What PE-10 emergency shutoff requires for a data center
If an assessment or authorization is coming and your server room has an emergency power off button, or has none at all, the question is whether PE-10 is in scope and what it asks for. PE-10 applies only to the moderate and high SP 800-53B baselines, not to low, and it is not part of the privacy baseline. Its enhancements are withdrawn in Release 5.2.0, so the base control is the whole requirement. In plain terms it asks for three things: a capability to cut power to defined systems or components in an emergency, shutoff switches or devices placed in defined locations that authorized personnel can reach, and protection of that capability against unauthorized activation.
The three parts are tested together. An assessor will want the organization to define which systems or components the shutoff covers, which rooms hold the switches, and who is authorized to operate them. Reachability matters as much as presence: a switch behind a locked cabinet, in a room only one person can enter, or blocked by racks may fail the test even though it exists. Protection against accidental or malicious activation is usually handled with a cover, a guard, a key or a logged procedure, and the assessor will ask how the organization prevents a bumped or deliberate trip. Confirm the defined scope, switch locations and protection method with your facilities team and write them into your physical and environmental procedures before the assessment begins.
This is hard in older rooms because the shutoff can drop power to live equipment, and an unplanned trip carries electrical hazard and outage risk. Retrofitting a switch may mean changes to panels, wiring, fire and access arrangements, and the work often needs licensed electricians and a change window that the operations team can accept. Ask your facilities or electrical contractor to confirm the existing wiring, the switch options your room can support and the cost and downtime of each. Those answers, not the control text alone, determine the effort and cost of meeting PE-10.
Which systems, rooms and teams PE-10 reaches
PE-10 only has meaning once the organization has named the systems it must be able to shut off and the rooms where those shutoffs sit. The cards below cover the scoping decisions that set the work, who owns each part, and the neighboring concern of water damage under PE-15.
Defining the systems and components
PE-10 requires shutoff capability for defined systems or components, so the first task is a written list of what the emergency shutoff must cut. Include racks, server rows, network core and any supporting equipment whose power must be removed in an emergency. Record the boundary for each entry, because a shutoff that cuts a rack but leaves its storage array live is a gap an assessor will find. Confirm the list against the current system inventory before it goes into the system security plan.
Mapping rooms and shutoff locations
Each shutoff switch or device must sit in a defined location that authorized personnel can reach. For a data center or server room, list every door, the switch that serves it and the path to it from the operations floor. Walk the route with the facilities team, since a switch behind a locked cabinet or in a room with no authorized staff nearby may not meet the requirement. Document the locations so the examine step can be passed without interviews to reconstruct them.
Colocation and cloud facilities
When the facility belongs to a colocation or cloud provider, the physical shutoff may be inherited rather than owned. Obtain the provider's control documentation and confirm which emergency power shutoff mechanisms cover your racks or tenant space. Your organization still owns the decision about which of its systems must be reachable in an emergency, and it must review the provider's evidence on a schedule. Ask the provider exactly where its shutoff devices sit relative to your equipment, and whether it lets authorized personnel from your organization operate them.
Splitting work across three teams
Operations usually runs the room and its escalation path, facilities owns the physical switches, wiring and electrical protection, and security owns protection against unauthorized activation and the access records for who can reach the switches. Assign a named owner for each element in the RACI and make sure each team can produce its own evidence. Gaps tend to appear where the switch is facilities' asset but operations is the only team that tests it.
Moderate versus high impact
PE-10 is allocated to the moderate and high baselines but not to low, so a system's impact level decides whether the control applies at all. Under the moderate baseline, scope the defined systems and rooms as above. Under the high baseline, the same control applies with the organization's own tailoring of the defined parameters, and the scope is typically wider. Tailoring can narrow the defined components only with a documented rationale, and the assessor will test that rationale against the system's categorization.
