NIST SP 800-53 (controls) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| PE-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy that | |
| PE-02 | Physical Access Authorizations | a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides; b. Issue authorization credentials for facility access; c. Review the access list detailing authorized facility access | |
| PE-02(01) in PE-2 |
Access by Position or Role | Authorize physical access to the facility where the system resides based on position or role. | |
| PE-02(02) in PE-2 |
Two Forms of Identification | Require two forms of identification from the following forms of identification for visitor access to the facility where the system resides: [Assignment: list of acceptable forms of identification]. | |
| PE-02(03) in PE-2 |
Restrict Unescorted Access | Restrict unescorted access to the facility where the system resides to personnel with [Selection (one or more): security clearances for all information contained within the system; formal access authorizations for all information contained | |
| PE-03 | Physical Access Control | a. Enforce physical access authorizations at [Assignment: entry and exit points] by: 1. Verifying individual access authorizations before granting access to the facility; and 2. Controlling ingress and egress to the facility using [Selectio | |
| PE-03(01) in PE-3 |
System Access | Enforce physical access authorizations to the system in addition to the physical access controls for the facility at [Assignment: physical spaces]. | |
| PE-03(02) in PE-3 |
Facility and Systems | Perform security checks [Assignment: frequency] at the physical perimeter of the facility or system for exfiltration of information or removal of system components. | |
| PE-03(03) in PE-3 |
Continuous Guards | Employ guards to control [Assignment: physical access points] to the facility where the system resides 24 hours per day, 7 days per week. | |
| PE-03(04) in PE-3 |
Lockable Casings | Use lockable physical casings to protect [Assignment: system components] from unauthorized physical access. | |
| PE-03(05) in PE-3 |
Tamper Protection | Employ [Assignment: anti-tamper technologies] to [Selection (one or more): detect; prevent] physical tampering or alteration of [Assignment: hardware components] within the system. | |
| PE-03(06) in PE-3 |
Facility Penetration Testing withdrawn | ||
| PE-03(07) in PE-3 |
Physical Barriers | Limit access using physical barriers. | |
| PE-03(08) in PE-3 |
Access Control Vestibules | Employ access control vestibules at [Assignment: locations]. | |
| PE-04 | Access Control for Transmission | Control physical access to [Assignment: system distribution and transmission lines] within organizational facilities using [Assignment: security controls]. | |
| PE-05 | Access Control for Output Devices | Control physical access to output from [Assignment: output devices] to prevent unauthorized individuals from obtaining the output. | |
| PE-05(01) in PE-5 |
Access to Output by Authorized Individuals withdrawn | ||
| PE-05(02) in PE-5 |
Link to Individual Identity | Link individual identity to receipt of output from output devices. | |
| PE-05(03) in PE-5 |
Marking Output Devices withdrawn | ||
| PE-06 | Monitoring Physical Access | a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents; b. Review physical access logs [Assignment: frequency] and upon occurrence of [Assignment: events] ; and c. Coordinate | |
| PE-06(01) in PE-6 |
Intrusion Alarms and Surveillance Equipment | Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment. | |
| PE-06(02) in PE-6 |
Automated Intrusion Recognition and Responses | Recognize [Assignment: classes or types of intrusions] and initiate [Assignment: response actions] using [Assignment: automated mechanisms]. | |
| PE-06(03) in PE-6 |
Video Surveillance | (a) Employ video surveillance of [Assignment: operational areas]; (b) Review video recordings [Assignment: frequency] ; and (c) Retain video recordings for [Assignment: time period]. | |
| PE-06(04) in PE-6 |
Monitoring Physical Access to Systems | Monitor physical access to the system in addition to the physical access monitoring of the facility at [Assignment: physical spaces]. | |
| PE-07 | Visitor Control withdrawn | ||
| PE-08 | Visitor Access Records | a. Maintain visitor access records to the facility where the system resides for [Assignment: time period]; b. Review visitor access records [Assignment: frequency] ; and c. Report anomalies in visitor access records to [Assignment: personne | |
| PE-08(01) in PE-8 |
Automated Records Maintenance and Review | Maintain and review visitor access records using [Assignment: organization-defined automated mechanisms]. | |
| PE-08(02) in PE-8 |
Physical Access Records withdrawn | ||
| PE-08(03) in PE-8 |
Limit Personally Identifiable Information Elements | Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: [Assignment: elements]. | |
| PE-09 | Power Equipment and Cabling | Protect power equipment and power cabling for the system from damage and destruction. | |
| PE-09(01) in PE-9 |
Redundant Cabling | Employ redundant power cabling paths that are physically separated by [Assignment: distance]. | |
| PE-09(02) in PE-9 |
Automatic Voltage Controls | Employ automatic voltage controls for [Assignment: critical system components]. | |
