Most employees now work somewhere that is not your office. NIST SP 800-53 Rev 5 control PE-17 Alternate Work Site is the control that asks you to treat those places as part of your security program, and to be able to show how.
800-53 binds US federal systems and, through contract, some suppliers. For everyone else it is a reference. It is a useful one, since customers regularly ask how remote work is secured.
What the control asks
Four parts. Determine and document the alternate work sites allowed for use by employees. Employ controls you choose at those sites. Assess how effective the controls are. And provide a way for employees to communicate with security and privacy staff when incidents occur.
The guidance says alternate work sites include government facilities and the private homes of employees. It also notes they can serve as locations during contingency operations, though they are distinct from alternate processing sites. You may set different controls for different types of sites or activities.
What it means in practice
Write down where people are allowed to work: home, a coworking space, a customer site. Say which are not allowed, such as public cafes for certain work. For each type, list the controls required.
Typical controls are an encrypted and managed laptop, a screen lock, a screen privacy filter in shared spaces, a home router with a strong password and current firmware, no printing of sensitive documents, a locked room or drawer for any paper, and a secure way to report a lost device.
Then check. Control assessment can be a self attestation, a short checklist, or device posture data from your management tool. The point is evidence that you looked.
Evidence to collect
- The remote work or alternate work site policy listing allowed sites.
- The control requirements for each site type.
- Signed acknowledgements from employees.
- Self assessment checklists or results from remote worker reviews.
- Device management reports showing encryption, screen lock and patch status.
- The incident reporting channel for employees, with instructions.
- Training records on remote work security.
Common gaps
The policy says employees may work remotely and nothing else. Controls are named and never checked. The incident channel is an email address for a mailbox no one watches. Contractors working from their own devices are left out.
Another gap is paper. A remote policy that covers laptops but not printouts or notebooks is incomplete.
How to implement it
Draft a one page policy. Limit it to what you can verify. Add a short onboarding checklist and ask employees to confirm. Use device management to check encryption, patching and screen lock on every laptop, and keep the report each quarter.
Give people an easy way to report trouble: a dedicated channel and a phone number for lost devices. Test it once a year with a drill.
Review the policy after incidents and when work patterns change. If your company adds a new country or a shared workspace, add it to the documented list.
The control has no enhancements in the record, so the base text is all there is. Related controls include PE-2 and PE-3 for access, MP-5 for media transport, and your incident response family for reporting. Check any mapping to SOC 2 or ISO 27001 against the document your auditor uses, since sources differ.
Quick check
Does PE-17 apply to employees' homes?
Yes. The guidance names the private residences of employees as alternate work sites.
Is a signed policy enough evidence?
No. The control also asks you to assess effectiveness, so keep checklist results or device reports as well.
What must employees be able to do in an incident?
Communicate with security and privacy personnel. A monitored channel and clear instructions satisfy the intent.
