PE-1 Policy and procedures: requirements and evidence

What PE-1 policy and procedures requires for physical and environmental protection

If you must show an assessor that a physical and environmental protection policy exists and is current, the answer is a written policy plus the procedures that put it into practice, both approved, distributed to the people who need them, owned by a named official and reviewed on a defined schedule. PE-1 asks for the policy to address purpose, scope, roles, responsibilities, management commitment, coordination among the parties involved, and compliance. It also asks for procedures that carry the policy out. Either document may be set at the organization, mission or business process level, or at the level of an individual system. The choice matters less than being clear about which facilities, data centers, server rooms and delivery areas the document governs, and making sure the level you choose covers the systems in scope.

Assessors treat PE-1 as the foundation for the rest of the PE family because every other control depends on it. Physical access authorizations (PE-2), access enforcement (PE-3), monitoring (PE-6), visitor records (PE-8) and environmental protection (PE-14) all need a stated owner, a stated expectation and a procedure that staff follow. Without them, the examine and interview methods in SP 800-53A Rev. 5 have nothing to test the other controls against. The SP 800-53A procedures for PE-1 ask assessors to examine the policy and procedures and the organization's risk management strategy, and to interview the personnel who hold physical and environmental protection responsibilities. Confirm with your assessor which of your documents they will request and which people they will interview, since interviews often reveal whether staff know the procedure exists.

The usual failure is a policy written once, approved and never revisited. Its review date passes, the facility changes ownership or adds a colocation cage, and nobody updates the text. A second failure is a procedure that describes how the facility was run years ago rather than how guards, facilities staff and badge administrators actually work today. Before the assessment, have the owner walk through each procedure against recent practice, record the gaps, and set review triggers such as relocation, new tenants, a significant incident or a change in responsibilities. Version history in your document system helps demonstrate that reviews happened, and the review and update frequencies should be the ones your organization defined, not ones borrowed from another framework.

Which facilities, teams and third parties PE-1 covers

PE-1 is set at a level the organization chooses: organization, mission or business process, or individual system. Each decision below changes who writes the policy, which facilities it reaches, and which third-party controls must be referenced, and the scope follows the baseline the system is categorized at.

Choose the policy level

Decide whether the physical and environmental policy applies across the organization, to a mission or business process, or to a single system. A single organization-wide policy is easier to keep current, but a system-level policy can be the right choice when one enclave has different facilities or hosting arrangements. Record the choice in the policy's scope statement so an assessor can see which systems it governs.

Confirm baseline applicability

PE-1 is allocated to the low, moderate and high baselines and is not part of the privacy baseline. For a system categorized only at the privacy baseline, confirm with the authorizing official whether PE-1 is required at all. Re-check scope whenever the system's categorization changes, because a move from low to moderate can bring in a new set of facility controls that the policy must address.

Map facilities and hosting sites

List every facility that houses a system component in scope, including data centers, server rooms, network closets, backup sites and offices where administrators work. For each one, record who owns the physical space and who operates it. The policy should name these locations or point to an inventory that is kept current, so that a facility added later does not fall outside the policy by accident.

Reference colocation and cloud controls

When a colocation provider or cloud platform operates the physical facility, the organization still needs to show how physical protection is covered. Ask each provider for its own physical security documentation, the scope of its independent assessments, and how it notifies customers of changes. Write the reliance into the policy, state which controls the provider performs and which the organization performs, and keep the provider's evidence on file for the assessor.

Assign physical and environmental roles

Name the official who manages the policy and the teams that carry out its procedures, such as facilities, security operations, data center operations, and the staff who approve access. Each role should have written responsibilities for access authorization, visitor handling, environmental monitoring and incident coordination. Roles held by contractors or outsourced facilities staff need the same clarity, with the contract or service agreement naming them.

Set the policy review triggers

Decide how often the policy and procedures are reviewed and which events force an update, such as a facility move, a new hosting provider, a change in system categorization or a significant security incident. Confirm the defined frequency in your own organization's standards, because the control requires the organization to set it. Track the review dates and the people who approved each version so the history can be shown.

How an assessor tests PE-1

This table walks through how an assessor works through PE-1 using the SP 800-53A procedure, separating the examine activities from the interview activities and showing what each produces. Read it as a checklist of what to have ready before the assessment starts and where findings usually arise.

