NIST 800-171 Controls · Physical Protection

PE.2.006 — Safeguard CUI at Alternate Work Sites

CMMC Level 2SPRS if unmet: -3HIGH priority~8h to implement

Enforce safeguarding measures for CUI at alternate work sites.

What PE.2.006 means in plain English

If employees work from home or at client sites with CUI, the same protection rules apply outside the office. They need to lock their laptop when they step away, use encrypted hard drives, avoid working on CUI at a coffee shop where someone can see their screen, and connect through VPN. Write a short remote work agreement that spells out these rules. A lost laptop with unencrypted CUI is a reportable incident.

The assessment question

“Do you have a documented telework or remote work policy that requires employees to protect CUI with encryption, screen privacy, VPN use, and physical security measures when working outside the primary office?”

How to implement PE.2.006

Write a one-page Remote Work / Telework Agreement that employees sign: it should require BitLocker encryption on all laptops, VPN use when accessing company systems, screen lock after 5 minutes of inactivity, and no CUI work in public spaces without a privacy screen.
Enable BitLocker on all company laptops: go to Control Panel > BitLocker Drive Encryption > Turn on BitLocker. Store recovery keys in your Microsoft 365 admin or a printed lockbox.
Deploy a VPN for remote access. WireGuard (free and open-source) or a pfSense-based VPN costs nothing beyond the hardware you likely already have.
Provide privacy screen filters (~$30 each) for employees who must occasionally work in shared spaces or during travel.
Include remote work security in your annual security awareness training so employees understand their responsibilities.

Evidence your assessor will ask for

Written Telework/Remote Work Policy or Agreement signed by employees
Evidence BitLocker or equivalent encryption is enabled on all remote laptops (management console screenshot)
VPN configuration and usage logs showing remote employees connect through VPN
Privacy screen filter distribution records or receipts
Training materials or sign-off showing remote security was covered in awareness training

Does AI prompt monitoring help with this control? Honestly, no.

PE.2.006 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Physical Protection controls

PE.1.001

Limit Physical Access to Systems

PE.1.002

Protect and Monitor Physical Facility

PE.2.003

Escort and Monitor Visitors

PE.2.004

Maintain Physical Access Audit Logs

PE.2.005

Control Physical Access Devices

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment