PE-1 Policy and procedures
The physical and environmental protection policy and procedures control: what the PE policy must address, who owns it, review and update cycles for policy and procedures, and the documents assessors examine.
PE Physical and environmental protection
The SP 800-53 Rev. 5 Physical and Environmental Protection family: physical access authorization, control and monitoring, visitor records, power, fire, environmental and water protection, and facility siting, with baselines and assessment procedures.
PE-2 Physical access authorizations
Physical access authorizations for the facility where the system resides: an approved list of authorized individuals, issuing credentials such as badges, periodic list reviews and removing people who no longer need access.
PE-3 Physical access control
Enforcing physical access at entry and exit points: verifying authorizations, guards or entry systems, physical access audit logs, visitor escort, securing and inventorying keys, combinations and access devices, and changing them when compromised.
PE-4 Access control for transmission
Physically protecting system distribution and transmission lines inside facilities against damage, tampering and eavesdropping, for example locked wiring closets, locked spare jacks, conduit and wiretapping sensors. Not in the low baseline.
PE-5 Access control for output devices
Controlling physical access to output from printers, copiers, monitors and similar output devices so unauthorized people cannot obtain it, for example by placing devices in secured areas. Not in the low baseline.
PE-6 Monitoring physical access
Monitoring physical access to detect and respond to physical security incidents: guards, video and sensors, reviewing physical access logs on a schedule and after events, and coordinating results with incident response.
PE-8 Visitor access records
Visitor access records: keeping records of facility visitors for a defined period, reviewing them on a schedule and reporting anomalies, with automated record keeping and limits on personal data in records as enhancements.
PE-9 Power equipment and cabling
Protecting power equipment and power cabling for the system from damage and destruction, with redundant cabling and automatic voltage controls as enhancements. Not in the low baseline.
PE-10 Emergency shutoff
Emergency power shutoff for systems or components: the shutoff capability, switches placed where authorized personnel can reach them, and protection against unauthorized activation, mainly for data centers and server rooms.
PE-11 Emergency power
An uninterruptible power supply for the system so that loss of primary power leads to an orderly shutdown or a transition to long-term alternate power, with alternate power supplies as enhancements.
PE-12 Emergency lighting
Automatic emergency lighting that activates in a power outage or disruption and covers emergency exits and evacuation routes in the facility housing the system.
PE-13 Fire protection
Fire detection and suppression systems for facilities housing the system, backed by an independent energy source, with automatic activation, notification and inspections as enhancements.
PE-14 Environmental controls
Keeping environmental conditions such as temperature and humidity at acceptable levels in the facility where the system resides and monitoring them, with automatic controls and alarm notifications as enhancements.
PE-15 Water damage protection
Protecting the system from water leakage damage with master shutoff or isolation valves that are accessible, working and known to key personnel, with automated detection as an enhancement.
PE-16 Delivery and removal
Authorizing and controlling system components entering and leaving the facility and keeping records of them, often by restricting and isolating delivery areas.
PE-17 Alternate work site
Security at alternate work sites such as employee residences: defining permitted sites, required controls, assessing those controls, and giving staff a way to contact security and privacy personnel about incidents. Not in the low baseline.
PE-18 Location of system components
Positioning system components within a facility to reduce damage from physical and environmental hazards and opportunities for unauthorized access. It is the only PE control allocated to the high baseline alone.
PE-19 Information leakage
Protecting the system against information leakage through electromagnetic signal emanations, with national emissions policies and procedures as an enhancement. No SP 800-53B baseline includes it.
PE-20 Asset monitoring and tracking
Using asset location technologies to track and monitor the location and movement of defined assets, such as equipment and system components, within controlled areas. No SP 800-53B baseline includes it.
PE-21 Electromagnetic pulse protection
Protective measures against electromagnetic pulse damage to defined systems and components. No SP 800-53B baseline includes it.
PE-22 Component marking
Marking hardware components such as computers, displays and printers with the impact level or classification of the information they may process, store or transmit. No SP 800-53B baseline includes it.
PE-23 Facility location
Planning the facility location with physical and environmental hazards in mind and, for existing facilities, reflecting those hazards in the risk management strategy. No SP 800-53B baseline includes it.