Neighboring control: PE-15 water damage
PE-15 covers protection against water leakage with accessible master shutoff or isolation valves that key personnel know how to operate. It is a separate control, but the two are often assessed together because both protect power and equipment during an emergency and both depend on the same facilities staff. Check that the water shutoff and the electrical shutoff sit in the same emergency procedure, so responders do not have to find them under pressure. PE-15 is related to PE-10 in the catalog, so keep the two evidence sets cross-referenced.
How an assessor tests PE-10
This table maps each SP 800-53A determination statement for PE-10 to the assessment method, the evidence an assessor asks for and the findings that tend to come up. Read it as a preparation checklist: for each row, confirm you can produce the named artifact before the assessor arrives.
| Assessment focus | What the assessor does | Evidence to have ready | Common findings |
|---|---|---|---|
| Examine: procedures and documentation | Reads the documented procedures for emergency power shutoff and confirms they cover the power source, the shutoff controls and switches, and where the switches are housed. | Written emergency power shutoff procedure, a list of the defined systems or components it covers, and the facility diagram showing switch locations. | No written procedure, or a procedure that names no defined systems or components. |
| Examine: switches and locations | Walks the room or data center, locates each shutoff switch or device and checks that it sits where authorized personnel can reach it. | Photographs or floor plan with switch positions, a current inventory of switches, and access lists for the rooms that hold them. | Switches behind locked or unlabeled doors, switches with no signage, or switches not shown on any document. |
| Interview: personnel who implement the capability | Asks facilities and operations staff how they would activate the shutoff, who authorizes it and how they would restore power. | Named responsible roles, activation and restoration steps, and records showing staff were briefed on the procedure. | Staff who cannot describe the activation steps, or who do not know who may authorize a shutdown. |
| Interview: personnel who use the capability | Asks the people who work in or near the protected systems whether they know where the switches are and when to use them. | Training or briefing records for users and a site safety briefing that covers the shutoff locations. | Users unaware the switches exist, or unclear on the criteria for activating them. |
| Test: shutoff mechanisms | Observes or reviews a controlled test of the mechanism that cuts power to the defined components and confirms the intended components lose power. | Dated test records with the scope, the components affected, the result and the restoration steps, witnessed or signed by the responsible role. | No record of any test activation, or tests that did not confirm which components lost power. |
| Test: protection against unauthorized activation | Checks that the shutoff capability is guarded, for example by covers, locks or alarms, and that unauthorized activation is detected or prevented. | Physical security configuration for the switches, access logs for the switch locations, and any alarm or cover records. | Unprotected switches open to anyone in the room, with no covers, locks or activation logging. |
| Scope confirmation | Compares the systems and components named in the procedure with the components actually powered by the switches. | Reconciled list of defined components tied to the switches that control them. | Components drawn from the procedure that are not wired to any shutoff, or new equipment added without updating the list. |
Implementing emergency shutoff in order
This sequence turns the PE-10 requirement into a documented, tested and staffed emergency power shutoff capability that an assessor can examine, interview against and test. Each step produces a record that feeds the next one.
Define the systems and components in scope
The organization, with its facilities and system owners, lists the systems, racks, rooms or power circuits that the emergency shutoff must cut off. The output is a scope statement that names each defined system or component and the power source that feeds it. Confirm the scope with the system owners and the facility team before any switch is specified, because the control applies to defined components and an undefined scope cannot be tested.
Document the emergency shutoff procedure
Write the procedure that governs when the shutoff is used, who may operate it, the order of actions, how power is restored and how the activation is recorded and reported to incident response. The output is an approved procedure with a named owner and a review date. Assessors will examine this document first, so it must match the switches and locations actually installed in the facility.
Place and label the shutoff switches
Using the scope statement, the facility team selects locations for the shutoff switches or devices that authorized personnel can reach quickly, including during an emergency, and marks each switch with its purpose and the systems it controls. The output is a location plan, typically a floor or room drawing with switch positions, and photographs or inspection notes confirming the labels. Confirm with the facility operator that the switch locations also work with fire and evacuation routes.
Restrict access and guard against accidental activation
Limit who can operate each switch to the personnel named in the procedure, and protect the switch against unauthorized or accidental activation, for example with a cover, a guarded housing or a second-person step, as the design allows. Pair this with the physical access controls already in place for the room. The output is an access list for the switches and a record of the protective measures installed, reviewed against the list of authorized personnel.
