How Should a CUI Workstation Be Physically Set Up?

A defense contractor can spend thousands of dollars securing a network and still overlook something much simpler:

Who can see the monitor?

Consider a typical engineering workstation.

The employee signs in with an authorized account. The computer is properly configured. Controlled Unclassified Information is stored inside the organization’s approved environment.

But the workstation faces a hallway.

A vendor walks past.

A visitor waits behind the employee.

Engineering drawings remain visible on the screen.

A shared printer sits outside the controlled workspace.

A USB drive is sitting beside the keyboard.

Nobody can immediately tell whether the computer is authorized to locally process CUI, access it only through a virtual desktop, or should never handle CUI at all.

This is why a CUI workstation cannot be evaluated solely as a computer.

It should be evaluated as a physical information-handling environment.

NIST SP 800-171 Revision 3 addresses physical access to facilities containing systems that process, store or transmit CUI and requires organizations to enforce physical access authorizations, control visitor activity and protect output from devices such as monitors and printers. 

For defense contractors, the practical question becomes:

What should the physical area around a CUI workstation actually look like?

This guide walks through it.

What is a CUI workstation?

A CUI workstation is a workstation that an organization has authorized and configured to perform some defined activity involving Controlled Unclassified Information.

Depending on the organization’s architecture, that may mean the workstation:

• stores CUI locally;
• processes CUI;
• displays CUI;
• accesses CUI in an enclave;
• connects to a controlled virtual desktop;
• accesses a cloud environment containing CUI;
• sends CUI to an authorized printer;
• interacts with manufacturing or engineering systems containing CUI.

Those distinctions matter.

A laptop that stores CUI locally is not necessarily equivalent to a thin client that can only access CUI through an approved virtual desktop.

Physical identification can help employees recognize those differences.

But the first step is not buying labels.

The first step is determining what the workstation is actually authorized to do.

Step 1: Define the workstation’s CUI role

Before physically marking a workstation, determine its role within your organization’s documented CUI environment.

Ask:

Can this computer store CUI locally?

Can it process CUI locally?

Can employees download CUI to it?

Can it print CUI?

Can removable media be connected?

Is CUI accessible only through VDI?

Is this device outside the CUI environment entirely?

Those answers should come from the organization’s actual system architecture, security policies and System Security Plan—not from whatever label happens to be attached to the computer.

Once the role is defined, physical identification can reinforce it.

For organizations using multiple workstation classifications, CUI Supply’s CMMC Control Asset Labels⁠ provide visible asset identification for endpoints with different CUI roles.

For example, an organization using virtual desktops can identify endpoints approved only for that workflow with CUI Authorized on Virtual Desktop Only Asset Labels⁠.

The important distinction is:

The configuration determines what the workstation can do. The label reminds the employee what the workstation is allowed to do.

Step 2: Decide whether the workstation is inside a controlled environment

The physical location matters.

The National Archives CUI Registry⁠ defines a controlled environment as an area or space an authorized holder considers to have adequate physical or procedural controls—such as barriers or managed access controls—to protect CUI from unauthorized access or disclosure. 

NARA guidance further explains that physical controlled environments are intended to prevent unauthorized access, observation or overhearing of CUI. 

That means a workstation inside:

a badge-controlled engineering office

is physically different from the same workstation sitting:

beside a public reception desk.

A CUI workstation does not automatically require its own dedicated locked room.

The broader question is whether the surrounding environment provides appropriate protection against unauthorized physical access and observation.

Step 3: Think about sightlines—not just doors

Physical CUI protection is not limited to someone touching the computer.

Someone can potentially obtain information simply by seeing the screen.

NIST SP 800-171 Revision 3 specifically incorporates protection of output devices into physical access control.

NIST’s discussion identifies several ways organizations can control physical access to output, including:

• placing output devices in secured areas;
• restricting access to authorized individuals;
• positioning devices where personnel can monitor them;
• using monitor or screen filters.

NIST explicitly identifies monitors, printers, scanners, fax machines, audio devices and copiers as examples of output devices. 

When positioning a CUI workstation, therefore, ask:

Can someone standing in the hallway see the monitor?

Can someone entering the room see it before being challenged?

Can a visitor seated nearby read it?