| PE-10 | Emergency Shutoff | a. Provide the capability of shutting off power to [Assignment: system or individual system components] in emergency situations; b. Place emergency shutoff switches or devices in [Assignment: location] to facilitate access for authorized pe | |
| PE-10(01) in PE-10 |
Accidental and Unauthorized Activation withdrawn | ||
| PE-11 | Emergency Power | Provide an uninterruptible power supply to facilitate [Selection: an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss. | |
| PE-11(01) in PE-11 |
Alternate Power Supply — Minimal Operational Capability | Provide an alternate power supply for the system that is activated [Selection: manually; automatically] and that can maintain minimally required operational capability in the event of an extended loss of the primary power source. | |
| PE-11(02) in PE-11 |
Alternate Power Supply — Self-contained | Provide an alternate power supply for the system that is activated [Selection: manually; automatically] and that is: (a) Self-contained; (b) Not reliant on external power generation; and (c) Capable of maintaining [Selection: minimally requ | |
| PE-12 | Emergency Lighting | Employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility. | |
| PE-12(01) in PE-12 |
Essential Mission and Business Functions | Provide emergency lighting for all areas within the facility supporting essential mission and business functions. | |
| PE-13 | Fire Protection | Employ and maintain fire detection and suppression systems that are supported by an independent energy source. | |
| PE-13(01) in PE-13 |
Detection Systems — Automatic Activation and Notification | Employ fire detection systems that activate automatically and notify [Assignment: personnel or roles] and [Assignment: emergency responders] in the event of a fire. | |
| PE-13(02) in PE-13 |
Suppression Systems — Automatic Activation and Notification | (a) Employ fire suppression systems that activate automatically and notify [Assignment: personnel or roles] and [Assignment: emergency responders] ; and (b) Employ an automatic fire suppression capability when the facility is not staffed on | |
| PE-13(03) in PE-13 |
Automatic Fire Suppression withdrawn | ||
| PE-13(04) in PE-13 |
Inspections | Ensure that the facility undergoes [Assignment: frequency] fire protection inspections by authorized and qualified inspectors and identified deficiencies are resolved within [Assignment: time period]. | |
| PE-14 | Environmental Controls | a. Maintain [Selection (one or more): temperature; humidity; pressure; radiation; {{ insert: param, pe-14_odp.02 }} ] levels within the facility where the system resides at [Assignment: acceptable levels] ; and b. Monitor environmental cont | |
| PE-14(01) in PE-14 |
Automatic Controls | Employ the following automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system: [Assignment: automatic environmental controls]. | |
| PE-14(02) in PE-14 |
Monitoring with Alarms and Notifications | Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to [Assignment: personnel or roles]. | |
| PE-15 | Water Damage Protection | Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel. | |
| PE-15(01) in PE-15 |
Automation Support | Detect the presence of water near the system and alert [Assignment: personnel or roles] using [Assignment: automated mechanisms]. | |
| PE-16 | Delivery and Removal | a. Authorize and control [Assignment: organization-defined types of system components] entering and exiting the facility; and b. Maintain records of the system components. | |
| PE-17 | Alternate Work Site | a. Determine and document the [Assignment: alternate work sites] allowed for use by employees; b. Employ the following controls at alternate work sites: [Assignment: controls]; c. Assess the effectiveness of controls at alternate work sites | |
| PE-18 | Location of System Components | Position system components within the facility to minimize potential damage from [Assignment: physical and environmental hazards] and to minimize the opportunity for unauthorized access. | |
| PE-18(01) in PE-18 |
Facility Site withdrawn | ||
| PE-19 | Information Leakage | Protect the system from information leakage due to electromagnetic signals emanations. | |
| PE-19(01) in PE-19 |
National Emissions Policies and Procedures | Protect system components, associated data communications, and networks in accordance with national Emissions Security policies and procedures based on the security category or classification of the information. | |
| PE-20 | Asset Monitoring and Tracking | Employ [Assignment: asset location technologies] to track and monitor the location and movement of [Assignment: assets] within [Assignment: controlled areas]. | |
| PE-21 | Electromagnetic Pulse Protection | Employ [Assignment: protective measures] against electromagnetic pulse damage for [Assignment: system and system components]. | |
| PE-22 | Component Marking | Mark [Assignment: system hardware components] indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component. | |
| PE-23 | Facility Location | a. Plan the location or site of the facility where the system resides considering physical and environmental hazards; and b. For existing facilities, consider the physical and environmental hazards in the organizational risk management stra |
59 of 1196.