Does NIST 800-171 allow CUI work from home, and what does it require?
Yes, remote and hybrid work is permitted under NIST SP 800-171 when the organization determines which alternate work sites its employees may use and applies its own security requirements at those sites, which is what 03.10.06 Alternate work site asks for. NIST's Rev. 3 discussion says alternate work sites include employees' private residences and other facilities the organization designates, so a home office is in scope by default. Whether the arrangement passes depends less on the address than on how remote access to CUI is designed, and that design is governed mainly by 03.01.12 Remote access.
For remote access, 03.01.12 requires usage restrictions and configuration and connection requirements for each type of remote access the organization allows, authorization of each type before any connection is made, and routing of remote access through authorized and managed access control points. It also requires authorization for remote execution of privileged commands and for remote access to security-relevant information. Before a single employee connects from home, confirm which remote access methods are allowed, document their configuration in the system security plan, and check how split tunneling is set, since the CMMC Assessment Guide Level 2 recommends disabling it so that all traffic, including internet traffic, passes through the VPN.
The organization owns its controls. An implementation partner can prepare the remote access design, configuration and evidence, but only an independent assessor issues assessment results, and the organization remains responsible for what its staff do at home. Ask a prospective partner to show how the alternate work site rules, remote access configuration and mobile multifactor authentication will be documented and tested, and ask the assessor which evidence they expect to examine and which people they will interview.
Which remote access design keeps the scope manageable
In this design, a staff member's laptop connects through a VPN and works directly with systems that store, process or transmit CUI. The home device therefore becomes part of the assessed environment, and NIST SP 800-171 Rev. 3 requirement 03.01.12 (Remote access) applies to every connection. That requirement asks the organization to set usage restrictions and configuration and connection requirements for each allowed type of remote access, to authorize each type before connections are made, to route remote access through authorized and managed access control points, and to authorize remote execution of privileged commands and remote access to security-relevant information.
- Usage restrictions and configuration: Document which remote access types are allowed, such as the corporate VPN, and which are not.
- Authorization before connection: Record the approval of each access type, not only the user account.
- Managed access points: Route all remote sessions through the organization's own VPN concentrator or gateway, where logging and enforcement occur.
- Privileged commands: Authorize remote administrative actions separately and log them.
- Split tunneling: The CMMC Assessment Guide Level 2 recommends disabling split tunneling on all devices so that all traffic, including internet traffic, passes through the VPN. Expect this to raise bandwidth and support load, and test it with real staff workloads before rollout.
Confirm with your assessor how they will sample remote sessions and home devices, since each device you permit to connect adds evidence to collect.
Virtual desktop infrastructure (VDI) keeps the data inside a hosted desktop. The staff member's endpoint runs a client that sends keyboard, video and mouse signals to the desktop, while the files, applications and CUI stay on the hosted side. Under 32 CFR 170.19(c), an endpoint hosting a VDI client is treated as out of scope when it is configured so that no CUI is processed, stored or transmitted beyond those keyboard, video and mouse signals. The hosted desktop and its session infrastructure remain in scope and must still meet the remote access requirements for the connection path.
- Endpoint configuration: Verify that clipboard, local drive, printer and USB redirection are blocked or disabled where CUI is displayed, so that no CUI leaves the session.
- Hosted side in scope: The virtual desktops, brokers and gateways must be documented in the system security plan and covered by 03.01.12 and related controls.
- Session controls: Define timeouts, logoff behavior and screen capture restrictions for the hosted session.
- Evidence of configuration: Keep the client and policy settings that show the endpoint is limited to display and input.
- Vendor confirmation: Confirm with your VDI vendor and assessor which redirection features can be disabled and how that is evidenced, since products differ.
Ask your assessor to confirm the VDI scope treatment against your exact client configuration before you rely on it for scoping.
The simplest scope is no remote access to CUI at all. Staff who handle CUI work only from facilities the organization controls, and home devices never connect to CUI systems. This design removes home devices from the assessed environment, although the alternate work site requirement under 03.10.06 still applies if any employee works from a private residence and the organization has designated it. In that case the organization must decide whether the residence is an allowed alternate work site and set the security requirements for it.
- Policy prohibition: Write a rule that bars CUI access from personal or home devices and make it enforceable through account controls.
- Technical enforcement: Block remote access to CUI repositories from outside the managed network, so the policy is backed by configuration.
- Scoring effect: The CMMC scoring methodology in 32 CFR 170.24 does not deduct points for remote access, wireless or mobile device requirements (3.1.12, 3.1.16, 3.1.18) when the company does not permit those capabilities, which can simplify the assessed score.
- Alternate work site decision: If staff occasionally work from home, document whether that is an allowed alternate work site under 03.10.06.
