Navigate

PE-17

PE-17: Alternate Work Site

The organization:

PE-17a.: Employs [Assignment: organization-defined security controls] at alternate work sites;

PE-17b.: Assesses as feasible, the effectiveness of security controls at alternate work sites; and

PE-17c.: Provides a means for employees to communicate with information security personnel in case of security incidents or problems.

Supplemental

Alternate work sites may include, for example, government facilities or private residences of employees. While commonly distinct from alternative processing sites, alternate work sites may provide readily available alternate locations as part of contingency operations. Organizations may define different sets of security controls for specific alternate work sites or types of sites depending on the work-related activities conducted at those sites. This control supports the contingency planning activities of organizations and the federal telework initiative.

CIA Levels
Confidentiality	moderate
Integrity	moderate
Availability	moderate

Overlays
Privacy (High), Privacy (Low), Privacy (Mod)

Related Controls

The controls below (if any) were marked by NIST as being related to PE-17.

Control	Description
AC-17	The organization: AC-17a.: Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and AC-17b.: Authorizes remote access to the information system prior to allowing such connections.
CP-7	The organization: CP-7a.: Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined information system operations] for essential missions/business functions within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable; CP-7b.: Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and CP-7c.: Ensures that the alternate processing site provides information security safeguards equivalent to those of the primary site.

Control

Description

AC-17

The organization:

AC-17a.: Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

AC-17b.: Authorizes remote access to the information system prior to allowing such connections.

CP-7

The organization:

CP-7a.: Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined information system operations] for essential missions/business functions within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable;

CP-7b.: Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and

CP-7c.: Ensures that the alternate processing site provides information security safeguards equivalent to those of the primary site.

Enhancements

The controls below (if any) add on to the requirements of PE-17.

Control	Description
No controls

Related CCIs

The CCIs below are tied to PE-17.

CCI	Definition
CCI-000985	The organization employs organization-defined security controls at alternate work sites.
CCI-000987	The organization assesses as feasible, the effectiveness of security controls at alternate work sites.
CCI-000988	The organization provides a means for employees to communicate with information security personnel in case of security incidents or problems.
CCI-002975	The organization defines security controls to employ at alternate work sites.