PE-17 Alternate Work Site

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Moderate, High	Organization	None

Related controls: AC-17, AC-18, CP-7

Control statement

• a. Determine and document the [Assignment: organization-defined alternate work sites] allowed for use by employees;
• b. Employ the following controls at alternate work sites: [Assignment: organization-defined controls];
• c. Assess the effectiveness of controls at alternate work sites; and
• d. Provide a means for employees to communicate with information security and privacy personnel in case of incidents.

NIST discussion

Alternate work sites include government facilities or the private residences of employees. While distinct from alternative processing sites, alternate work sites can provide readily available alternate locations during contingency operations. Organizations can define different sets of controls for specific alternate work sites or types of sites depending on the work-related activities conducted at the sites. Implementing and assessing the effectiveness of organization-defined controls and providing a means to communicate incidents at alternate work sites supports the contingency planning activities of organizations.

Assessment objectives (SP 800-53A)

Objectives and methods for PE-17

Determine if:

• PE-17a. [Assignment: organization-defined alternate work sites] are determined and documented;
• PE-17b. [Assignment: organization-defined controls] are employed at alternate work sites;
• PE-17c. the effectiveness of controls at alternate work sites is assessed;
• PE-17d. a means for employees to communicate with information security and privacy personnel in case of incidents is provided.

Examine: Physical and environmental protection policy; procedures addressing alternate work sites for organizational personnel; list of security controls required for alternate work sites; assessments of security controls at alternate work sites; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel approving the use of alternate work sites; organizational personnel using alternate work sites; organizational personnel assessing controls at alternate work sites; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for security and privacy at alternate work sites; mechanisms supporting alternate work sites; security and privacy controls employed at alternate work sites; means of communication between personnel at alternate work sites and security and privacy personnel.

Policy statement

• The Chief Information Security Officer shall determine and document Fill in: alternate work sites allowed for use by employees Typical: employees’ homes, under an approved telework agreement, and other organization facilities as the alternate work sites allowed for use by employees, and the Supervisor shall approve each employee’s use of them. (PE-17a)
• The following controls shall be employed at alternate work sites: Fill in: controls to be employed at alternate work sites Typical: organization-issued devices, or personally owned devices the organization has approved and manages under its external system terms (AC-19, AC-20), connected through the approved remote access methods (AC-17), with full-disk encryption and screen lock (AC-11); a workspace where screens and conversations are not overseen or overheard; paper and media kept secured and not left unattended; and no printing of information not approved for public release on personal printers. (PE-17b)
• The Chief Information Security Officer shall assess the effectiveness of controls at alternate work sites at least annually, through an employee self-assessment and the device compliance data from endpoint management, and act on the gaps found. (PE-17c)
• The Chief Information Security Officer shall provide a means for employees at alternate work sites to communicate with information security and privacy personnel in case of incidents, available at all hours, and employees shall report incidents through it as the Rules of Behavior require (IR-6). (PE-17d)

Federal systems

Under 5 U.S.C. § 6502, each executive agency’s telework policy must require a written agreement between an agency manager and each employee authorized to telework, outlining the specific work arrangement, which is mandatory for any employee to telework (subsection (b)(2)); must be part of the agency’s continuity of operations plans (subsection (b)(5)); and must enumerate when employees may temporarily work from approved overseas locations (subsection (b)(6)). Text checked in the United States Code, 2024 edition, as of October 2026.

• No employee shall telework without the written telework agreement 5 U.S.C. § 6502(b)(2) requires, and the agreement shall reference the alternate work site controls in this policy. (PE-17a)
• Work from an overseas location shall be allowed only in the circumstances the agency’s telework policy enumerates under 5 U.S.C. § 6502(b)(6). (PE-17a)

From the Physical and Environmental Protection Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PE-17 asks you to decide and document which alternate work sites employees may use (a), set the controls that apply there (b), assess whether those controls work (c), and give employees a way to reach security and privacy staff about incidents (d). NIST’s PE-17 discussion says alternate work sites include government facilities and employees’ private residences. It says they are distinct from alternate processing sites but can serve as alternate locations during contingency operations, and that organizations can set different controls for different types of site. PE-17 is in the Moderate and High baselines, not Low.

