CMMC Remote Work

CMMC remote work scoping is the process of determining which home office devices, networks, and physical spaces fall within the CMMC Level 2 assessment boundary when employees handle Controlled Unclassified Information (CUI) outside the corporate facility. Under 32 CFR Part 170 and NIST SP 800-171, any asset that processes, stores, or transmits CUI — or that provides security protections for assets that do — is in scope. Remote work doesn't change that definition. It changes which physical locations and personal devices that definition reaches.

Is my home office in scope for CMMC?

In a corporate office, the facility is already part of the assessment. When an employee works from home, the "facility" becomes their private residence. Three things become potential assessment artifacts the moment a remote employee touches CUI:

• The endpoint device: If CUI can reach the laptop, it is a CUI Asset candidate.
• The home network: The Wi-Fi router providing the access path can enter the assessment picture.
• The physical space: Windows, sight lines, and shared occupants are all physical facility concerns.

Does viewing CUI on a remote device make it in scope?

Under DoD's scoping definition, an asset "processes" CUI when it accesses, enters, edits, generates, manipulates, or prints it. "Access" includes opening a browser tab or VDI window that displays CUI. The data doesn't need to download for the endpoint to be in scope.

To keep a viewing device from full CUI Asset classification, two things must work together: MDM-enforced technical controls blocking clipboard sync, screenshots, and local downloads, plus SSP documentation justifying CRMA classification rather than CUI Asset.

How does a VDI enclave minimize remote work CMMC scope?

How do you determine if a remote device is in scope for CMMC?

What remote work mistakes cause CMMC assessment failures?

• Local Download

  Word auto-saves a local copy of a SharePoint CUI file. The laptop is now a CUI Asset. MDM must block local sync for CUI-tagged content.

• Screenshot

  PrtScn saves CUI locally; a phone photo achieves the same result. MDM must disable screenshot keys; the AUP must explicitly prohibit screen photography.

• Family Devices

  A child uses the corporate laptop or a spouse logs in. The AUP must prohibit third-party use; MDM should enforce user-level restrictions.

• BYOD

  Personal devices accessing CUI are in scope but nearly impossible to validate. Prohibit CUI access on personal devices or require MDM enrollment.

• Travel / Public Wi-Fi

  Accessing CUI on uncontrolled networks without a VPN is a direct NIST 800-171 compliance failure. The AUP must address travel scenarios explicitly.

• Browser-Only Illusion

  Browser rendering is processing. Browsers cache tokens and thumbnails locally. "Browser-only" is not automatically out of scope.

What evidence do C3PAO assessors need for remote work controls?

Assessors use three methods in concert — Examine, Test, and Interview. All three must be consistent and documented before assessment day.

The Bottom Line

To keep home offices out of CMMC scope, implement these three controls in sequence: deploy VDI through a FedRAMP Moderate-authorized environment (GCC High or equivalent) so CUI never leaves the cloud enclave. Configure MDM (Intune, Jamf) to block local downloads, clipboard sync, screenshots, and USB access on every remote endpoint. Draft and enforce a Remote Work Acceptable Use Policy — signed by every remote employee — that prohibits screen photography, shared device access, and CUI handling on uncontrolled networks. Document all three in your SSP with the specific CRMA justification for each remote endpoint.