PE-11 Emergency power: requirements and evidence

PE-11 emergency power: what the requirement asks for and why it is hard

If your system is categorized at the moderate or high impact level, an assessor will expect you to show that a loss of primary power does not leave the system in an uncontrolled state. PE-11 Emergency power asks for an uninterruptible power supply for the system so that, when the primary power source is lost, the system either shuts down in an orderly way or moves to long-term alternate power. The organization chooses which of those two outcomes it relies on, and the choice has to match the system's recovery objectives. Data loss, corrupted state, failed writes and outages that nobody controls are the risks the control addresses. The control is listed in the moderate and high baselines of SP 800-53B. It is not in the low baseline, and it is not part of the privacy baseline. The high baseline adds the enhancement PE-11(1), so the requirements for the high baseline are larger than those for moderate.

The control is hard because it crosses several disciplines that rarely share a single owner. Facilities and electrical teams own the UPS hardware, its capacity and its maintenance. Platform and operations teams own the shutdown sequence, which must be configured, tested and kept current as the system changes. Contingency planning owns the decision about whether the system shuts down or runs on alternate power for the expected duration. Assessors test the mechanism itself and the records that show it works, so gaps usually appear where these teams do not coordinate. Confirm with your facilities provider which parts of the UPS and the alternate power supply are owned by the facility, which by your organization, and which are shared with other tenants.

A practical starting point is to write down the decision for each system, then collect the evidence that supports it. Record the UPS make, capacity and runtime, the shutdown or transfer procedure, and the dates of the most recent tests and battery checks. The assessment procedure for PE-11 looks at emergency power procedures, UPS documentation and UPS test records, and it interviews the people responsible for emergency power. Monitoring the UPS state and tying alerts to a shutdown trigger gives you evidence that the control operates, not only that it was installed. Open-source tools such as Prometheus can collect metrics from instrumented jobs, and Grafana Alerting can raise alerts on those metrics, but whether a given UPS or power distribution unit exposes the needed metrics is something to confirm with the hardware vendor and the facility team before you design the monitoring.

Which systems, facilities and teams PE-11 reaches

PE-11 is not a flat requirement that every system carries. Four scoping decisions determine whether it applies, where the evidence lives and who answers for it. Settle these before estimating effort, because each one changes the people and documents involved.

Impact level that brings PE-11 in

SP 800-53B allocates PE-11 to the moderate and high baselines only, so a system categorized as low impact does not inherit it. Moderate and high systems carry the control, and high systems also carry PE-11(1). Confirm the categorization in the system security plan first, since a change in impact level can add or remove the requirement. Check whether the system is also in scope for privacy baseline work, because PE-11 is not part of the privacy baseline.

Facility that houses the system

The UPS and its alternate power arrangements must cover the room, rack or building where the system actually runs, including any secondary site used for contingency. A system moved to a new room, or a disaster recovery site added to the boundary, brings new power supplies into scope. Map every facility in the authorization boundary and record which power path feeds each one, so assessors can trace the control to real equipment.

Owned or provided power source

When the organization owns its data center, it holds the UPS, generator and transfer equipment, and must test them directly. When a colocation provider or cloud host supplies power, much of PE-11 may be inherited. Ask the provider for its emergency power documentation, UPS test records and generator test results, and confirm in writing which parts it covers. Any gap between provider evidence and the boundary becomes the organization's own finding to resolve.

Facilities team ownership

Facilities or building operations typically maintain the UPS batteries, generators, transfer switches and maintenance contracts. The IT operations team needs to know the shutdown sequence, the time the UPS provides and who receives power alerts. Agree in writing which team owns each piece of equipment, who signs off on test results and who is paid under each vendor contract, so the evidence assessors request has a named owner.

Orderly shutdown or alternate power choice

PE-11 requires the organization to select between an orderly shutdown of the system and a transition to long-term alternate power. The choice changes the runbooks, the testing approach and the contingency plan. An orderly shutdown needs documented sequencing, automated shutdown triggers and restart procedures. Long-term alternate power needs fuel supply agreements and generator load testing. Record the selection in the system documentation and align it with the contingency plan under CP-2.

Contingency planning and training links

PE-11 cross-references AT-3, CP-2 and CP-7, so the same power failure appears in training records, the contingency plan and alternate processing arrangements. A UPS that cannot carry the system to a safe shutdown is a contingency planning gap, not only a facilities gap. Confirm with the contingency planning owner that the power scenario is included in exercises and that staff who must act during an outage have current training.

How an assessor tests the emergency power control

This table breaks down the single SP 800-53A determination statement for PE-11 into its examine, interview and test methods, showing what each method looks at and what evidence it produces. Read it as a checklist of what to have ready before an assessor arrives, with the common findings showing where assessments usually stall.

