id: "PE-17" title: "Alternate Work Site" family: "PE" family_name: "Physical and Environmental Protection" sort_id: "pe-17" priority: "P2" implementation_level: "organization"
Determine and document the {{ insert: param, pe-17_odp.01 }} allowed for use by employees;
Employ the following controls at alternate work sites: {{ insert: param, pe-17_odp.02 }};
Assess the effectiveness of controls at alternate work sites; and
Provide a means for employees to communicate with information security and privacy personnel in case of incidents.
Guidance
Alternate work sites include government facilities or the private residences of employees. While distinct from alternative processing sites, alternate work sites can provide readily available alternate locations during contingency operations. Organizations can define different sets of controls for specific alternate work sites or types of sites depending on the work-related activities conducted at the sites. Implementing and assessing the effectiveness of organization-defined controls and providing a means to communicate incidents at alternate work sites supports the contingency planning activities of organizations.
Assessment Objective: {{ insert: param, pe-17_odp.01 }} are determined and documented;
Assessment Objective: {{ insert: param, pe-17_odp.02 }} are employed at alternate work sites;
Assessment Objective: the effectiveness of controls at alternate work sites is assessed;
Assessment Objective: a means for employees to communicate with information security and privacy personnel in case of incidents is provided.
Physical and environmental protection policy
procedures addressing alternate work sites for organizational personnel
list of security controls required for alternate work sites
assessments of security controls at alternate work sites
system security plan
privacy plan
other relevant documents or records
Organizational personnel approving the use of alternate work sites
organizational personnel using alternate work sites
organizational personnel assessing controls at alternate work sites
organizational personnel with information security and privacy responsibilities
Organizational processes for security and privacy at alternate work sites
mechanisms supporting alternate work sites
security and privacy controls employed at alternate work sites
means of communication between personnel at alternate work sites and security and privacy personnel