Log switch access and test the mechanism
Configure a log of who operates or attempts to operate each switch, and test the shutoff under a controlled, scheduled exercise that the facility operator approves in advance. Confirm that the defined systems lose power, that the switch position and labels are correct, and that restoration follows the procedure. The output is a dated test record listing the components tested, the result, any defects and the corrective actions assigned. Ask the facility operator how the test is scheduled so that production systems are protected.
Train and assign the responsible personnel
Brief the personnel who implement and use the capability on the procedure, the switch locations and their responsibilities, and record the attendance. Assign a named owner for the capability and an alternate. The output is a training record and a current assignment list that an assessor can compare against the interviews they conduct. Repeat the briefing when people change roles or when the procedure or switch layout changes.
Balancing reachable switches with protection from activation
In a purpose-built server room, the organization usually controls the electrical design, so it can place emergency shutoff switches at defined locations that authorized personnel can reach quickly, such as near the main exit, while keeping them away from public corridors. The main design question is how to make the switch easy to operate in an emergency yet hard to trigger by accident or by someone without authority.
- Protective covers: Specify a clear, labeled cover or enclosure that must be lifted or broken before the switch operates, and record the cover type in the facility drawings.
- Alarm on activation: Connect the switch to the building management or alarm system so that any operation generates an alert to security and facilities staff.
- Access to the location: Restrict the switch area with badge or key control consistent with PE-3, and log entry where the design allows.
- Test records: Keep documented test or drill results showing the shutoff operates as designed and that the protective cover and alarm function.
From your own records, you can usually produce the drawings, switch inventory, cover specifications, alarm configuration, access logs and test records. Confirm with your electrical contractor that the as-built layout matches the drawings before an assessor relies on them.
Many server rooms sit in older buildings where the shutoff is a building-level device, such as a main breaker or a facility-wide disconnect that also serves offices and other tenants. Reachability is easier to satisfy here, but the switch may be shared with people outside the organization's control, which weakens protection from activation. Confirm who owns the device before writing the control narrative.
- Scope of shutoff: Document exactly which circuits the building-level device cuts, and whether it reaches the protected systems at all.
- Shared protection: Ask whether a cover, lock or alarm already exists, and whether the organization can add a local protective measure that the building owner approves in writing.
- Activation logging: Confirm whether building management logs operation of the device, and who receives the alert.
- Interim measures: Where no dedicated shutoff exists, document the compensating arrangement and the planned remediation in the plan of action and milestones.
The organization can produce its own system inventory and any local access records, but the single-line diagram, device ownership, alarm logs and maintenance records usually come from the building owner or facility operator. Request them in writing and confirm the scope they cover.
In colocated or provider-hosted space, the facility operator controls the shutoff devices, and the organization inherits some or all of PE-10 through the operator's documentation. The organization still needs to confirm that the operator's arrangement reaches its own cabinets, cages or racks, and that the protections meet the requirement for the system's baseline. Inheritance is recorded in the system security plan, not assumed.
- Operator attestations: Request the operator's control documentation, including its physical security and power sections, and any independent report that covers them.
- Cage and rack scope: Confirm whether the operator's shutoff reaches the organization's specific equipment, and whether the organization may add local protection inside its own cage.
- Activation notification: Ask how the operator notifies customers when an emergency shutoff operates in their suite or hall.
- Contract terms: Make the required evidence, notification timing and inspection rights part of the contract or service agreement.
The organization can produce its contract, its inheritance mapping and its own cage access logs. The operator must supply the shutoff design, protective measures, activation records and test results, so the organization should request them before relying on inherited coverage.
Evidence that passes a PE-10 review
An assessor testing PE-10 examines documents, interviews the people who run the shutoff, and tests the mechanism itself. The artifacts below map to those three methods, and each one needs an owner who signs it and a date that shows it is current.