Assessment element	What the assessor does	Evidence to have ready
Determination statements	Works through 17 determination statements for PE-1, each asking whether a specific part of the policy or procedures exists and is applied.	A written map from each determination statement to the document section, owner and date that addresses it.
Examine: PE policy	Reads the physical and environmental protection policy and checks that it covers purpose, scope, roles, responsibilities, management commitment, coordination and compliance.	Approved policy with version number, effective date, named owner and approval record.
Examine: PE procedures	Checks that procedures exist to implement the policy and that they are specific enough for staff to follow.	Procedures for access, visitors, environmental and power controls, each with a named owner and review date.
Examine: risk management strategy	Confirms the PE policy and procedures align with the organizational risk management strategy.	Risk management strategy document and a traceable link from identified physical risks to the PE policy sections.
Interview: PE personnel	Asks facility, security and operations staff with physical and environmental responsibilities what the policy requires and how they apply it.	Staff who can explain their duties and point to the current procedure, plus training or briefing records.
Dissemination records	Checks that the policy and procedures reached the defined roles, and that the recipients can locate the current version.	Distribution lists, acknowledgment records or intranet publication logs showing who received each version.
Review and update cycle	Compares the defined review frequency and triggering events with the actual review history.	Review log showing dated reviews, plus records of reviews after defined events such as facility changes or incidents.
Common findings	Undated or unversioned policies, missing dissemination records, and reviews that did not take place after a triggering event.	Change history, owner sign-off on each revision and a corrective action record for any gap found.

Steps to write, approve and maintain the PE policy and procedures

This sequence turns PE-1 from a requirement on paper into a policy and procedures set that matches how the facility actually runs, is approved by management, reaches the people who need it, and stays current through a defined review cycle and event triggers.

Confirm the policy level and scope
Decide whether the policy will sit at the organization, mission or business process, or system level, and list the facilities, systems and staff it covers. Confirm which SP 800-53B baseline applies to the systems in scope, since PE-1 is allocated to the low, moderate and high baselines. The output is a short scope statement that names the level, the facilities and the system boundaries, and that a named sponsor has agreed to it. Ask your assessor early whether they expect one policy or a set of policies by location.
Assign a designated official
Name one designated official who owns the physical and environmental protection policy and procedures, keeps them current and answers assessor questions about them. This person may be the facilities security lead, the CISO or another accountable role, but the choice should be written down with a deputy identified. The output is an appointment record or a line in the policy that names the role, its authority and its contact point. Without a named owner, review dates tend to slip, so confirm the role holder in writing before drafting begins.
Draft the policy against each required element
Write the policy so it covers purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities and compliance. Map each element to a section heading so that an assessor can find it quickly. Where the organization already has an information security policy, reference it rather than repeating it, and state how physical controls fit within it. The output is a draft policy with a traceability table that lists each required element next to the section that addresses it. Reviewers from facilities, IT operations and HR should comment before the draft moves forward.
Write procedures that match real facility operations
Translate the policy into procedures that describe how the work is actually done: who grants badge access, how visitors are logged, how power and environmental alarms are routed, how deliveries are received and how staff at alternate sites are handled where that applies. Walk each procedure through the facility with the people who perform it and correct any step they cannot follow. The output is a procedures set with an owner, a step sequence and a reference to the evidence each step produces, such as a badge log or an alarm ticket. Procedures copied from a template and never tested against operations are a common assessment finding.
Obtain management approval
Send the policy and procedures to the senior official who will formally approve them, with a short cover note that states the scope, the designated official and the review cycle. Record the approval date, the approver's name and the version number. The output is a signed or recorded approval and a version history that starts at the first approved version. Keep the approval record with the policy so that an assessor can see that management commitment is documented, not only asserted in the text.
Disseminate to defined roles
Distribute the approved policy and procedures to the roles the organization has defined, such as facilities staff, security operations, reception and data center operators, and keep a record of who received them and when. Where a role must acknowledge the document, collect those acknowledgments. The output is a dissemination record, for example a distribution list, an access log for the document repository or signed acknowledgments. Confirm that the repository restricts edits to the designated official while letting defined roles read the current version.
Set the review cycle and event triggers
Define how often the policy and procedures are reviewed and updated, and list the events that force an earlier review, such as a facility move, a new access control system, a significant incident or a change in the systems in scope. The organization sets these values, so record them in the policy itself rather than leaving them implicit. Confirm the frequency with your own governance rules and any contractual or regulatory obligations you carry. The output is a review schedule with named reviewers, a change log and a trigger list that the designated official can point to during an assessment.
Maintain version control and evidence of review
Store each version so that changes, dates and authors are recorded, and keep the review outcomes, even when the review finds no change. Wiki or document platforms with version history can hold this evidence, but the organization must still confirm that its chosen tool retains the history it needs. The output is a maintained record in which each review has a date, a reviewer, a decision and a link to any revised version. Assessors examine this trail to judge whether the policy is kept current in practice, so treat each review as evidence to be produced on request.

