confirm that a named internal owner signs off on each decision, because an outside party cannot make those calls for you.
An implementation partner can prepare the technical side of the safeguards and the evidence that shows they work. Under a written, fixed scope, DeployOpen configures systems inside your own environment, such as encrypted storage, access controls, logging and network rules, and assembles the records an assessor will ask for. The partner does not decide your policy, does not attest that the controls are effective and does not issue any finding about compliance.
- Technical configuration: Set up encryption for CUI repositories, for example server-side encryption with keys held under your control, and restrict access to approved roles.
- Logging and review: Configure audit logs for remote access and the rules that record it, and document how the logs are reviewed.
- Evidence packages: Prepare configuration exports, screenshots, change records and test results that are final, dated and tied to each assessment objective in NIST SP 800-171A.
- Documentation: Draft procedures and runbooks for your review, which you then approve and adopt.
- Knowledge transfer: Train your staff to operate and maintain the configuration after handover.
Confirm in the written scope which deliverables the partner owns, which you must produce yourself and who holds administrative credentials after the engagement ends.
For Level 2 certification, a C3PAO authorized or accredited by The Cyber AB assesses your environment against NIST SP 800-171A. The assessor is independent of the organization and of any consultant who helped prepare it. Under the current rule, the assessor tests whether both assessment objectives for 3.10.6 are satisfied: that safeguards for alternate work sites are defined, and that they are enforced. Assessors interview staff, inspect configurations and sample evidence, so the partner's work must be complete before the assessment begins.
- Who issues the result: Only the assessor issues the assessment outcome and certificate. Neither your team nor DeployOpen can issue either.
- What the assessor tests: Whether safeguards are defined in writing and actually applied at home offices and during travel.
- Independence line: A partner may prepare evidence, but it may not perform the assessment or grade its own work for the same engagement.
- Status of Level 2 certification: The Department of War suspended Phase II, which had required Level 2 C3PAO certification for applicable contracts, so confirm the current contract requirement before scheduling anything.
- Self-assessment: Phase I self-assessments and SPRS postings remain in place, and the organization makes those determinations itself.
Before you hire anyone, ask the assessor how it handles conflicts of interest with prior consultants and confirm the requirement that applies to your contracts today.
Where alternate site safeguards usually fail an assessment
Most failures under PE.L2-3.10.6 come from missing paperwork and unverified practice rather than missing technology. The cards below cover the gaps assessors find most often, and each one ends with the action that closes it before the assessment begins.
No written list of approved sites
The first objective asks whether the organization has defined the safeguards for CUI at alternate work sites. If there is no approved list of home offices, travel locations and coworking spaces, and no written safeguards for each category, the assessor has nothing to test against. Staff often work from places nobody recorded. Close the gap by publishing a site standard that names the approved site types, the required safeguards for each, and who approves exceptions. Confirm the standard is signed off by the people who own the CUI.
Personal devices without encryption
Laptops and phones that leave the office are the most common route for CUI to reach an alternate site. Assessors look for evidence that full-disk encryption is enforced on the devices that hold or access CUI, not only a policy that asks for it. Check the device inventory against the management console, and confirm that unmanaged personal devices cannot open CUI repositories. Where a file store must be reached remotely, Nextcloud's server-side encryption protects file contents at rest, but it does not hide file names or folder structure, so document that limit in the system security plan.
Logs that nobody reviews
Access logs from remote sessions and VPN gateways often exist but are never read. An assessor who asks who reviewed last month's alternate site access events may receive no answer. Name an owner for review, define how often it happens, and keep a record of findings and follow-up. OPNsense can log each rule match and show it in the live log view, which gives reviewers a starting point, but the review itself must be scheduled, performed and documented. Confirm the retention period with the organization's own policy before setting it.
Unsigned remote staff acknowledgments
Many organizations ask remote staff to accept site rules in an onboarding portal, then discover that some acknowledgments were never completed. Assessors test whether each person who works from an alternate site knows the rules and has agreed to them. Pull a sample of remote users, match each name to a signed acknowledgment, and flag anyone missing one. Tie the acknowledgment to access provisioning so that no one receives CUI access before signing, and re-collect it when the site standard changes.
Drafts presented as final evidence
A policy marked draft, a screenshot taken during testing or a procedure that was edited after the assessment date does not show the safeguard was in place. Under the CMMC rule, a requirement is met only when the evidence is in final form, so drafts count against the score. Before the assessment, label each artifact with its approval date, version and owner, and remove superseded copies from the evidence folder. Keep a dated record of changes so the assessor can see that the final version was in effect during the period tested.
Remote access with no enforced controls
Assessors also test whether the access controls that protect CUI actually apply at alternate sites. A VPN that accepts any device, or shared logins used from home networks, undermines the safeguards written in the standard. Check that remote sessions require the organization's authentication and that the firewall rules restrict traffic to the systems that need it, using address aliases to keep the rule set readable. Test the rules from an outside network to confirm they behave as documented, and keep the test results with the evidence.
Questions buyers ask about PE.L2-3.10.6
Does a home office need a locked drawer for CUI?
