PE-17 Alternate work site
Requires the alternate work sites permitted for employees to be identified and documented, organization-defined controls to be applied at those sites, the effectiveness of those controls to be assessed, and a means to be
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Assessment records evaluating control effectiveness at alternate sites · Physical access / facilities
governing documentDocuments that govern the control
- Documented list of permitted alternate work site types and the controls required at each · Policy repository / GRC workspace
- Published contact route for security and privacy incidents from remote locations · Policy repository / GRC workspace
- Employee acknowledgement of alternate work site requirements · Policy repository / GRC workspace
First move
Common gaps auditors find
- Home working permitted in practice with no documented control expectations
- Controls specified but effectiveness never assessed in any form
- Incident contact routes assume the corporate network is reachable
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPE-16 Delivery and Removal. Authorize and control [organization-defined] entering and exiting the facility; and Maintain records of the system components · PE-18 Location of System Components. Position system components within the facility to minimize potential damage from [organization-defined] and to minimize the opportunity for unauthorized access