03.10.06 Alternate work site: requirements and evidence

What 03.10.06 asks for when employees work from home

03.10.06 asks the organization to decide which alternate work sites its people may use and to define the security requirements that apply at each one. If a contract requires NIST SP 800-171 and staff already work from home or from client offices, this requirement is where that practice has to be written down. NIST's discussion of the requirement says alternate work sites include employees' private residences and other facilities the organization designates. The organization owns this decision. It chooses which sites are allowed, what those sites must have in place, and who approves exceptions. An assessor's job is to test whether that decision exists, is documented, and is followed.

This requirement differs from the facility requirements elsewhere in the physical protection family. Access authorizations, monitoring and entry controls assume the organization controls the building where the system sits. A kitchen table or a coworking desk gives the organization no such control, so the question shifts from who may walk through a door to what conditions must hold wherever the work happens. In practice the hard part is the variety. Home networks differ from one house to the next, personal laptops and phones may hold CUI alongside family devices, and printers, smart speakers or shared household computers can sit inside the same network. A useful first step is to list every location where CUI is actually viewed or stored, including the sites staff have been using informally.

Plan for the evidence before the first assessment. Expect to show a written list of permitted alternate sites, the security requirements for each category, and records of how those requirements were verified, such as device configurations, approved home network standards or attestations from staff. Confirm with your contracting officer or assessor which evidence they accept, since NIST leaves the implementation details to the organization and the federal agency that holds the contract. Ask your implementation partner to help turn the decision into a standard that can be enforced through managed devices and the documented procedures, but remember that the assessment itself is performed by an independent assessor, not by the partner.

Which alternate work sites fall under 03.10.06

03.10.06 applies once an organization lets people work outside its own facilities. The decisions below determine which sites are in scope, which roles and systems may use them, and how much of the requirement each site triggers. Settle these choices in writing before any employee begins working from a new location.

Employees' private residences

NIST's Rev. 3 discussion names employees' private residences as alternate work sites. Any home office where someone reaches CUI systems, or prints, stores or discusses CUI, falls under the requirement. Check whether the organization has a written list of approved home locations or allows work from any address, because an open-ended policy makes the site inventory impossible to keep current.

Other facilities the organization designates

The requirement also reaches any other location the organization chooses to designate as an alternate site, such as a satellite office, a partner's facility or a branch that is not covered by the main physical controls. Designation is the organization's decision, so the list should come from the same authority that approves remote access. Confirm that designated sites appear in the system security plan with their security requirements.

Roles and systems permitted to work remotely

Scope follows the people and systems, not just the address. Decide which roles may work from an alternate site and which systems they may reach from there. A help desk agent with access to a CUI enclave changes the scope far more than a finance user who never touches CUI. Restrict remote access by role in the access control records so the set of in-scope sites can be traced to named accounts.

Whether CUI is accessed or stored there

The strongest scoping question is whether CUI is viewed, stored, printed or transmitted at the site. A site that only reaches a remote desktop with no local copies carries different risk than one where files are downloaded or printed. Document each data path, including screenshots, paper notes and removable media, so the assessor can see where CUI can leave the controlled environment.

Contractors and coworking spaces

Coworking spaces and contractor-run offices are alternate work sites when people use them to access CUI, even though the organization does not own the premises. Confirm who controls the physical space, who else can see screens, and whether the operator can access network equipment. Where a contractor's staff work on CUI systems, the contractor's site is also in scope for the related personnel and supply chain requirements.

Documenting the decision

The organization must determine the alternate sites it allows and state the security requirements that apply there, so the decision needs a record. Ask for a written approval process, a current list of sites and roles, and the security requirements each site must meet. Ask your implementation partner or assessor to confirm that the list matches what they will sample during the review.

How an assessor tests alternate work site controls

This table maps each assessment method in SP 800-171A Rev. 3 to the objects an assessor requests for 03.10.06 and the findings that most often appear. Read it as a checklist of what to have ready before an assessor arrives, since a missing site list or an unset ODP value fails the requirement regardless of how well the home office is secured.