- Operational cost: Expect pressure from staff and contracts that need flexible work, so test the policy against real business needs first.
Confirm with your contracting officer and assessor that the prohibition is acceptable for the contract and that the scoring treatment matches your environment.
What multifactor authentication on mobile devices must cover
When a phone or tablet can reach a system holding CUI, the remote access, identification and authentication, and maintenance requirements apply together. The cards below separate the mobile MFA expectation from the remote access controls it complements and the Rev. 3 numbering changes that affect how you map them.
MFA when a mobile device reaches CUI
The CMMC Assessment Guide Level 2 says multifactor authentication is required when a mobile device is used to access a system or application containing CUI. This applies to a managed corporate phone or tablet as well as a personal device used for work email or a CUI application. Confirm with your assessor which mobile access paths exist in your environment, and whether each one prompts for a second factor before CUI is displayed.
Link to IA.L2-3.5.3
The Assessment Guide ties mobile MFA to IA.L2-3.5.3, the Level 2 identification and authentication practice, which complements the remote access practices AC.L2-3.1.12 to 3.1.15 and MA.L2-3.7.5. Auditors often test these together, so a mobile sign-in that skips the second factor can fail more than one practice. Map each mobile access path to both the authentication control and the remote access control in your system security plan.
Device management expectations
MFA alone does not show that a phone is controlled. Assessors typically ask whether mobile devices are enrolled in a management tool, whether screen locks and encryption are enforced, and whether a lost or departing user's device can be wiped or have its access revoked. Ask your assessor which device management evidence they expect for personal devices and which they accept for company-issued devices.
Rev. 3 consolidates 03.01.14 and 03.01.15
Rev. 2 treated remote access execution and remote access to security-relevant information in separate requirements, 3.1.14 and 3.1.15. Rev. 3 withdrew both and incorporated them into 03.01.12 Remote access, so one requirement now covers usage restrictions, authorization before connection, routing through managed access points, and remote privileged commands. Update your SSP so older Rev. 2 references are traced to 03.01.12.
Where 03.13.07 is addressed
NIST states that withdrawn requirement 03.13.07 (Rev. 2 3.13.7, which concerned split tunneling) is addressed by 03.01.12 together with 03.04.02 and 03.04.06. The Assessment Guide recommends disabling split tunneling so all traffic, including internet traffic, passes through the VPN. Confirm with your assessor that your mobile and remote configurations meet this expectation through these three requirements.
What happens to the SPRS score if remote access is not allowed
If an organization does not permit remote access, wireless access or mobile device access to systems that handle CUI, the DoD assessment methodology does not deduct points for the related requirements, 3.1.12, 3.1.16 and 3.1.18. The methodology is explicit that these deductions are not applied when the capability is not permitted. Read that carefully, though: this is a scoring rule, not a waiver. The requirements still exist, and the organization is still responsible for showing that the prohibition is real. An assessor will expect the prohibition written into the system security plan, with the boundary and the allowed access paths described so that the absence of remote access is a documented design decision rather than an assumption.
The prohibition also has to be verified. Before the assessment, the team should check that the technical controls actually block what the policy forbids: VPN concentrators and firewall rules that refuse inbound sessions to the enclave, mobile device management policies that keep CUI applications off unmanaged phones and tablets, and wireless configurations that do not reach the CUI network. Each check should produce evidence, such as configuration exports or test results, that matches the SSP statement. A prohibition that exists only in a policy document will not survive an examination of the system.
The scope decision should be made before any assessment, because the score submitted to SPRS depends on it. DFARS 252.204-7019 and 252.204-7020 govern the assessment and score submission process, and the score reflects the environment as it was described and scored at that time. Changing the position later, for example by allowing a VPN for a few staff members, brings the deducted requirements back into scope and changes the result. Confirm with the contracting officer and your assessor how the decision will be recorded, and treat the choice between a no-remote-access enclave and a controlled remote path as a boundary decision that needs sign-off before the SSP is finalized.
How to bring remote and hybrid work into scope, step by step
This sequence turns remote and hybrid work from an informal habit into a documented, configured and verified part of the NIST SP 800-171 boundary, so an assessor can test each decision against evidence. The organization owns every decision, and an independent assessor reaches the final judgment.
Decide whether remote work with CUI is allowed
Leadership, with input from the security and HR owners, decides whether employees may view, process or store CUI away from the organization's facilities at all. The output is a written decision that names the roles allowed to work remotely with CUI and the roles that may not. If the answer is no, the organization can still score and assess the environment on that basis, because the scoring methodology does not deduct points for remote access capabilities the company does not permit. Record the decision with its date and approver so it can be tested later.