Defined list of protected systems
A written list of the systems and components the emergency shutoff covers, such as racks, zones or specific server rooms, tied to the system security plan. It matters because PE-10 requires the shutoff to reach defined systems, so an assessor will compare this list against what the shutoff actually disconnects. Confirm that every new rack or circuit added since the last review appears on it. The facilities or data center manager should sign it, and the system owner should countersign.
Emergency shutoff procedure
The step-by-step procedure for operating the shutoff, including who may activate it, the order of notifications, how power is restored, and when the fire or facility team is called. Assessors read this to confirm the capability is used deliberately and not improvised. Check that it names current roles rather than individuals who have left. Review it after any facility change, and have the facilities lead and the security lead sign it.
Shutoff location and labeling records
Floor plans or site drawings that show where each shutoff switch or device sits, with photographs or a labeling log confirming the markings match the drawings. PE-10 requires the switches to be in defined locations that authorized personnel can reach, so an assessor will walk the room against these records. Keep the drawings updated when racks or doors move. The facilities manager should sign the drawings after each physical walkthrough.
Authorized personnel access list
The roster of people permitted to operate the shutoff, reconciled against the physical access authorization list for the room. Interviews under PE-10 test whether the responsible personnel understand their role, so this list shows who should be answering. Remove departed staff promptly and confirm that the people listed can reach the switch during an outage. The data center manager should review it on the same schedule as physical access reviews and sign each revision.
Activation test records
Dated records of tests that exercise the shutoff mechanism, including the scope tested, the result, observed defects and the follow-up ticket. Testing is one of the assessment methods, so an assessor will ask for proof that the mechanism works and that protective covers or interlocks function. Record tests against a schedule the organization defines in its own procedures. The facilities lead and a witness from security should both sign each test record.
Inspection and change records
Inspection logs for the shutoff devices and change records for any modification to the circuits, switches, covers or room layout that affects them. These show the capability was maintained between audits and that changes were reviewed for their effect on the shutoff. Ask your electrical contractor or facilities vendor to attach their inspection reports to the log. The facilities manager signs each inspection, and the change approver signs each change.
What meeting PE-10 costs in money and effort
This table breaks the cost of meeting PE-10 into its components, showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. NIST does not estimate compliance costs, so no figures appear here; use the drivers to build a question list for your facility team and any partner before requesting an itemized quote.
| Cost component | Who is paid or who carries it | One-time or recurring | What drives it |
|---|---|---|---|
| Engineering scope to define covered systems and shutoff points | Internal engineering or an implementation partner under a written scope | One-time, with reviews when the room changes | Number of rooms, racks and downstream loads that must be named in the control |
| Electrical and facilities work for switches and covers | Licensed electrical contractor and facilities team | One-time, plus repairs when hardware fails | Age of wiring, panel location, whether shutoff already exists, and whether the shutoff can be guarded without blocking egress |
| Protection against unauthorized activation | Facilities team and security team, sometimes a locking or cover vendor | One-time installation, recurring key or cover checks | Number of switches, whether they sit in shared corridors, and how many people hold keys |
| Access list and activation log upkeep | Facilities or security operations staff | Recurring, tied to staff turnover and access reviews | Headcount with authority to operate the switches, and whether logging is manual or automated |
| Tooling for alarms or logging of switch state | Facilities or monitoring vendor, or internal platform team | Initial setup and recurring licensing or support, if purchased | Whether existing building management or monitoring systems can already report switch status |
| Test coordination and downtime planning | Facilities, operations and application owners | Recurring, at the test interval the organization sets | Shared power domains, redundancy level, and how much of the load can be failed over before a test |
| Auditor sampling and evidence preparation | Internal compliance staff and the independent assessor | Recurring at each assessment cycle | Number of locations in scope, how well test records are kept, and whether assessors need site visits |
Where open-source tooling helps and where it does not
Open-source tooling supports PE-10 indirectly. The shutoff capability is physical: the switches, their labeling, their locations and the protection that keeps unauthorized people from operating them. No software product produces that hardware or the act of shutting power off, so a platform cannot make an organization meet PE-10 on its own. What a self-hosted platform can do is keep the records an assessor will ask for. Start with an asset register or inventory that lists each defined system or component the shutoff is meant to cover, the room or zone it sits in, and the shutoff device that serves it. Self-hosted inventory tools running inside your own network can hold that list, so the mapping between a component and its shutoff point is written down and version controlled rather than kept in someone's head.
