Alternate Work Site PE-17
Physical and Environmental Protection · Moderate baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds PE-17 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Physical and Environmental Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
PE-17 (Alternate Work Site) is about letting people work on the system from places other than the main facility — a home office, another site — without lowering security. You decide which sites are allowed, require the same protections there, check that they hold, and give remote staff a way to report a problem. It is a Physical and Environmental Protection control that enters at the Moderate baseline.
What good looks like
- Name the allowed work sites (for example, an administrator's home office) rather than leaving ‘anywhere’ as the default.
- Require the same controls off-site as on-site — secure remote access, a locked space, no shoulder-surfing.
- Assess that those controls actually hold at the alternate site, not just on paper.
- Give remote staff a clear way to reach security and report an incident — a phone number or address they already have.
- This leans on Remote Access (AC-17) — the secure connection is what makes off-site work safe.
Framework mapping
How to move it toward Implemented
- List the alternate work sites allowed for this server and the rule for each: connect only over the VPN (Virtual Private Network — an encrypted tunnel) or an equivalent, never the open internet.
- Harden the remote path on the server: in
/etc/ssh/sshd_configsetPasswordAuthentication noso SSH (Secure Shell — the encrypted remote-login protocol) is key-only, and restrict which addresses can reach it. - Write down the incident-reporting contact remote staff should use, and confirm they have it.
- Attach that alternate-site list and the SSH hardening note as hardening evidence on the asset, naming
PE-17in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.