List permitted sites and access types
Security engineering and operations staff list every alternate work site the decision allows, such as employee residences or other facilities the organization designates, and every access type, such as VPN, virtual desktop or managed mobile access. For each site and access type, record who uses it and which systems hold CUI. The output is an inventory that maps sites and access types to the requirement 03.10.06 alternate work site determination and the remote access requirement 03.01.12. Any site or access method not on the list is treated as unauthorized.
Document each site and access type in the system security plan
The system security plan describes each permitted site, each access type, the configuration rules that apply to it, and who authorizes it. Security-related settings, such as the security requirements the organization defines for alternate sites, are written down with their owner and review point. The output is a plan section that an assessor can read and compare to the actual configuration. Confirm with the contracting agency how it wants remote access described, because the agency's agreement can shape what must be recorded.
Configure remote access and enforce split tunneling rules
Engineers configure each approved access type against the usage restrictions and connection requirements written in the plan, and route all remote sessions through managed, authorized access points. The CMMC Assessment Guide Level 2 recommends disabling split tunneling so that all traffic, including internet traffic, passes through the VPN. The output is a configuration baseline per access type, with remote execution of privileged commands and access to security-relevant information restricted to named roles. Engineers keep the change records that show when each setting was applied and by whom.
Enforce multifactor authentication on mobile and remote devices
Administrators confirm that multifactor authentication applies to every remote session and to every mobile device used to reach a system or application containing CUI. The CMMC Assessment Guide Level 2 treats this as a requirement that complements the remote access requirements and the maintenance requirement for remote maintenance. The output is an authentication policy export or screenshot for each access path, plus a test log that shows a session is refused when the second factor is missing. Confirm the authenticator types with the organization's identity owner, since they affect how the requirement is evidenced.
Verify the controls in an internal review
An internal reviewer who did not configure the environment tests each remote path against the plan. The reviewer attempts connections from an unapproved site, a split-tunnel route and a session without the second factor, and checks that each attempt fails and is logged. The output is a dated review record listing each test, its result, and the corrective action for any failure, which feeds the plan of action and milestones where a gap remains. Retain the logs, since they are the primary evidence an assessor will ask to see.
Hand the evidence package to an independent assessor
The organization assembles the plan, the site and access inventory, the configuration baselines, the authentication evidence and the internal review record, then gives them to an independent assessor or the agency that will judge the environment. DeployOpen can prepare the systems and evidence for this step, but it does not issue assessment results or certifications. The output is a complete evidence set indexed by requirement, with open questions listed so the assessor's findings can be answered in writing. Ask the assessor which evidence format it expects before collecting anything.
Who owns the remote work controls and who prepares the evidence
Remote and hybrid access to CUI touches four parties with different jobs. The organization decides which sites and connections are allowed, an implementation partner builds and documents the controls, the contract owner decides whether the result is acceptable, and an independent assessor tests it. DeployOpen prepares systems and evidence but does not issue reports or certificates.
Organization owns site rules and access
The organization decides which alternate work sites are allowed under 03.10.06, which remote access types are authorized before any connection is made, and who may approve exceptions. These decisions belong to named owners, recorded in the system security plan and approved by leadership. Check that every rule names an accountable role and that someone reviews access decisions on a set schedule.
Partner configures VPN, VDI and MFA
An implementation partner can configure the VPN, virtual desktop infrastructure, multifactor authentication and logging that the organization has chosen, and it can disable split tunneling so all traffic passes through the VPN. The partner also writes configuration records and collects screenshots, exports and logs that show each setting is in place. Ask the partner which settings it will change, which it will only document, and who holds administrator credentials after handover.
Contract owner decides acceptance
The contracting officer or agency program office decides whether the organization's remote work approach meets the contract. Under the DoW class deviation dated 3 September 2026, contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2. Confirm early which revision, scoring method and remote access position the contract expects, and get that agreement in writing before the boundary is drawn.
Independent assessor tests and reports
An independent assessor examines the implemented controls, interviews staff and tests whether remote access behaves as documented. Only the assessor or certification body issues a report or score that a government customer will rely on. Ask any assessor how it will test remote sessions, mobile MFA and VDI scoping, and whether it has independence from the partner that configured the environment.
Common questions about remote work under NIST 800-171
Can staff handle CUI from home under NIST SP 800-171?
Yes, if the organization allows it and defines the conditions. NIST's Rev. 3 requirement 03.10.06 (Alternate work site) requires the organization to determine which alternate work sites employees may use and to set security requirements for those sites. NIST's discussion of that requirement states that alternate work sites include employees' private residences and other facilities the organization designates. The practical question is not whether home work is possible but whether the organization has written down which sites are approved, what each site must provide, and how that is enforced. Your organization owns that decision. An implementation partner can help build the rules, the configuration and the evidence, but the policy and the approval belong to you.