Does the screen face an exterior window?

Does a second monitor extend beyond the employee’s controlled viewing area?

Can people passing through a shared production floor see the display?

A workstation can be technically secure while still having a poor physical layout.

Step 4: Position monitors intentionally

The easiest physical safeguard is sometimes simply changing the direction of the desk.

Whenever practical, position CUI displays so they are not directly visible from:

• public hallways;
• reception areas;
• conference-room entrances;
• exterior windows;
• customer waiting areas;
• shipping/receiving areas;
• shared break areas;
• uncontrolled production aisles.

For environments where sightlines cannot reasonably be eliminated, organizations may consider privacy filters or other physical viewing protections appropriate to the environment.

NIST specifically lists screen filters as one example of controlling access to output. 

That does not mean every CUI monitor universally requires a privacy filter.

It means monitor visibility should be considered as part of the physical protection strategy.

Step 5: Control who can physically reach the workstation

NIST SP 800-171 Revision 3 requirement 03.10.01 addresses Physical Access Authorizations.

Among other things, organizations are directed to develop and maintain lists of individuals authorized to access facilities where covered systems reside and issue appropriate facility-access credentials. 

Requirement 03.10.07 addresses physical access control and includes:

• verifying physical access authorization;
• controlling ingress and egress;
• maintaining applicable physical access audit logs;
• escorting visitors;
• controlling visitor activity;
• securing keys, combinations and other physical-access devices. 

Notice what this means operationally:

A “CUI Restricted Area” sign is not what makes an area secure.

The access-control process does.

Signs can make the boundary obvious.

CUI Supply’s CUI Restricted Area Signs⁠ are designed to visibly identify rooms and work areas where an organization’s CUI access procedures apply.

But they should reinforce real controls such as:

• badge access;
• locked doors;
• reception controls;
• personnel authorization;
• visitor escorting;
• employee training.

That distinction is critical for both compliance and assessment readiness.

Step 6: Make the boundary obvious

One of the hardest environments for physical CUI protection is an open manufacturing floor.

There may not be convenient walls around every:

• CNC workstation;
• inspection computer;
• quality station;
• engineering terminal;
• test stand;
• production traveler;
• shared monitor.

Organizations may therefore establish controlled work zones using their documented physical and procedural controls.

Visible boundary markings can help employees and visitors understand where those procedures begin.

CUI Supply’s CUI Restricted Area Signs⁠ can identify entrances and workspaces, while physical boundary products can reinforce where an organization’s controlled area begins.

Again:

A line on the floor does not create security by itself.

It communicates the boundary of the security process.

NARA’s controlled-environment guidance emphasizes that the actual environment requires adequate physical or procedural controls to protect CUI from unauthorized access or disclosure. 

Step 7: Identify the workstation appropriately

Once the organization’s asset classification is established, physical asset identification can reduce employee mistakes.

Imagine a room containing ten nearly identical laptops:

Four may locally process CUI.

Three may access CUI only through VDI.

Three may be general-purpose systems outside the CUI environment.

Without clear procedures, users can easily confuse them.

This is where physical asset labels become useful.

For contractor-owned equipment, CUI Supply offers Generic SF 905 CUI Digital Media Labels⁠ that do not contain the “U.S. Government Property” language found on SF 902.

CUI Supply also offers CMMC Control Asset Labels⁠ designed to distinguish different device roles.

The labels can support:

• inventory reconciliation;
• employee awareness;
• workstation identification;
• scoping discussions;
• visual inspection;
• consistent equipment handling.

But asset labels should reflect the organization’s documented environment.

Do not create your CMMC scope by putting stickers on computers.

Determine the scope first.

Then use physical identification to make that scope easier to operate.

Step 8: Understand SF 902 vs. Generic SF 905

This deserves special attention because the two labels serve different situations.

CUI Supply’s SF 902 Computer and Digital Media Labels⁠ contain “U.S. Government Property.”

That language matters.

If the workstation is company-owned rather than government property, an organization should not casually apply a label that inaccurately represents ownership.

For contractor-owned equipment, CUI Supply’s Generic SF 905 labels⁠ omit that government-property statement.

The practical rule is:

Use the label that accurately reflects the asset and your organization’s approved marking procedure.