Method	Objects the assessor requests	Common finding
Examine	Physical protection policy and procedures, procedures for alternate work sites for personnel, the list of security requirements for alternate work sites, and assessments of those requirements at each site	No written procedure covering remote or home work, or a site list that is out of date
Interview	Personnel who approve use of alternate work sites and personnel who work from them	Approvers cannot explain how a site is approved, and staff do not know the security rules that apply at home
Test	Processes for security at alternate work sites and the mechanisms that support them, such as encrypted laptops, locked storage and secure connections	Controls exist on paper but were never observed working at a home or other off-site location
Determination statement 1 (approved sites)	Evidence that the organization determined which alternate work sites employees may use, including private residences and other designated facilities	No record of which sites are allowed, so any home office is effectively unapproved
Determination statement 2 (requirements applied)	Evidence that the organization employed its defined security requirements at each allowed site	Requirements are defined but not applied or assessed at the sites in use
ODP check (requirements defined)	The organization-defined security requirements for alternate work sites, written as specific values	The ODP is left blank or stated only as a general intent, which fails the check even when controls are in place
Scope question	Whether the organization has assigned values to the ODP itself or received them from the federal agency	Assumption that the agency will supply the values, when the organization must assign them if the agency does not

Setting the organization-defined parameter for alternate sites

Requirement 03.10.06 has one organization-defined parameter (ODP): the security requirements to be employed at alternate work sites. NIST does not assign a value to it. The value is the organization's own decision, and it has to be written down before an assessor can test the requirement. Under NIST's guidance, if the federal agency that holds the contract or agreement does not specify the ODP values, the nonfederal organization must assign them to complete the requirement. Because NIST's OSCAL catalog includes a determination statement that checks whether each ODP value is defined, an undefined parameter is a finding in its own right, separate from whether the controls at the home office are working.

In practice, the value is a list of the security requirements that apply wherever an employee works from a home or another designated facility. A workable list names the things a reviewer will look for: which devices may hold CUI away from the office, how remote sessions reach the enclave, what storage and printing are permitted, how screens are protected from viewing by others, and how paper or media are secured and disposed of. The list should be specific enough that an interviewer can ask an employee who works from home what they do, and the answer matches the document. The organization owns this list, and the same ODP value should drive the policy, the system security plan and the training given to people who use alternate sites.

The FAR overhaul proposed rule published 23 June 2026 would have contractors handling CUI comply with SP 800-171 Rev. 3 using ODP values published by the DoW CIO. That rule was not final as of October 2026, and DoW Class Deviation 2026-O0025, Revision 3 names Revision 2 for DFARS purposes, so the source of the values depends on which clause and contract vehicle applies. Ask the contracting officer in writing which ODP values apply to 03.10.06, whether the agency will publish them or expects the contractor to set them, and which revision the contract cites. Record the answer in the contract file. If you assign your own value now, keep it under version control so you can show when it was set and changed.

How to set up alternate work site controls, in order

This sequence turns the 03.10.06 requirement into a working control: it defines which alternate sites are permitted, what may be handled there, the security requirements each site type must meet, and a documented approval and review cycle that an assessor can test.

Define the permitted alternate site types
Start by listing every kind of place where work on the system may happen outside the main facility, such as an employee's private residence, a co-working space, a client site or a partner office. Ask the system owner, facilities and HR which of these already occur, and decide which types the organization will allow and which it will prohibit outright. The output is a site-type register with one entry per type and a yes or no decision on each. NIST's discussion of 03.10.06 names private residences and other facilities the organization designates, so the list should make both explicit.
Decide which roles and data may go where
For each permitted site type, decide which personnel roles may work there and which categories of CUI, systems and tasks they may handle. A residence may be acceptable for a narrow set of roles with access to a managed endpoint, while a shared public space may be excluded for any CUI work. Document these decisions in a matrix that maps site type, role, data category and access method. The matrix is complete when the system owner and the approver of alternate work sites have both signed it, because it becomes the basis for every later approval.
Write the security requirements for each site type
Translate the decisions into a written standard of security requirements for alternate work sites. Cover the controls the organization expects to see at each site type, such as a locked space for devices and printed material, screen privacy, no unattended sessions, secure storage for removable media, approved network paths for connecting to the system, and rules on who else in the household or building may observe screens. Keep the standard specific enough that a reviewer can answer yes or no at each point. The output is a versioned requirements standard that a person outside the project could apply.
Set the organization-defined parameter value
03.10.06 has one organization-defined parameter: the security requirements to be employed at alternate work sites. NIST does not assign this value, so the organization must set it, and the requirement is not complete until it does. Name the requirements standard from the previous step as the value, and confirm that the version and the scope of the standard match what will be cited in the system security plan. The output is a recorded ODP value in the system security plan. If a federal customer or contract sets the value, record that source instead and confirm it with the contracting officer.
Approve and record each alternate site
For every individual site, such as a named employee's home office, have the approver confirm that the site type is permitted, that the person's role and data scope fit the matrix, and that the site meets the requirements standard. Collect a short attestation from the employee describing the controls in place, and record the approval with the person, site type, date and approver. The approval record is the evidence an interviewer will ask for when testing whether personnel approving alternate work sites actually use the process. Store these records in a system that keeps version history so changes to approvals can be traced.
Assess the controls at approved sites
Check that the requirements in the standard are actually in place, not only described. Use a combination of self-attestation, periodic check-ins, and where appropriate, a walkthrough or remote verification with the employee. Record the assessment results, the findings and the corrective actions, and link them to the approval record. SP 800-171A Rev. 3 expects an examination of assessments of security requirements at alternate work sites, so the assessment record needs to show what was checked, by whom and when.
Reassess when conditions change
Define the events that trigger a new approval or assessment, such as a change of role, a move to a new address, a change to the data handled, a new device, a security incident involving the site, or a revision to the requirements standard. Review the full register of approved sites on a schedule the organization sets and documents in its procedures. Remove approvals that no longer fit, and update the matrix and standard when new site types are added. The sequence is complete when the review cycle has run once and its records are traceable to the current standard and the ODP value.