Setting review and update cycles that survive an audit

PE-1 requires the organization to define how often the physical and environmental protection policy and the procedures that implement it are reviewed and updated, and to define the events that force an earlier review. The assessor will compare those defined values with what the organization actually does, so the cycle you write down must be one you can prove you follow. Choose a frequency that your governance calendar, staffing and facility change rate can sustain. A cycle that is ambitious on paper but skipped in practice is one of the most common findings in this area, because the gap is visible in the document history itself. Confirm the exact wording of the frequency and event requirements in the control text in NIST's CPRT catalog before you draft anything, since your organization-defined parameters must match it.

Give policy and procedures separate cycles. The policy usually changes slowly and is approved at a senior level, while procedures for badge issuance, visitor escort or data center access change whenever a vendor, room layout or badge system changes. Name the trigger events explicitly: a move or expansion of a data hall, a change in the badge or video platform, a security incident at a facility, a change in the staff roles that own physical access, or a finding from an audit or test. Record each trigger in the policy's change log with the date, the event and the decision taken, even when the decision is to make no change. Assessors look for evidence that events were considered, not only that a scheduled review happened.

Record every review, including reviews that end with no change. A dated entry stating who reviewed the document, what they checked and that the content remained accurate is evidence that the cycle operated. Keep the reviewer, approver and version number in the document itself, and use the wiki or document system's version history as the audit trail rather than a separate spreadsheet that can drift from the content. Self-hosted tools such as XWiki keep version history, let you compare versions and roll back, which supports this record. Before the assessment, confirm with your internal audit or compliance lead which review frequency and trigger events the organization has formally adopted, and check that the last review date falls within that cycle.

Evidence that passes a PE-1 assessment

A PE-1 assessor examines a small set of documents and interviews the people who own them. The cards below cover each artifact, what it must show, and how to keep it current between assessments so the evidence reflects how the facility is actually run.

The approved PE policy

The signed, approved policy is the first document an assessor opens. It should state purpose, scope, roles, responsibilities, management commitment and coordination among the offices that run physical security, facilities and IT. Confirm that the policy names the level it applies at (organization, mission or business process, or system) and that the approver is someone with authority over the facility. An unapproved draft will not pass.

The procedures document

Procedures show how the policy is carried out day to day: who requests and approves facility access, how visitors are logged, how deliveries are received and how facility faults are escalated. Each procedure should name the role that performs it and the records it produces. Check that procedures match the policy and that they describe the systems people really use, such as badge platforms and ticketing tools.

Designated official appointment

PE-1 requires that the policy and procedures be managed by a designated official. Keep a signed appointment letter or role description that names that person, their authority and their deputy. Assessors often ask who can change the policy in an emergency, so record that delegation too. The appointment should be reviewed whenever the official changes role.

Dissemination records

Assessors check that the policy and procedures reached the defined roles, not only the people who wrote them. Keep acknowledgment records, distribution lists, intranet publication logs or training attendance tied to the policy version. Compare the distribution list with the current staff roster so that new facilities, security guards and contractors are covered.

Version history with approvals

Version control shows what changed, when and by whom, and it lets reviewers compare any two versions. In XWiki, every page change is kept under version control and users can roll back to an earlier version. In BookStack, role-based permissions limit who can edit and publish. Keep the approval record for each version next to the change log so that the approved text can always be shown.

Review records and risk strategy references

PE-1 requires review and update at a defined frequency and after defined events. Record each review, its outcome and any change it triggered, such as a facility move or a fire incident. Link the policy to the organizational risk management strategy that assessors examine, and to the risk assessment that identified facility hazards. Confirm your own review frequency in the policy itself, because the standard leaves that value to the organization.