The second contribution is a ticketing record of inspections and test activations. PE-10 assessors examine procedures and interview the people who operate the capability, and they look for proof that the procedures were followed. A self-hosted ticketing or work-order system can log each scheduled inspection of the shutoff switches, each test, the person who performed it, the result and the follow-up for any defect. The third contribution is access logs. If the room housing the switches uses a self-hosted access control or badge system, its logs can show who entered the location, which supports the question of whether only authorized personnel could reach the switches. Confirm with the vendor exactly which log fields are exported and whether they are retained long enough for your review cycle.
Do not expect software to monitor the shutoff circuit itself unless the facility has instrumented it. Whether a building management or power monitoring product can report switch status, detect unexpected activation or alarm on tampering depends on the hardware and the vendor, so confirm that capability in writing before you count it as evidence for the protection requirement. Plan the physical controls, the switch placement review and the inspection routine with facilities and electrical engineering staff, then decide which records software will hold. An implementation partner can configure and document those self-hosted records, but the organization owns the control and an independent assessor decides whether the evidence is sufficient.
Who owns PE-10 and what a partner can take on
Your organization owns the PE-10 control. That means the emergency power shutoff capability, the decision about which systems or components it covers, the physical placement of shutoff switches or devices, and the procedure that tells people when and how to use them. The shutoff must be controlled by authorized personnel, so your facilities and security leads decide who those people are and how their authority is recorded. Your team also owns the facilities work, such as installing or relocating switches, protecting them from unauthorized activation, and confirming that the switches remain reachable as the room layout changes.
- Shutoff ownership: Name an accountable owner for the emergency shutoff and for each data center or server room where it applies.
- Switch placement: Decide the defined locations for shutoff switches or devices and confirm authorized personnel can reach them.
- Protection from misuse: Define how the shutoff is guarded against unauthorized activation, such as covers, alarms or access controls.
- Procedure: Write and approve the emergency shutoff procedure, including who may operate it and when.
- Authorized personnel: Keep the list of people who implement and use the capability current.
Before any outside work starts, confirm that these owners and the procedure exist on paper and in practice, because assessors will ask for both.
An implementation partner such as DeployOpen can help prepare the systems, documentation and evidence that support PE-10, under a written, fixed scope agreed before work begins. The partner does not own the control and does not decide whether your shutoff design is adequate. Typical work includes documenting scope, packaging evidence the organization already produces, building and maintaining the inventory of covered systems and shutoff locations, setting up logging where the environment supports it, and coordinating tests of the shutoff mechanisms with your facilities staff.
- Scope documentation: Record which systems, components and rooms the PE-10 scope covers, and keep that record aligned with the system security plan.
- Evidence packaging: Collect procedures, photographs, diagrams and test records into a structure the assessor can follow.
- Inventory and logging: Maintain the list of shutoff devices and locations, and capture logs of who accessed or operated them, where the platform and facility allow.
- Test coordination: Plan and document shutoff tests with your staff, including safety sign-off and records of results.
- Written scope: Agree deliverables, responsibilities and timelines in writing before work starts, and confirm what is excluded, such as electrical installation.
Before signing, ask the partner which items they will hand over and which remain with your staff.
The independent assessor examines, interviews and tests PE-10 using the assessment procedures in SP 800-53A. Examination covers the procedures, the shutoff controls and switches, and the locations that house them. Interviews cover the personnel responsible for implementing and using the capability. Testing covers the mechanisms that support or implement emergency power shutoff. Only the assessor or the organization's authorizing process can conclude whether the control is satisfied. DeployOpen prepares evidence and does not issue assessment reports, attestations or certifications.