Does a home office need its own separate site review?
Each approved alternate work site must meet the security requirements the organization has defined for it, so a home office is reviewed against those requirements rather than assessed as a separate facility. The review looks at what the requirements call for: who else can access the room, where screens face, whether devices are locked when unattended, whether printed CUI is stored or destroyed correctly, and whether the network path back to the organization is controlled. Ask your assessor how they expect the approval to be recorded, because the evidence is usually a documented site determination plus the signed-off conditions for each approved location. Reviews can be lighter for a documented remote setup than for a large facility, but the scope of what you must check depends on your own requirement set and the contract.
Does VDI take the home endpoint out of scope?
It can, when the endpoint is configured so that no CUI is processed, stored or transmitted beyond the keyboard, video and mouse signals. The CMMC rule at 32 CFR 170.19(c) treats an endpoint hosting a VDI client as out of scope under that condition. The word that matters is "beyond." If the client can save files locally, print, copy and paste into other applications, sync data or cache sessions, the endpoint may hold CUI and remain in scope. Verify the configuration against the actual client settings, check that the session host stays inside your boundary, and document the design in your system security plan. Confirm with your assessor and contracting officer how they treat your specific VDI design before you rely on it for scoring.
Is split tunneling required to be turned off for remote users?
Turn it off. The CMMC Assessment Guide Level 2 recommends disabling split tunneling on all devices so that all traffic, including internet traffic, passes through the VPN. The reason is visibility and control: with split tunneling, a laptop can reach the corporate network and the open internet at once, which means traffic leaving the organization is not inspected, logged or filtered by the same controls. Full tunneling routes that traffic through the access control points you manage, which supports the requirement to route remote access through authorized and managed points under 03.01.12 (Remote access). Expect some performance trade-offs for video and cloud applications, so test the design with real workloads before rollout.
Does MFA apply when staff use a phone to reach CUI?
Yes. The CMMC Assessment Guide Level 2 says multifactor authentication is required when a mobile device is used to access a system or application containing CUI. It also notes that the identification and authentication requirement 03.05.03 complements the remote access and mobile requirements. In practice, this means the phone app, browser or mobile client that reaches CUI must be covered by MFA, and the factor should be one the organization has chosen to meet its authenticator requirements. Engineers should check which mobile paths exist (email clients, collaboration apps, VPN clients on phones) and confirm each one enforces MFA. Document every mobile access path in the system security plan so the assessor can trace it.
What does banning remote access do to the SPRS score?
It can remove points from the deduction count, provided the company truly does not permit the capability. The 32 CFR 170.24 scoring methodology does not deduct points for remote access, wireless or mobile device requirements (3.1.12, 3.1.16, 3.1.18) when the company does not permit those capabilities. The condition is that the prohibition is real and enforced: the policy must say so, technical controls must block the paths, and the assessor must find no exceptions in practice. A ban written in a policy but bypassed through unmanaged personal email forwarding or unsanctioned file sync will not hold up. Ask your assessor to walk through how the prohibition is tested before you claim it in your score.
How DeployOpen prepares remote access controls for assessment
DeployOpen scopes remote access in writing before any configuration starts. The agreed scope names each allowed type of remote access, the users and devices that may use it, the access control points that every session must pass through, and the systems that hold CUI. That written scope is what lets the organization answer the 03.01.12 Remote access questions an assessor will ask: which connection types are authorized, how each is configured, and where it is routed. DeployOpen implements the VPN, the virtual desktop infrastructure (VDI) layer, multifactor authentication and session logging inside the client's own cloud accounts, data centers or networks. Where the client's design calls for it, the VPN is set to route all traffic, including internet traffic, through the tunnel, which is the approach the CMMC Assessment Guide Level 2 recommends for split tunneling.
Each configuration is documented as it is built, so the organization can show how it works rather than rely on memory. The documentation covers the VPN and VDI settings, MFA enrollment for remote users and mobile devices, the logs generated for remote sessions and the owner of each setting. Before the assessor arrives, the client should confirm which evidence its own assessor will request, such as configuration exports, screenshots of settings, log samples and records of who approved each connection type. DeployOpen prepares these artifacts for the client's review. It does not decide whether a control is met.
DeployOpen does not issue audit reports, attestations or certifications. The organization owns its controls and its system security plan, and the assessment is performed by the independent assessor the federal agency or contracting process recognizes. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ask any implementation partner to name, in that written scope, which configuration and evidence items are included and which remain with the organization or its assessor.