Unlike the rest of the PE family, PE-17 stays with the organization even for a cloud-hosted system: the provider has no part in employees’ homes. For detail on securing telework and remote access, NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security (July 2016), is the final version as of October 2026; a Rev. 3 pre-draft call for comments closed in October 2020, and csrc.nist.gov lists no later draft.

Common implementations. A telework policy names the allowed sites, and each teleworker’s supervisor approves the arrangement. The controls at home are mostly the device’s: an organization-issued laptop, or a personally owned device the organization has approved and enrolled in its device management (AC-20), with full-disk encryption and screen lock, reaching the system only through the approved remote access methods (AC-17) that the remote access standard lists, with its device tiers. The Rules of Behavior, which every user signs, carry the user’s side: only issued or approved devices (AC-19), remote access only through approved methods, a private workspace, paper and media secured, no printing on personal printers, locking the screen (AC-11), and reporting incidents (IR-6). Each year teleworkers complete a short self-assessment of their workspace, and the CISO reviews it with the endpoint compliance data.

Organization-defined parameters. Typical values, from the Physical and Environmental Protection policy, which your organization may set differently:

Parameter	Typical value
Alternate work sites allowed for employees (a)	Employees’ homes, under an approved telework agreement, and other organization facilities
Controls employed at alternate work sites (b)	Organization-issued devices, or personally owned devices the organization has approved and manages under its external system terms (AC-19, AC-20), connected through the approved remote access methods (AC-17), with full-disk encryption and screen lock (AC-11); a workspace where screens and conversations are not overseen or overheard; paper and media kept secured and not left unattended; and no printing of information not approved for public release on personal printers

The policy has the CISO determine and document the allowed sites and each employee’s supervisor approve their use. For PE-17c, the CISO assesses the controls at least annually, through an employee self-assessment and the device compliance data from endpoint management, and acts on the gaps found. For PE-17d, the CISO provides a means, available at all hours, for employees at alternate work sites to report incidents to security and privacy staff, and employees use it as the Rules of Behavior require. Other sites, such as hotels or public places, are not on the list, so working from them is outside the policy unless the CISO adds them with their own controls.

Evidence assessors ask for.

• The documented list of allowed alternate work sites, and the controls for each type
• A sample of teleworkers’ approvals or telework agreements
• Endpoint management data showing teleworkers’ devices are organization-issued or approved and enrolled, encrypted and locking
• Remote access logs showing connections only through the approved methods
• The last annual self-assessment results and the actions taken on gaps
• How teleworkers report incidents, and the Rules of Behavior they signed

Inheritance. None from a cloud or hosting provider. PE-17 is usually a common control the CISO provides for every system that teleworkers use, recorded as such in each system security plan. The device controls it relies on are inherited from the endpoint management and remote access services, and their implementation belongs with AC-17, AC-11 and AC-19.

Common findings.

• A telework policy that names the sites but sets no security controls for them.
• No assessment of controls at alternate work sites, or one that never happens after the first year.
• Personal printers, or home computers the organization has not approved or does not manage, used for work, contrary to the policy.
• Teleworkers who do not know how to report an incident outside business hours.
• Telework agreements missing for some teleworkers, or not referring to the security requirements.

Enhancements in the Moderate baseline. None. PE-17 has no enhancements.

Federal systems (as of October 2026). Under 5 U.S.C. § 6502, the head of each executive agency must establish a policy under which eligible employees may be authorized to telework (subsection (a)). The policy must require a written agreement between an agency manager and each employee authorized to telework, outlining the specific work arrangement, and the agreement is mandatory for any employee to telework (subsection (b)(2)). It must be incorporated into the agency’s continuity of operations plans (subsection (b)(5)) and must enumerate when employees may temporarily work from approved overseas locations (subsection (b)(6)). Text checked in the United States Code, 2024 edition. The PE-17 clause’s federal block lets no employee telework without that written agreement, has the agreement reference the policy’s alternate work site controls, and allows overseas work only in the circumstances the agency’s telework policy enumerates.

Artifacts

• Physical and Environmental Protection Decision Worksheet
• Physical and Environmental Protection Policy
• Rules of Behavior