- Examine: Review the emergency shutoff procedures, switch locations and related documentation.
- Interview: Speak with the people who operate the shutoff and those accountable for it.
- Test: Observe or verify the shutoff mechanisms under controlled conditions.
- Independence: The assessor must be independent of the team that prepared the evidence.
- Reports: Only the assessor issues findings and assessment results.
Before engaging an assessor, confirm their independence arrangements and the format in which they expect evidence to be delivered.
Where PE-10 programs usually fall short
PE-10 is a short control, which makes its gaps easy to miss. Most failures come from a shutoff that exists on paper but is not scoped, labeled, tested, or governed by a current access list. The cards below cover the gaps assessors most often find and the checks that close them.
Shutoff defined only in facility documents
The emergency power off procedure lives in the building or facilities manual, but the system security plan never names the systems or components it covers. An assessor testing PE-10 will ask which defined systems the shutoff reaches. Map each rack, cluster or room in scope to its shutoff zone, and record that mapping in the system documentation so the control has a bounded scope.
Switches unlabeled or hard to reach
PE-10 requires shutoff devices in defined locations that authorized personnel can reach. Switches hidden behind equipment, mislabeled after a rewire, or placed where only one person knows the location fail that test in practice. Walk the room with someone outside the facilities team, confirm each switch is labeled with the zone it controls, and check the path to it stays clear of stored equipment.
No record of test activations
Assessors look for evidence that the shutoff mechanism works, not only that it is installed. Many teams have never tested it, or tested it years ago without a record. Define a test procedure, schedule it, and keep dated records showing who ran it, what systems were affected, what the result was, and how the outcome was followed up. Confirm with your facilities provider how test activations are scheduled so they do not disrupt production.
Access list not reviewed after staff changes
People who can reach or activate the emergency shutoff should be authorized and kept current. When staff move roles or leave, their physical access often outlasts their need for the shutoff. Compare the list of personnel allowed to operate the switch against badge and key records at a defined interval and after each staffing change, and document the reviews. Link this review to the PE-2 authorization list so the two stay consistent.
Colocation provider controls not documented
In colocated facilities, the provider often owns the emergency power shutoff and its testing. If your system depends on that inherited control, the provider's responsibilities and evidence must be written down and reviewed. Request the provider's PE-10 related documentation, confirm which shutoff zones include your equipment, and record inherited controls in your control implementation statements with the evidence you rely on.
Procedures that do not name who may activate
A procedure that says staff should shut off power in an emergency but does not name who is authorized to do so leaves responders guessing during an incident. Assessors interview the people responsible for the capability, so those people must know their role. Name the roles authorized to activate the shutoff, the conditions that justify activation, the notification steps afterward, and the way unauthorized activation is prevented and reviewed.
PE-10 questions buyers ask before hiring help
How much effort does PE-10 take compared with the rest of the PE family?
PE-10 is one of the narrower controls in the Physical and Environmental Protection family because it has a single base control and no active enhancements, since all of its enhancements are withdrawn in Release 5.2.0. Its work centers on one capability: an emergency power shutoff that is documented, placed where authorized people can reach it, and protected from accidental or unauthorized activation. Controls such as PE-3 (physical access control) or PE-14 (environmental controls) usually take more effort because they run continuously across entry points, logs and sensors. The effort for PE-10 depends mostly on how many rooms, racks or power zones fall in scope and whether the existing shutoff hardware is already documented, labeled and tested. Ask your partner to break the estimate down by facility and by system component.
Do we need an implementation partner to meet PE-10?
No. Your organization owns the control and can meet it with internal staff, facilities teams and electricians. A partner is useful when internal teams lack time, when the facility has several rooms with mixed equipment, or when the evidence needs to be organized for an assessor. A partner can prepare the documentation, map shutoff locations to the systems they serve, and set up a test procedure. Only an independent assessor can examine the evidence and issue an assessment result. Any partner, including DeployOpen, prepares systems and evidence but does not issue reports or certifications.
How long does PE-10 work take, and what drives the timeline?