What meeting PE-1 costs in money and effort

This table breaks down the cost components of producing and maintaining a PE-1 policy and procedures set, marking each as one-time or recurring and naming who is paid. Read it as a checklist for requesting a quote, since no price or duration for these items is published in the sources we rely on. The main takeaway is that most of the cost is internal staff time, and the scope of facilities and sites drives it more than any tool choice.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it up or down
Drafting the policy and procedures	Internal policy owner, with implementation partner support if scoped	One-time, then revised	Number of facility types, sites and system categories covered
Facility and security staff review	Facilities, guard, and physical security staff	One-time per cycle, recurring at each review	Number of reviewers and how many sites need local procedure annexes
Management approval	Senior leadership who adopt the policy	Recurring at each approved revision	Whether approval is per policy or bundled with a wider security policy set
Document tooling and hosting	Software licensing or self-hosted infrastructure (for example, a wiki)	Recurring license or hosting spend	Whether an existing self-hosted wiki or document system can host the policy
Dissemination and acknowledgment	Internal communications, HR and system owners	Recurring with staff turnover and policy changes	Headcount with physical access responsibilities and contractor population
Scheduled and event-driven reviews	Policy owner and designated official	Recurring on the defined frequency and after defined events	How often the organization defines reviews and how many events trigger them
Assessor time for examination and interviews	Independent assessor or internal assessment team	Recurring at each assessment cycle	Number of determination statements in scope and interview count
Implementation partner work	Implementation partner under a written, fixed scope	One-time build, optional recurring support	Scope agreed in writing, including what evidence and document templates are included

Who owns PE-1, what a partner does, and where the auditor stops

Your organization owns PE-1. The policy is a statement of management intent for physical and environmental protection, so a senior official must approve it, and a designated official must be accountable for it. The policy and its procedures must reflect how your facilities, data centers and co-location arrangements actually operate, which only your staff can confirm. Your organization also decides the level at which the policy applies (organization, mission or business process, or system) and the defined review frequency and triggering events.

Approval and ownership: Name the senior official who approves the policy and the designated official who maintains it.
Scope decisions: Decide which facilities, tenants and system components the policy covers.
Defined frequencies: Set the review and update cycle for the policy and procedures, and the events that force an early update.
Dissemination: Distribute the approved documents to the roles that need them and keep proof of distribution.
Operational truth: Confirm that the procedures describe what staff really do at the entry points, visitor desks and facility managers' offices.

Before engaging anyone, confirm which of these decisions your governance charter already assigns, because the assessor will test them against your records.

Where PE-1 programs usually fall short

PE-1 looks simple on paper: a policy, procedures, and a review cycle. Assessors usually find the gaps in how those documents connect to the risk strategy, the facility, the people who own them, and the records that show they were actually used.

Policy not tied to risk strategy

The PE policy is often written as a generic statement that never references the organization's risk management strategy. An assessor will examine that strategy alongside the policy, so a gap here is easy to spot. Fix it by naming the risk strategy in the policy's purpose and scope, and by mapping each physical threat in the risk register to the policy section that addresses it. Check that the same owner maintains both documents.

Procedures that ignore the facility

Procedures copied from a template often describe badge systems, shutoff switches or visitor logs that the actual site does not have. Walk each procedure against the building, including the data center, server room and any alternate work sites in scope. Replace generic steps with the real entry points, equipment owners and escalation contacts, and record the date of the walkthrough as evidence.

Unclear ownership of the policy

PE-1 requires a designated official to manage the policy and procedures, yet many programs split responsibility between facilities, IT and security with no single name on the document. When the owner is unclear, reviews slip and nobody approves changes. Assign one accountable official in the policy itself, list the roles that support them, and keep a current roles and responsibilities table in the document repository.

No proof of dissemination

Publishing the policy on a shared drive does not show that the defined roles received and accepted it. Assessors look for distribution records, acknowledgments and interview answers from personnel with physical protection duties. Use a document system that records who was notified and when, and collect signed or electronically recorded acknowledgments from each defined role after every version change.

Reviews off the defined cycle

Policies often carry a review date that passes unnoticed, or they are updated only after an incident. PE-1 requires review at a defined frequency and after defined events, so the cycle must be written down and tracked. Set the frequency and triggering events in the policy, schedule reminders, and keep a change log showing each review, what changed and who approved it.

Common questions about PE-1 cost, effort and outside help

How much effort does PE-1 take to meet?

PE-1 is a documentation and governance control, so the effort sits in writing a physical and environmental protection policy and the procedures that implement it, getting them approved, and keeping them current. The policy has to cover purpose, scope, roles, responsibilities, management commitment, coordination and compliance. The procedures have to show how staff actually carry out physical protection tasks. The effort rises with the number of facilities, the number of system types and the number of teams that touch physical protection. Most of the work is drafting, reviewing with facilities, HR and security owners, and setting a review cycle that you can keep to. Ask any partner to split its estimate into drafting, stakeholder review, approval and the first review cycle, so you can see where the hours go.

Can an organization write its own PE-1 policy in-house?

