CMMC and Remote Workers: Home Offices, Laptops and Personal Devices

Level 1’s requirements talk about systems and physical access, and it’s easy to picture all of that happening in one building. Most small contractors don’t work that way. Someone does the books from home two days a week, the estimator checks email on their phone, and the owner’s laptop goes everywhere.

The question is which of that is in scope, and what you actually have to do about it.

The scope rule is simpler than it sounds

If Federal Contract Information touches it, it’s in scope.

Not “if it’s company property.” Not “if it’s in the office.” If a device stores, processes or transmits FCI, the Level 1 requirements apply to it, wherever it happens to be sitting.

That’s the whole test, and applying it honestly is most of the work. Walk through where your contract information actually goes: the shared drive, the email accounts that receive purchase orders, the laptop the estimator uses, the phone that syncs that email. That list is your scope.

Company laptops at home

These are the straightforward case. A company laptop with individual accounts, antivirus on, updates installing and a password on the screen lock meets the substance of what Level 1 asks, whether it’s on a desk in your shop or a kitchen table.

Two things worth attending to:

Physical protection travels with the device. The requirement to limit physical access doesn’t stop at your property line. A laptop left in a car is a gap in a way that one locked in your office isn’t. This doesn’t need a policy document — it needs people to understand that the machine with contract information on it shouldn’t be left where anyone can take it.

Disposal still applies. When a home-based worker’s laptop is replaced, it comes back and gets wiped like any other. The Media Disposal requirement is the one most often missed for remote equipment, because the machine never passes through the office in the normal way.

Personal devices are the hard part

This is where small contractors genuinely struggle, and the honest answer is that personal devices make compliance harder rather than impossible.

The problem isn’t that personal devices are forbidden. It’s that if your employee’s own phone receives email containing FCI, that phone is in scope — and you now need to be able to say something sensible about unique identification, access control and what happens when that person leaves.

You have three realistic options.

Keep FCI off personal devices. The cleanest answer. Company email on company devices only. For a small shop with a handful of people, this is often less disruptive than it sounds.

Use the controls your email platform already has. Microsoft 365 and Google Workspace can both require a screen lock, enforce encryption, and remotely remove company data from a personal phone without touching anything else on it. This is built into licences you likely already hold, and it turns “their phone” into something you can actually account for.

Accept it and document it. If people will use personal devices regardless, say so explicitly, apply what controls you can, and write down what you concluded and why. A documented decision is defensible; an unexamined practice isn’t.

What you shouldn’t do is leave it unaddressed and hope the question doesn’t come up. It’s a predictable question.

Home networks and boundary protection

The boundary protection requirement asks you to monitor and control communications at the external boundary of your systems. People read that as an obligation to secure every employee’s home router, which would be unworkable.

For a small contractor at Level 1, the practical reading is that the boundary that matters is around your systems and data, not around your employee’s house. If work happens through a company laptop connecting to company cloud services over an encrypted connection, the controls live at those services and on that device.

A VPN is not a Level 1 requirement. It can be useful, particularly if people reach an on-premises server from outside, but it isn’t mandated and you shouldn’t be sold one on the basis that it is.

Offboarding matters more with remote staff

The Authorized Access Control requirement is about who can get into your systems. When someone leaves, their access ends.

With remote workers this is easy to get wrong, because there’s no badge handed back and no desk cleared. Accounts stay live. Equipment stays at their house. A written offboarding step — disable accounts the same day, recover equipment, wipe it — closes a gap that’s otherwise invisible.

The bottom line

Scope follows the information, not the building. Company devices at home are straightforward; personal devices need a decision you make deliberately rather than by default; home networks aren’t your boundary.

Write down what you concluded about each, because next year you’ll need to show your reasoning — see what records you need to keep.