Do not select labels solely because one “looks more official.”

Step 9: Clearly identify VDI-only workstations

Virtual desktop infrastructure creates another physical challenge.

Suppose a laptop is allowed to access CUI through an approved virtual desktop but is not authorized to store or process CUI locally.

Technically, the architecture may be perfectly clear.

Operationally, the employee sees a laptop.

That can create mistakes:

• downloading a file locally;
• saving an attachment to the desktop;
• printing from the wrong environment;
• moving information to an unauthorized application;
• copying information to local storage.

CUI Supply’s CUI Authorized on Virtual Desktop Only Asset Labels⁠ are designed specifically to communicate that distinction.

They can provide a physical reminder that the endpoint’s approved CUI workflow is through the organization’s controlled virtual desktop.

The label does not enforce VDI restrictions.

Technical configuration does.

The physical label reinforces the technical architecture for the person actually using the machine.

That combination—technical control + physical cue—is much stronger than either one alone.

Step 10: Treat printers as extensions of the workstation

If a CUI workstation can print, the physical security analysis should not stop at the desk.

Ask where the output goes.

A properly controlled workstation sending CUI to a printer in an uncontrolled hallway can create an obvious exposure path.

NIST’s physical-access discussion specifically identifies printers and scanners as output devices requiring consideration. 

Organizations should determine:

• which printers are authorized for CUI;
• who can physically access them;
• whether output can sit unattended;
• whether visitors can reach the print area;
• how employees identify approved printers;
• how unwanted CUI output is destroyed.

CUI Supply offers CUI Printer Station Signs⁠ to distinguish authorized CUI print locations from printers where CUI should not be printed.

For organizations standardizing the entire workflow, the CUI Printer & Scanner Station Pack⁠ combines printer/scanner identification, SF 901 cover sheets, destruction-container identification, asset labels and document-marking tools.

These products support the process.

They do not substitute for appropriate printer configuration, access controls or employee procedures.

Step 11: Plan for physical documents at the workstation

Many CUI workstations produce something digital security controls cannot protect:

paper.

Engineering drawings may be printed.

Inspection reports may sit beside the keyboard.

Employees may take notes containing CUI.

A manufacturing traveler may be placed on the desk.

A printed document can remain exposed even after the computer is locked.

Organizations therefore need procedures for physical CUI at the workstation.

NARA states that CUI does not universally have to be stored in a GSA-approved safe. Its FAQ explains that CUI generally must be stored behind a locking barrier inside a controlled environment that prevents unauthorized access, while CUI Specified categories can impose additional requirements. 

For active documents, the SF 901 CUI Cover Sheet collection at CUI Supply⁠ can support standardized physical-document handling.

An SF 901 is an approved CUI cover sheet—not a replacement for safeguarding.

The distinction matters:

Cover the document. Control the environment. Secure it appropriately when unattended.

Step 12: Establish a clean-desk procedure appropriate to CUI

A clean-desk policy is not a universal CMMC requirement with one prescribed implementation.

But organizations handling physical CUI should determine what employees must do when they leave a workstation.

For example:

During active work: CUI may remain under the authorized employee’s direct control.

Leaving briefly: screen locked; physical CUI covered or otherwise protected according to policy.

Leaving the controlled area: physical CUI returned to approved storage.

End of day: documents secured; removable media stored; unwanted CUI moved to the authorized destruction process.

The precise procedure should reflect the organization’s environment and applicable requirements.

The objective is to prevent a workstation from becoming an unattended collection of exposed CUI.

Step 13: Control removable media

USB drives and external storage devices deserve particular attention because they can physically leave the workstation.

Your organization should define:

• whether removable media is permitted;
• which media is authorized;
• how media is identified;
• where it is stored;
• who may remove it;
• how it is transported;
• how it is sanitized or destroyed.

Physical labels can help distinguish controlled media, but they do not replace the technical and administrative controls governing its use.

CUI Supply carries CUI labels and digital-media identification products⁠ for organizations standardizing these workflows.

Step 14: Account for visitors before they arrive

Visitors should not become a problem only after someone notices them standing beside a CUI workstation.

NIST SP 800-171 Revision 3 explicitly applies physical access authorization concepts to employees and visitors and requires organizations to escort visitors and control visitor activity as part of physical access control. 