Yes. PE-1 does not require an outside firm to write the policy, and an in-house team that knows its facilities can produce a compliant document. The control asks for a policy set at the organization, mission or business process, or system level, plus procedures, disseminated to defined roles and managed by a designated official. The risk for in-house teams is usually coverage rather than wording: physical controls often sit with facilities, real estate or a colocation provider, while the system owner sits in IT. A policy that ignores one of those owners will fail review. Confirm with your assessor which level of policy they expect for your environment, and make sure the named official has the authority to enforce it.

What does an outside partner contribute to PE-1?

A partner can help prepare the documents and the evidence behind them, but it does not own the control or issue any assessment result. DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, and it prepares systems, controls and evidence for compliance assessments. For PE-1, a partner can draft the policy and procedures from your existing practices, set up a document management system with version history and role-based permissions, map the documents to the roles named in your policy, and assemble the review record. Only an independent assessor or certification body issues reports or certificates. Engagements are normally fixed-scope, with scope and deliverables agreed in writing before work starts.

How long does it take to get PE-1 in place?

The supplied facts do not give a duration for PE-1, so confirm the timeline with your partner and your assessor before you commit. The schedule depends on how many facilities and teams the policy covers, how much current practice is already written down, how many approval layers the document has to pass, and whether a review cycle has already been set. An organization with a current physical security standard and named owners will move faster than one that has to agree on ownership first. Ask for a written milestone plan that separates drafting, stakeholder review, approval, dissemination to defined roles and the first scheduled review.

What does PE-1 need from facility and HR staff?

PE-1 needs facilities and HR staff to describe how things actually work, then to agree to follow the documented procedures. Facilities staff provide the detail for physical access, visitor handling, power, fire, environmental and water protection, and delivery and removal, because the procedures must match what happens on site. HR staff provide the input on role changes, onboarding, offboarding and sanctions, and they help make sure the policy reaches the right people when someone joins, moves or leaves. Both groups must confirm the roles and responsibilities written into the policy and agree on the review frequency and the events that trigger an update. Without that agreement, the document describes a process nobody runs.

Does a written PE-1 policy alone satisfy the control?

No. A written policy is necessary for PE-1, but an assessor will also look for procedures that implement it, evidence that the documents were disseminated to the defined roles, and proof that they are reviewed and updated on schedule and after defined events. Examples of supporting evidence include the approved policy with its version history, the procedures, distribution records, review minutes or sign-off records, and the list of roles and the designated official. An assessor may also interview personnel with physical and environmental protection responsibilities to see whether they know what the policy requires. A policy sitting on a shelf that no one has read or reviewed will not pass.

How do version control tools help keep PE-1 documents current?

Version control tools keep a record of each change, which helps you show when a policy was reviewed and updated. XWiki keeps every change to a page under version control, recording what changed, when and by whom, and lets users compare versions and roll back. BookStack assigns user abilities through roles, and permissions can be overridden per role at the shelf, book, chapter or page level. Together these features support the dissemination and review evidence an assessor will ask for. Confirm with your assessor that a wiki or document system is acceptable as the record of approval in your environment, and confirm the exact features of any version you deploy before you rely on them.

How DeployOpen prepares PE-1 evidence

DeployOpen's part in PE-1 starts with a written scope agreed before work begins. The scope names the facilities and systems the policy covers, the policy and procedure documents to be prepared or revised, the roles that must receive them, and the document system where they will live. Most engagements are fixed-scope, so deliverables and timelines are settled in writing up front. The organization still owns the policy. Its designated official approves the content, decides the review frequency and defines the events that trigger an update, and DeployOpen helps draft and structure the material for that official to adopt.

On the document side, DeployOpen can set up the repository that holds the policy, procedures and their review history. Self-hosted wiki and knowledge base platforms such as XWiki keep version history that records what changed, when and by whom, and let reviewers compare versions and roll back. BookStack assigns permissions through roles that can be overridden at shelf, book, chapter or page level, which helps separate who edits physical security procedures from who only reads them. Ask the organization to confirm which of these platforms, if any, it already runs and who holds administrator rights, since assessors will ask who could change a policy and whether those changes were approved.

When the assessment approaches, DeployOpen assembles the evidence an assessor will examine: the current policy and procedures, the dissemination record showing who received them, the review and update history, and the link between the policy and the organization's risk management strategy. DeployOpen does not issue assessment reports, attestations or certifications. Those come only from an independent assessor or certification body, and the organization remains accountable for whether PE-1 is actually operating. Before the engagement starts, confirm with the assessor which documents they expect and in what format.

PE-1 Policy and procedures