CCI-002975

Implementation Guidance

The organization being inspected/assessed defines and documents security controls to employ at alternate work sites, which must include all applicable building and safety codes for the information system's environment DoD has determined the security controls are not appropriate to define at the Enterprise level, but must include all applicable building and safety codes for the information system's environment.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented security controls to ensure the organization being inspected/assessed defines security controls to employ at alternate work sites, which must include all applicable building and safety codes for the information system's environment. DoD has determined the security controls are not appropriate to define at the Enterprise level, but must include all applicable building and safety codes for the information system's environment.

Compelling Evidence

1.) Telework policy, Telework Agreement, or other similar documentation containing organizationally-defined security controls