For a workstation environment, organizations should decide:

• whether visitors can enter the area;
• whether they require an escort;
• how visitor status is identified;
• whether monitors need to be locked or obscured;
• whether physical CUI must be covered;
• whether meetings should occur somewhere else;
• how maintenance personnel are handled.

This is especially important for:

• repair technicians;
• delivery personnel;
• prospective customers;
• suppliers;
• cleaning crews;
• equipment installers;
• auditors;
• temporary employees.

The objective is not merely knowing that someone is a visitor.

It is ensuring their activity around CUI is controlled.

Step 15: Don’t forget CNC machines, test equipment and legacy systems

A “workstation” is not always a desktop computer.

NIST SP 800-171 Revision 3 specifically recognizes that specialized systems—including industrial/process control systems and computer numerical control machines—may have limitations affecting implementation of certain security requirements. 

That makes physical implementation particularly important in manufacturing environments.

A CNC controller may:

• display controlled drawings;
• receive controlled programs;
• contain technical information;
• lack modern login-banner functionality;
• sit directly on an open production floor.

A test stand may have similar characteristics.

CUI Supply’s Notice and Consent Warning Labels⁠ are intended for environments such as manufacturing controllers, test equipment, stand-alone engineering systems and legacy equipment where organizations want a physical warning visible before system use.

A physical notice is not automatically required simply because a device handles CUI.

And it should not be represented as a substitute for an electronic control where the organization’s applicable requirement calls for one.

But where physical notice is part of the organization’s approved implementation, it can help standardize user awareness across equipment that does not behave like a conventional PC.

Step 16: Think about alternate work sites

Physical CUI protection does not necessarily end at the facility door.

NIST SP 800-171 Revision 3 includes requirement 03.10.06, Alternate Work Site.

It requires organizations to determine which alternate work sites employees may use and establish organization-defined security requirements for those locations. NIST specifically identifies employees’ private residences as one example of an alternate work site. 

That means an organization allowing CUI-related remote work should answer questions such as:

Can CUI be viewed from a home office?

Can family members enter that room?

Can physical CUI be printed at home?

Can documents be stored there?

Is VDI the only authorized workflow?

Can the employee’s monitor be observed through a window?

What happens to physical notes?

The answer is not universally “remote CUI work is prohibited.”

NIST instead directs organizations to determine permitted alternate sites and the security requirements applicable to them. 

That makes physical workstation procedures important even for remote employees.

What should a good CUI workstation look like?

There is no single federally mandated desk layout.

A practical workstation might look like this:

Controlled Area

↓

Access limited according to the organization’s authorization process

↓

Clearly Identified CUI Workstation

↓

Monitor positioned away from uncontrolled sightlines

↓

Privacy filter where appropriate

↓

Workstation role clearly understood by employee

↓

Authorized printer identified separately

↓

Physical CUI protected during use

↓

Approved storage available for unattended documents

↓

Authorized destruction workflow available

↓

Visitor activity controlled

The exact implementation can vary.

What matters is that the physical environment supports the organization’s actual CUI protection procedures.

CUI workstation checklist

Use this checklist when reviewing a workstation that accesses, processes, stores or displays CUI:

Workstation role

• Is the workstation’s permitted CUI use properly documented?
• Can it locally store CUI?
• Is it VDI-only?
• Is printing permitted?
• Is removable media permitted?

Physical location

• Is the workstation located within an appropriate controlled environment?
• Can unauthorized personnel physically reach it?
• Does the screen face a hallway, window or public area?
• Can visitors observe the display?

Identification

• Can employees distinguish this workstation from non-CUI systems?
• Does the physical label accurately represent the device?
• Does the asset identifier correspond to the organization’s inventory?

Output

• Is the monitor protected from unauthorized viewing?
• Does printing go only to an authorized location?
• Are scanners/copiers considered?
• Can printed CUI sit unattended?

Physical documents

• Are employees trained on CUI coversheets and markings?
• Is approved storage available?
• Is there a defined destruction process?
• Are documents protected when the employee leaves?

Visitors

• Are visitors identified?
• Are visitors escorted when required?
• Are employees trained on what to do when visitors enter?
• Can maintenance or cleaning personnel encounter exposed CUI?

