There is an increased potential for CUI to be overheard or observed with more people likely to be in the home.
Many people used to have the house to themselves while teleworking and now in many households’ spouses, kids, and housemates are home.
Even in homes with a room that can be used as an office, it might be a room shared by both spouses. In this situation, even if both spouses work for the government, one spouse may not have a lawful government purpose to have access to information the other spouse has access to. Special attention should be paid to dissemination controls, particularly FED ONLY, NOCON, DL ONLY, Attorney-Client, Attorney-WP, and Deliberative.
Other employees do not live in a home with even the option of an extra room to serve as an office. This might include a couple living in a studio apartment or just a very full house.
Some employees also might live with housemates that are not of their choosing because of financial constraints. Nearly all of us can think back to the days — at some point in our life — that we were in this situation.
So how do agencies and employees establish a controlled environment to effectively safeguard CUI when it is used during telework?
There are lots of deeply personal reasons an employee might have to make the judgment call they need to take extra precautions in order to achieve a controlled environment. Just to name a few examples: a kid who tells everything to their friends or random strangers they walk by, an untrustworthy roommate, a family member with mental illness, or a divorce in progress.
In most cases an employee will prefer not to go into these details with a supervisor, the same way they might be willing to say they “live in a studio apartment with a parakeet”…though some employees might not even be comfortable saying that.
Though the personal situation can be generalized to protect employee personal privacy, there are three steps that should occur:
- the employee should notify their supervisor they feel a need to take extra precautions and what those precautions are,
- the employee acknowledges it is their responsibility to achieve a controlled environment that effectively safeguards the information and the supervisor recognizes that part of their own obligation to safeguard the information is to empower the employee with the work time and resources to do this,
- the agency provides supplemental training on the safeguarding needed to achieve a controlled environment is given before CUI is used.
An employee knows their home environment best, so be a good listener when an employee says “I cannot talk about that now,” “Can I email you,” “I need to call you back about that,” etc.
Keeping the computer screen from being observed is a different set of challenges and depend greatly on the physical configuration of the work environment.
Different solutions will be right for different employees. Here a couple items supervisors might want to consider:
- Providing flexible schedules (for example, to work at a time when others aren’t around)
- Providing flexible range of assignments (so non-CUI work can be done if the environment changes)
- Providing screen protectors (to limit the angles a computer screen is readable from)
- Providing headphones (that can be used instead of speaker phones or laptop speakers; note: it remains the employee’s responsibility keep in mind people around them and be mindful of what information they are talking about)
- Providing refresher training (particularly tailored to our new telework environment)
Employees also need to remember their obligation to report security and safeguarding incidents, even ones that happen at home. It is an essential security and safeguarding practice for agencies to foster a culture of self-reporting.
In addition, telework.gov is a great resource to check out for additional information.
What are other solutions that you have found to be a best practice as we all adjust to teleworking with a full house? What topics would you suggest be included in refresher training about creating a controlled environment while teleworking with a full house?