Evidence that passes an alternate work site assessment

Assessors testing 03.10.06 look for a chain of records: which sites are allowed, which security requirements apply to each, who approved them, and proof that the requirements were checked and still hold. Each artifact below should be kept current between assessments, with a named owner and a recorded sign-off.

Approved alternate site list

This is the register of every location employees may work from outside organizational facilities, including private residences and any other site the organization designates. Each entry should record the site type, the covered roles, the date of approval and the approver. Check that the list matches what HR, facilities and IT actually see, since a remote-work arrangement that never reached the register is the most common gap an assessor finds. Review the list on a set schedule and whenever a role or location changes.

Security requirements standard by site type

Because 03.10.06 leaves the security requirements to the organization, it needs a written standard that states what applies at each site type, such as a home office, a co-working space or a partner facility. Typical entries cover locked storage for media, screen privacy, device encryption, and rules for printing and disposing of CUI. Confirm the standard is specific enough that a person at a home office could follow it without guessing, and that it reflects the organization-defined parameter value your organization has set.

Alternate site policy and procedures

The policy states who may request an alternate site and the procedures explain how the request is reviewed, approved, configured and ended. Assessors examine these documents and then interview the people who approve and use alternate sites to confirm they match actual practice. Assign an owner for each document, keep a version history, and record the reviewer's sign-off so that changes made after the last assessment are visible.

Approval records for each arrangement

Each person working from an approved site should have a dated approval that names the site, the requirements that apply, and the manager and security approver who signed it. Approval records show that the decision was made deliberately rather than by default. Set a recertification point, such as an annual renewal or a role change, and remove the approval when the arrangement ends so the record does not outlive the access it granted.

Completed site assessments

Before or shortly after a site is approved, a responsible person should check that the required security measures are in place and record the result. The assessment should list each requirement, the evidence reviewed (for example, a photo of a locking cabinet or a screenshot of disk encryption status), the finding and any corrective action. Repeat the assessment on the schedule set in the standard, and after any significant change to the site or the person's role.

Remote access configuration records

Alternate sites usually reach internal systems through remote access, so the configuration of that access is part of the evidence. Keep records of the remote access method, the device and identity controls required, session settings and the monitoring applied to that access. Export configuration baselines from the access platform at each review so an assessor can compare what was approved with what is running. Confirm with your access platform's documentation which of these settings it records and which must be captured separately.

What meeting 03.10.06 costs in money and effort

This table breaks down the cost components of putting 03.10.06 in place, who is paid for each, whether it is one-time or recurring, and what drives it up. Use it to structure a written quote and to see where open-source platforms can reduce license spend. No prices or durations are given because none are supplied; ask each provider for them in writing.

Cost component	Who is paid	One-time or recurring	What drives it up
Policy and standard drafting	Internal policy owner, or an implementation partner preparing templates	One-time, with periodic review	Number of alternate work site types (home, co-working, branch offices) and how many security requirements each must meet
Engineering for remote endpoint and network controls	Internal IT or platform engineering, or a partner building the configuration	One-time, then change work	Number of device types, operating systems and remote access paths such as VPN or virtual desktops
Assessment effort per site	Internal assessors or the organization's own security staff	Recurring, per site and per review cycle	Number of approved remote roles, distance of sites and frequency of re-verification
Evidence upkeep	Internal records owner, or a partner maintaining the records system	Recurring	Volume of signed acknowledgments, site assessments, exceptions and change history
External review before assessment	Independent consultant or assessor, paid by the organization	One-time per review, repeated before each assessment	Scope of contract flow-down, number of sites in scope and how mature the existing records are
Auditor sampling	Independent assessor, paid by the organization	Recurring at each assessment	Number of alternate work sites the assessor samples and whether records are complete and retrievable
Open-source license spend	Platform licenses avoided when self-hosted open-source tools replace paid products	Recurring license cost reduced, hosting and support remain	Choice of tools for documentation, approvals and records, and whether the organization hosts them internally