Consistency

• Does the workstation’s physical setup match the SSP?
• Does employee behavior match written procedures?
• Could an assessor observe the environment and understand how the controls work?

That final question is worth emphasizing.

Build the environment so the correct behavior is obvious

The best physical CUI program does not force employees to remember dozens of invisible rules.

It turns those rules into an environment.

An employee approaching a workstation should be able to understand:

This workstation handles CUI.

or:

This workstation accesses CUI only through VDI.

or:

This device is not authorized for CUI.

A visitor should encounter a visible boundary before entering an area where CUI is exposed.

An employee printing CUI should know which printer to select.

An engineer leaving a desk should know where the drawing goes.

An employee holding unwanted CUI should know where to place it for destruction.

That is the value of combining:

technical controls + documented procedures + training + physical access control + visual identification.

None of those elements should pretend to replace the others.

Together, they make the CUI environment easier to operate correctly.

Does the 2026 CMMC Phase II suspension change CUI workstation protection?

No—not in the sense of eliminating existing safeguarding obligations.

On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II requirements that had been scheduled for November 10, 2026. The Department simultaneously stated that all Phase I self-assessment requirements remain in place while CMMC undergoes review. 

DFARS 252.204-7012 continues to require contractors with applicable covered contractor information systems to provide adequate security and implement the information-security protections required by the clause. 

The practical takeaway is straightforward:

A CMMC schedule change does not make physical CUI exposure harmless.

If anything, the current pause gives contractors additional time to clean up environments that may technically function but are operationally confusing.

A CUI workstation is a good place to begin.

Because cybersecurity ultimately reaches a physical point:

a person, sitting at a computer, looking at information.

Protect that point well.

Frequently Asked Questions

Does a CUI workstation need to be in a locked room?

Not universally. The appropriate physical safeguards depend on the environment and applicable requirements. NARA defines a controlled environment based on adequate physical or procedural controls, while NIST provides multiple examples of controlling physical access and output—not only locked rooms. 

Does every CUI computer need a sticker?

There is no universal NIST SP 800-171 requirement saying every computer that handles CUI must display a particular CUI sticker. Asset labels can support inventory, user awareness and standardized handling, but they do not replace technical controls or documented asset management.

Should I use SF 902 on a contractor-owned computer?

Be careful. CUI Supply’s SF 902 label includes “U.S. Government Property.” Organizations should not use ownership language that inaccurately represents contractor-owned equipment. A generic label without that wording may be more appropriate depending on the organization’s procedures. 

What is a CUI VDI-only workstation?

It is an endpoint the organization has approved to access CUI through a controlled virtual desktop environment while restricting local CUI storage or processing according to the organization’s architecture. Physical identification can remind users of that limitation, but the actual restriction must be enforced through technical and administrative controls.

Does a CUI monitor need a privacy screen?

Not universally. NIST lists screen filters as one example of controlling physical access to output. Organizations should evaluate monitor positioning, sightlines and unauthorized viewing risk to determine appropriate safeguards. 

Can visitors enter a room containing CUI workstations?

Potentially, subject to the organization’s applicable physical-access procedures. NIST SP 800-171 Revision 3 requires organizations to escort visitors and control visitor activity as part of physical access control. 

Can employees work with CUI from home?

NIST SP 800-171 Revision 3 recognizes alternate work sites, including private residences, and requires organizations to determine permitted alternate work sites and the security requirements applied there. Whether a particular employee may work with CUI from home depends on the organization’s approved environment, applicable contractual requirements and implemented safeguards. 

Do CUI signs make a workspace compliant?

No. Signs communicate boundaries and procedures. They do not create access control, authorize employees, configure computers or secure information by themselves.

Can a CUI workstation print to a normal office printer?

The organization should ensure physical access to CUI output is appropriately controlled. NIST specifically identifies printers among the output devices considered under physical access control. A printer accessible to unauthorized personnel may therefore create an exposure risk. 

Does the CMMC Phase II pause mean we can stop improving physical CUI controls?

No. The July 13, 2026 announcement suspended Phase II while explicitly keeping Phase I self-assessment requirements in place, and existing contractual safeguarding requirements continue to matter.