No duration is fixed for PE-10, and any figure you are given should come from a written scope. The main drivers are the number of facilities and power zones, the condition of existing shutoff switches and their labeling, whether wiring or controls need changes, and how quickly facilities and electrical contractors can schedule testing. Work also depends on your change control process, because a live shutoff test on production equipment needs approval and an agreed window. Ask for a schedule with separate phases for inventory, documentation, physical changes, testing and evidence collection, and ask which dependencies sit with your staff.
What does PE-10 need from our facilities and security staff?
The work draws on people who know the building and the equipment, not only on security staff. Expect to involve:
- Facilities or building management, who can confirm shutoff locations, electrical zones and any licensed electrical work
- Data center or server room operators, who know which systems each shutoff affects and the business impact of a shutoff
- Security staff, who define who is authorized to operate the switches and how activation is protected
- Change management, who approve any live test
Ask the partner to list each role, the decisions each role makes, and the number of hours each role should expect to spend.
Does PE-10 apply to low baseline systems?
No. In SP 800-53B, PE-10 is allocated to the moderate and high baselines only, so it is not required for systems categorized at the low impact level. It also does not appear in the privacy baseline. If your system is moderate or high, PE-10 applies to the components it defines. Confirm your system's baseline from its security categorization and any tailoring decisions, since an agency or contract may add or remove controls through tailoring or overlays.
Who issues the assessment result for PE-10?
An independent assessor issues the assessment result, not DeployOpen and not the implementation partner. The assessor examines procedures, locations and switches, interviews the personnel who operate and use the emergency shutoff capability, and tests the mechanisms that implement it. Depending on the authorization you pursue, your agency, contracting officer or authorizing official defines who may serve as the assessor. Ask your partner to prepare the evidence package, and ask the assessor to confirm in writing which artifacts they expect to review before testing begins.
What should we ask for in a quote for PE-10 work?
Ask for a written scope that lists each facility, power zone and system component covered, the shutoff devices in each area, and the evidence to be delivered. A useful quote separates one-time work, such as the inventory, documentation, labeling and testing, from recurring work, such as periodic retesting and records review. It should also state which tasks are performed by your staff, by licensed electrical contractors and by the partner, and what is excluded, such as hardware replacement or wiring changes. DeployOpen does not publish a price list, and a quote follows from the written scope.
How DeployOpen approaches PE-10 engagements
A PE-10 engagement starts with a written scope that names the systems or components whose power can be shut off, the rooms and data halls where the shutoff devices sit, and the people who own each decision. DeployOpen agrees that scope, the deliverables and the timeline in writing before work begins. The organization keeps ownership of the control: it decides which systems count as defined components, which personnel are authorized to operate the switches, and how the capability is tested. DeployOpen's role is to prepare the procedure, the inventory and the evidence set so the organization can show those decisions were made and carried out.
Most of the working time goes into two artifacts. The first is an inventory of every emergency shutoff switch or device, with its location, the circuits or equipment it controls, and the protections against unauthorized activation, such as covers, locks or alarmed enclosures. The second is the written procedure for emergency power shutoff, including who may operate the switches, how activation is logged, and how power is restored safely. DeployOpen drafts both from the site walk and interviews with facilities staff, then the client's facilities and security owners review and approve them. Confirm early whether your facilities team already keeps a switch register, because reconciling an existing register is usually cheaper than building one.
The evidence package is what the independent assessor will examine, interview against and test, so it should map directly to the three assessment determinations in SP 800-53A for PE-10. DeployOpen assembles the procedure, the inventory, photographs or floor plans showing switch placement, access lists for authorized personnel, and records of any functional tests the client has run. DeployOpen does not issue audit reports, attestations or certifications. The assessor decides whether the control is satisfied, and the organization should agree the assessor's scope and sampling approach before evidence is packaged. Many clients then move to a retainer for periodic test records, inventory updates after equipment changes and support during reassessment, which DeployOpen quotes separately from the initial scope. Ask any partner to confirm in writing who signs off on each artifact.