Yes, if CUI is kept there in paper or on removable media, the organization must define safeguards for that site and enforce them. A locked drawer is one physical safeguard the CMMC Assessment Guide Level 2 names for remote and traveling staff, but it is only one option. The assessor will check that the rule is written down, that it applies to the actual home setting, and that staff follow it. Confirm with your assessor how they expect home sites to be documented, and decide early whether CUI should be allowed at home at all.
Can a partner set up alternate work site safeguards for us?
A partner can help, but the organization owns the requirement. An implementation partner such as DeployOpen can prepare the technical side, including encrypted storage, access controls and audit logging on self-hosted platforms inside your own environment, and can help draft the written safeguards and the evidence that shows they are enforced. Your staff still have to approve, use and follow those safeguards, and only an independent C3PAO or other assessor can judge whether the requirement is met. Confirm the split of responsibilities in the written scope before work starts.
How long does it take to set up alternate work site safeguards?
The duration depends on how many sites and access paths exist, how much of the environment is already documented, and whether technical changes such as remote access controls or logging are needed. Policy and procedure work can often run alongside technical configuration. No duration is set by a researched source for this requirement, so ask any provider for a timeline tied to a written scope that lists the sites, systems and deliverables. Plan for staff training and a round of evidence collection before an assessment.
What does the work require from staff who work remotely?
Staff need to understand what they may and may not do with CUI away from the office, then follow the safeguards every day. In practice this means storing CUI only where the rules allow, using encrypted devices and approved access paths, locking paper records away, and reporting lost equipment. Managers approve alternate sites and users, and assessors may interview them to test whether the safeguards are real. Training and signed acknowledgments are common evidence, so build them into onboarding and refresh them on a schedule the organization defines.
Does POA&M apply to PE.L2-3.10.6?
PE.L2-3.10.6 is a 1-point requirement, and under 32 CFR 170.21 it may be placed on a Plan of Action and Milestones if the overall score is at least 88 of 110, with closeout due within 180 days. Requirements on the exclusion list cannot be deferred this way, and this one is not on that list. Being eligible does not mean it is safe to defer, because the assessor still evaluates the plan, and a site with CUI and no safeguards may be a visible gap. Confirm the current POA&M rules and your score with your C3PAO or contracting office before relying on it.
How does the Phase II suspension affect planning for this requirement?
On 13 July 2026 the Department of War suspended CMMC Phase II and started a 60-day review, while Phase I self-assessments, SPRS postings and DFARS 252.204-7012 obligations remain in place. The safeguards for alternate work sites are still required for NIST SP 800-171 Rev. 2 under the CMMC rule, so the work should not be postponed on the assumption that it is optional. Watch for the outcome of the review and confirm with your contracting officer which assessment type applies to your contracts before scheduling any certification assessment.
Which open-source tools help produce evidence for this requirement?
Several self-hosted tools can produce technical evidence, though none of them satisfies the requirement alone. Nextcloud server-side encryption protects file contents at rest on the server, but it does not encrypt file names or folder structure, so that gap should be documented. OPNsense rules can restrict traffic and log each rule match for review, which supports access control and audit evidence for remote connections. OpenBao's transit engine can manage versioned encryption keys with rotation. Confirm each tool's capabilities against your environment and your assessment objectives before you rely on them.
Where to read the requirement and assessment method
Start with the requirement wording in NIST SP 800-171 Rev. 2, requirement 3.10.6, which the CMMC Level 2 model carries forward as PE.L2-3.10.6. The derived requirement asks an organization to enforce safeguarding measures for CUI at alternate work sites. Read the Rev. 2 publication for the exact text and its place in the Physical Protection family, then check Appendix D, which maps 3.10.6 to SP 800-53 Rev. 4 control PE-17 (Alternate Work Site). That mapping helps teams that already hold SP 800-53 evidence reuse it, but confirm with your assessor which artifacts they will accept under the CMMC model. Read the publication here: NIST SP 800-171 Rev. 2 on CSRC.
SP 800-171A defines how the requirement is tested. For 3.10.6 it sets two assessment objectives: defining the safeguarding measures required for CUI at alternate work sites, and enforcing them. Turn these into a worksheet with one row per objective and list the evidence for each: a written list of required safeguards for home offices and travel, and records showing those safeguards operate at each approved site. Assessors may interview the people who approve, use or assess those sites, so confirm that those roles can explain the safeguards from memory. A requirement is met only when every applicable objective is satisfied with evidence in final form. Read the procedures here: NIST SP 800-171A.
The CMMC Assessment Guide for Level 2 gives the assessment context for CMMC, including examples of safeguards for remote and traveling staff such as locked file drawers, encryption, audit logging and access controls. Use it to decide which examples fit your environment and to check how your evidence will be judged. Then confirm program status on the official Department of War pages before you plan. The DoW CIO About CMMC page, the 13 July 2026 Department of War release on suspending Phase II, and the current eCFR text of 32 CFR 170.3(e) do not describe the schedule in the same way, so record the date you checked each one and ask your assessor or Affirming Official which version governs your contract. Guide: CMMC Assessment Guide, Level 2.