Using self-hosted wikis to keep site records under version control

An alternate work site decision produces records: the approved site list, the security requirements for each site, and the approvals behind them. Self-hosted wikis can hold those records with change history and access control, but they store evidence and do not enforce the site controls themselves.

XWiki version history for site decisions

XWiki keeps every change to a page under version control, recording what changed, when and by whom. For 03.10.06, this lets you show an assessor how the approved site list and its security requirements evolved, including when a home office was added or its requirements were tightened. Users can compare any two versions and roll back to an earlier one. Confirm with your administrators that page history is retained for the period your assessment and records policy require.

Rollback limits for approved records

Rollback restores an earlier page version, which is useful when an edit was wrong, but it can also erase the current state of a decision that an assessor has already sampled. Define who may roll back approval records, and require that a rollback itself is noted in the page or in a linked change ticket. Ask your wiki administrator whether rollbacks are logged as events in their own right.

BookStack role-based permissions

BookStack assigns abilities through roles, and permissions can be overridden per role at the shelf, book, chapter or page level. You can place the alternate work site list on a restricted book that only the physical security and approving managers can edit, while a broader audience reads it. Map each role to the people named in your approval process, and review role assignments when staff change.

Separating approvals from edits

Site approvals should record who approved a home or other alternate site, under which requirements, and for what period. In either wiki, keep approval pages editable only by approvers and make a separate page or attachment the signed record. Confirm whether your tool can restrict edit rights to a named group, since this affects whether the record can be trusted as evidence.

What a wiki cannot enforce

A wiki documents that a site was approved and what security requirements apply, but it does not install disk encryption on a home laptop, lock a cabinet, or stop an employee from working from an unapproved location. The controls themselves must be implemented and tested elsewhere, and assessors will check them directly. Treat the wiki as the record that links each site to its controls and their test results.

Confirming fit in your environment

Before choosing either tool, confirm how it authenticates users, whether it integrates with your identity provider, where its data and backups are stored, and how long page history is retained. Check that the tool runs inside your own infrastructure if CUI-related records are involved. Ask your implementation partner and your assessor which format they expect for evidence exports.

Who owns, implements and tests alternate work site controls

Your organization owns the decision about which alternate work sites may be used and which security requirements apply at them. That ownership cannot be delegated to a vendor. The 03.10.06 requirement asks you to determine the alternate work sites allowed for employees and to define the security requirements employed at those sites, and NIST's discussion makes clear that employees' private residences are included when you designate them. Leadership, the security office and HR or facilities typically share this work.

Approval of sites: Decide whether home offices, co-working spaces or other facilities are permitted, and record who approves each category.
Defined requirements: Write the security requirements for alternate sites, such as locked storage, screen privacy, device handling and visitor limits. This list is the organization-defined parameter you must assign.
Policy and procedures: Maintain the physical protection policy and the procedure for approving and reviewing alternate sites.
Staff accountability: Ensure personnel who use alternate sites know the rules and sign acknowledgments.
Ongoing review: Reassess sites and requirements when roles, locations or threats change.

Before engaging anyone, confirm that your system security plan already describes which alternate sites are in scope.

Questions about alternate work site cost, effort and outsourcing

Can employees work from home under NIST SP 800-171 Rev. 3?

Yes, if the organization decides that home offices are an allowed alternate work site and defines the security requirements that apply there. Requirement 03.10.06 does not ban homes. It asks the organization to determine which alternate work sites employees may use and to employ defined security requirements at those sites. NIST's discussion of the requirement explicitly includes employees' private residences among alternate work sites. The practical question is therefore not whether home work is permitted but which roles, data types and devices are allowed to work there, and what the assessor will see as proof of those decisions.

How much effort does an alternate work site program take?

