CMMC Remote Work and CUI: Home Offices, Personal Devices and What 800-171 Allows

Yes, your people can work from home with controlled unclassified information (CUI). CMMC remote work rules come from NIST SP 800-171 Rev 2, and nothing in it bans home offices or travel. What it requires is control: remote access that you approve, encrypt and watch, written safeguards for the places people work outside the office, and firm limits on personal laptops and phones touching CUI.

The hard part for a small shop is that remote work quietly pulls new devices and networks into scope. A home laptop that opens a drawing is a CUI asset. A personal phone that syncs company email might be one too. This post walks through the requirements that apply, what an assessor looks for under NIST SP 800-171A, and three setups that work for a 5 to 50 person company.

The requirements behind CMMC remote work and CUI

No single requirement is called "remote work". Instead, about a dozen requirements across four families of NIST SP 800-171 Rev 2 decide whether your remote setup passes. Here they are with their weights in the DoD Assessment Methodology used for your Supplier Performance Risk System (SPRS) score.

Requirement	Plain English	SPRS points
3.1.12	Monitor and control remote access sessions	5
3.1.13	Encrypt remote access sessions	5
3.1.14	Route remote access through managed access control points	1
3.1.15	Authorize remote use of privileged commands	1
3.1.18	Control connection of mobile devices	5
3.1.19	Encrypt CUI on mobile devices	3
3.1.20	Verify and control connections to and use of external systems	1
3.5.3	Multifactor authentication for network and remote access	3 or 5
3.10.6	Enforce safeguards for CUI at alternate work sites	1
3.13.7	Prevent split tunneling	1
3.13.12	Block remote activation of cameras and microphones	1

Four of these carry 5 points each, and under 32 CFR 170.21 requirements worth more than 1 point generally cannot sit on a plan of action and milestones (POA&M) for a conditional Level 2 status. Remote access is something to get right, not something to plan for later. You can see how these gaps move your number in the free SPRS calculator.

Remote access: 3.1.12, 3.1.13 and 3.1.14

800-171A breaks 3.1.12 into four objectives: remote access sessions are permitted [a], the permitted types are identified [b], sessions are controlled [c], and sessions are monitored [d]. In practice that means you write down how people are allowed to connect (for example: company laptop, company VPN, or the cloud suite's web apps with multifactor sign-in), block other methods, and keep logs that show who connected and when.

3.1.13 asks you to identify [a] and implement [b] cryptography that protects remote sessions. Current TLS (transport layer security) for cloud apps and IPsec or TLS for a VPN (virtual private network) meet the intent. Because these sessions carry CUI, 3.13.11 also applies: the cryptography must be FIPS-validated. Our post on FIPS-validated encryption explains how to check a product.

3.1.14 asks for managed access control points that are identified [a] and that remote access is routed through [b]. For a small shop that is one VPN gateway or one cloud identity provider, not a mix of remote desktop ports opened on a router years ago. Consumer screen sharing tools installed "just for that one time" fail all three requirements, so find and remove them.

The home office: 3.10.6

3.10.6 reads: enforce safeguarding measures for CUI at alternate work sites. NIST's discussion names the private residences of employees as an example of an alternate work site, and it lets you define different rules for different kinds of sites. The two objectives are that the safeguards are defined [a] and enforced [b].

Defined means written. A one-page telework rule set, signed by each remote worker, is a reasonable way to show it. A starting list:

• CUI is handled only on company-issued, managed devices.
• Screens lock automatically and face away from windows and shared spaces.
• No printing of CUI at home unless approved; approved printouts are stored locked and shredded.
• Family members and guests do not use work devices.
• Work happens on a secured home network, never open public Wi-Fi without the company VPN.
• Lost or stolen devices are reported the same day.

Enforced means you can show it happens: device settings that force screen lock and encryption, the signed acknowledgments, and a record of the occasional check-in. Assessors interview people, so make sure remote staff can explain the rules in their own words.