Effort depends mainly on how many sites and roles are in scope, how many security requirements the organization sets for them, and how much of that already exists in the environment. The work usually falls into four parts: deciding which sites are allowed, writing the requirements for each site type, configuring devices and access so the requirements can be met, and collecting evidence that people follow them. The Rev. 3 requirement has one organization-defined parameter, so the list of site requirements is the central artifact. No duration or effort figure is supplied for this requirement, so ask any provider to break the estimate into these four parts and show which assumptions drive it.

Can a partner set up the alternate work site controls for us?

A partner such as DeployOpen can help prepare the systems and evidence behind the requirement, but the organization owns the decision about which sites are allowed and which requirements apply. In practice, an implementation partner can configure managed devices, remote access paths, endpoint settings and logging, and document the procedures and records an assessor will examine. Only an independent assessor can judge whether the requirement is met, and the organization remains responsible for its compliance. Ask any provider to state in writing which parts of the work they perform, which they support, and which remain with your own staff.

What does our team need to supply before a partner starts?

The team needs to supply the decisions and the context that a partner cannot invent. Typically this includes the current list of roles that work remotely, the types of CUI those roles handle, the devices and networks in use, the existing policy and procedures for physical protection, and the names of people who approve alternate site use. Interview access matters too, because the assessment method for this requirement includes interviewing the personnel who approve and use alternate sites. Agree on these inputs in the written scope so that delays do not change the cost or timeline.

Are the organization-defined parameter values for 03.10.06 fixed?

No. The requirement has one organization-defined parameter, which is the set of security requirements to be employed at alternate work sites, and NIST does not assign its value. If a federal agency does not specify the value, the nonfederal organization must assign it to complete the requirement. Assessors check that the value is defined, so a written and approved list is required. Pending rule changes may also affect who sets the values. A proposed FAR overhaul published on 23 June 2026 would require ODP values published by the DoW CIO for contractors handling CUI, but that rule was not final as of October 2026, so confirm the current contract language with the contracting officer.

Does the assessment cost change if we allow home offices?

Yes, usually, because the assessor must examine more evidence and may interview more people. The assessment for 03.10.06 uses the examine, interview and test methods, with two determination statements plus one that checks the parameter is defined. Allowing home offices adds sites to examine, personnel to interview and mechanisms to test. Whether that increase is material depends on how uniform the remote setup is. A small number of standard managed devices is easier to assess than many personal devices with different configurations. Ask the assessor how they will sample sites before agreeing to a fee.

Which parts of the program recur after the first setup?

Most recurring work comes from keeping the site list and its requirements current, reviewing approvals, and collecting evidence for each assessment cycle. Recurring items usually include reviewing who holds approval for alternate site use, updating requirements when roles or devices change, checking that remote endpoints still meet the defined settings, and retaining records of those checks. The one-time items are the initial decision, the written parameter, and the first configuration. Ask any provider to separate one-time fees from ongoing support, and check whether a retainer covers periodic review and evidence preparation.

How DeployOpen scopes and prepares 03.10.06 evidence

DeployOpen approaches 03.10.06 Alternate work site as a scoped engagement inside your own infrastructure. We help you decide which alternate work sites may be used, define the security requirements that apply at each one, and prepare the records an assessor will examine. Your organization owns the decisions, and an independent assessor or auditor reaches any conclusion about compliance.

How we scope

Confirm with your team which locations count as alternate work sites, including employees' private residences and other designated facilities.
Record in the written scope which systems, data types and user groups may be accessed from each alternate work site.
Agree in writing who sets the organization-defined security requirements for alternate sites, since NIST leaves those values to the organization.
Confirm the scope before work starts, because engagements are fixed-scope and quoted from the written scope.

How we build

Draft the list of security requirements for alternate work sites, covering device, network, storage and printing expectations.
Configure the self-hosted platforms in your environment so that access from approved alternate sites follows that list.
Set up approval workflows and access records that show who authorized each alternate site and when.
Test the remote access paths and device controls against the documented requirements before handover.

How we hand over

Deliver the alternate work site procedure, the approved site list and the security requirements document in your wiki or document system.
Provide version history for every policy and procedure so an assessor can see what changed, when and by whom.
Map each deliverable to the examine, interview and test objects that SP 800-171A Rev. 3 lists for 03.10.06, so your team knows what evidence exists.
Document test results and open items so your compliance lead can present them to the independent assessor.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, so alternate site rules can be reviewed as staffing changes.
Ask any prospective partner to confirm how it handles periodic review of the approved site list and the security requirements.
Confirm with your assessor which evidence they expect for interviews with personnel who approve and use alternate sites.
Plan a review after any change to remote access tools, device standards or the list of approved locations.