NIST points to two telework guides for more detail: SP 800-46 for enterprise telework security and SP 800-114 for users' own devices. Neither is a CMMC requirement, but both are useful when you write your rules.

Personal devices: 3.1.20, 3.1.18 and 3.1.19

3.1.20 covers external systems, and NIST's discussion says plainly that these include personally owned systems and devices. The six objectives ask you to identify, verify and control/limit both connections to external systems and their use [a] to [f]. You set the terms and conditions, and if you cannot set them, you restrict your people from using those systems.

For most small contractors the cleanest answer is a rule: no CUI on personal computers, ever. Any device that stores, processes or transmits CUI is a CUI asset under 32 CFR 170.19, which means it goes in your asset inventory, your system security plan (SSP) and your assessment. You do not want an employee's family computer in that list.

Phones are the harder case. 3.1.18 (5 points) asks you to control mobile device connections, and 3.1.19 (3 points) asks you to encrypt CUI on mobile devices. If phones read email that may contain CUI, enroll them in the device management that comes with your cloud suite, require a passcode and encryption, and keep the ability to wipe company data. If you would rather not, write a policy that keeps phones off CUI entirely and configure the suite to enforce it. A later post in this series goes deeper on bring your own device.

Split tunneling, cameras and remote admin

Three 1-point requirements round out the picture.

• 3.13.7, split tunneling. When a laptop is on the company VPN, it should not also talk directly to the internet over a separate path. Most VPN products have a setting for this. Turn split tunneling off for in-scope devices and keep a screenshot.
• 3.13.12, collaborative devices. Cameras and microphones must not be switched on remotely, and users must be able to tell when they are in use. Laptop indicator lights cover most of this; meeting room devices need a look.
• 3.1.15, remote privileged commands. If your IT provider administers systems remotely, that access must be authorized and limited. Write down who has it and through which tool.

Three setups that work for a small shop

Setup	How it works	Trade-off
Company laptops plus VPN	Managed, encrypted laptops connect through one VPN with multifactor sign-in; logs are kept	Every remote laptop is in scope and must meet all 110 requirements
Cloud suite only	CUI lives in a suitable cloud tenant; managed devices sign in with multifactor; downloads restricted	Depends on the tenant and the device rules being set correctly
Virtual desktop	CUI stays on a hosted desktop; the home device only sends keyboard and mouse and receives the screen	More setup and cost, but the home device can drop out of scope

The third option has a specific basis in the rule. Under 32 CFR 170.19, an endpoint hosting a VDI (virtual desktop infrastructure) client configured so that no CUI is processed, stored or transmitted beyond the keyboard, video and mouse sent to the client is an Out-of-Scope Asset. The configuration must actually block copy, paste, printing and file transfer to the local device, and you should document how. This is the same scope-shrinking idea behind a CUI enclave, and our scoping guide explains the asset categories in more depth.

Multifactor authentication sits under all three. Our post on whether CMMC requires MFA covers the 3.5.3 details.

What to do this week

1. List everyone who touches CUI outside the office and the devices they use. Mark any personal device.
2. Write down the allowed remote access methods and remove anything else, including old remote desktop ports and consumer screen sharing tools.
3. Confirm remote sessions are encrypted with FIPS-validated modules and that sign-ins require multifactor authentication.
4. Turn off split tunneling on the VPN and save the setting as evidence.
5. Write a one-page telework rule set for 3.10.6 and get each remote worker to sign it.
6. Decide your phone rule: enrolled and encrypted, or kept off CUI entirely, and configure the suite to match.

CMMC Map, CMMC compliance software for small defense contractors, scores these requirements alongside the rest of the 110 for free. The $149 a month plan generates the SSP sections, POA&M and policies, including the remote access and alternate work site language, from your answers. CMMC sits on three self-assessed paths today, Level 1 (Self), Level 2 (Self) and the SPRS score, and remote work controls matter on every path that involves CUI. This post is explanatory content, not legal advice.