Method and object	Test approach	Evidence requested	Common findings
Examine: emergency power procedures	Read the documented procedures that address emergency power for the facility housing the system and check they describe the orderly shutdown or alternate power transition the organization selected.	Approved emergency power procedures, owner, review date and the link to contingency planning procedures.	Procedures are generic, do not name the system, or describe a transition that the UPS sizing does not support.
Examine: UPS documentation	Compare the UPS documentation against the system's power needs and confirm the UPS is designed to carry the system through a power loss until the chosen response completes.	UPS specifications, load and runtime calculations, shutdown sequence or generator transfer design, and asset inventory entries.	Runtime figures are not tied to current load, or documentation predates equipment changes.
Examine: UPS test records	Review records of UPS tests and confirm they were performed, measured and acted on, including any failed tests.	Dated test logs, battery test results, corrective action tickets and sign-off by responsible staff.	Tests are missing for some periods, records show failures with no follow-up, or tests were never run under load.
Interview: personnel responsible for emergency power and planning	Ask facilities and system owners how the shutdown or transition works, who decides to start it and how they learn the UPS status.	Named roles, escalation contacts and notes showing the interviewee can explain the procedure in their own words.	Staff describe different sequences, or the people responsible for planning are not the people who run the facility.
Test: mechanisms supporting the UPS	Observe or test the monitoring, transfer switches, alarms and automatic controls that support the UPS and confirm they operate as documented.	Test scripts or observed results for transfer and alarm functions, configuration screenshots and monitoring alerts.	Alarms reach no one after hours, or transfer switches have not been exercised since installation.
Test: the UPS itself	Perform or witness a controlled power loss test or a load test and check the UPS carries the system for the required period and the shutdown or transition completes.	Witnessed test results, timestamps, system logs from the test window and a record of any issues found.	Tests are run without the real load, or the system is not shut down cleanly during the test.

How to implement PE-11 in the order assessors expect to see it

This sequence moves from scoping the control to the evidence an assessor examines, so each decision about backup power is documented, sized, exercised and tied back to contingency plans. The output is a set of records that show the UPS was chosen deliberately, works when tested and is known to the people who would respond.

Confirm baseline and enhancement scope
Start by confirming that PE-11 applies to the system. SP 800-53B allocates the control to the moderate and high baselines, not the low baseline, and it is not part of the privacy baseline. If the system is in the high baseline, add PE-11(1) to scope, which is the enhancement that covers alternate power supplies. The system owner and the compliance lead record the impact level, the baseline selection and any tailoring decisions in the system security and privacy plan. Done means the scope statement names the baseline, the enhancements in force and the facility where the system resides.
Document the shutdown or alternate power decision
PE-11 lets the organization choose between an orderly shutdown of the system and a transition to long-term alternate power when primary power fails. Facilities and system owners should evaluate both options against the mission, the expected outage handling and the recovery priorities of the system, then record the selection and the reasons for it. Assessors will check that the decision is written down, approved by the right owner and consistent with the contingency plan. Ask the facility team to confirm the choice matches what the building can physically support.
Size and document the UPS and runtime
Derive the UPS capacity and required runtime from a load analysis of the system components, the time needed for an orderly shutdown or the time needed to start alternate power, and the recovery objectives in the contingency plan. Do not reuse a generic figure from a vendor sheet. Record the sizing calculation, the assumptions and the engineer who signed it. The output is a UPS specification and a sizing record that an assessor can trace back to the load data and the chosen response from the previous step.
Define procedures and responsible roles
Write the procedures that run when primary power is lost. They should state who detects the loss, who decides between shutdown and transfer to alternate power, the order of shutdown steps, who monitors the UPS during the event and how power is restored. Assign named roles and an alternate for each, and align the procedures with the physical and environmental protection policy. The output is an approved procedure document and a roles matrix. Confirm that the people named on it can be reached outside business hours.
Schedule and record UPS tests
Set a test schedule for the UPS and any alternate power supply, covering functional checks, battery condition and transfer behavior. Each test should record the date, the test method, the observed results, any deviations and the corrective actions opened. Keep the test records with the UPS documentation so an assessor can examine them alongside the procedures. The schedule itself is an organizational decision; confirm the frequency with the equipment vendor's guidance and your own risk assessment rather than adopting a figure from this page.
Link outputs to contingency planning
Connect the power decision, the UPS sizing and the test results to the contingency plan under CP-2 and to the alternate processing and recovery arrangements under CP-7. The contingency plan should reference the emergency power procedures, the recovery sequence after power returns and the test outcomes that support it. Where a test found a gap, the contingency plan should reflect the fix or the accepted risk. The output is a cross-reference table that shows each power dependency is covered by a contingency measure.
Train staff and record completion
Deliver training on the emergency power procedures to the people who have roles in them, and cover the related material in the role-based training assigned under AT-3. Record who attended, when, which version of the procedure was used and whether the participants passed any knowledge check the organization uses. Training records are a common assessor request, so keep them alongside the procedures and test records. Done means every named role has a training record that matches the current procedure version.

Evidence that passes PE-11 and how to keep it current

PE-11 is tested through paper and practice: the assessor reads the documents that define emergency power, then checks that the UPS was tested and that the people responsible know their roles. Each card below names one artifact, what the assessor checks, and how the organization keeps it accurate between assessments, with the review dates, test cadence and change triggers set by the organization itself.

Emergency power procedures

These are the written steps that run when primary power is lost, covering who decides between an orderly shutdown and a transition to long-term alternate power, how the UPS hands over load, and who is called. The assessor checks that the procedure addresses emergency power and matches the system as it is actually built, including the components that depend on the UPS. Keep it current by setting a review date in the document control record and by reviewing it after any change to the facility, the load or the power chain. Confirm the review interval with your own policy owner.

UPS documentation

This is the set of records describing the uninterruptible power supply itself: make, model, capacity, runtime at the current load, battery age, and the single-line diagram showing what it feeds. The assessor compares these details with the installed equipment and the stated load. Keep the file current by recording each battery replacement, firmware change and capacity expansion, and by recomputing runtime whenever servers or racks are added. Mismatched documentation is a common reason this evidence fails.

UPS test records

Test records show that the UPS and its supporting mechanisms work when called on. Each entry should state the date, the test type (for example, a load transfer or a controlled shutdown test), the result, the person who performed it, and the corrective action for any failure. The assessor checks that tests happened at the interval the organization defined and that failures were tracked to closure. Set the test cadence in writing, then schedule it in the same system that holds the maintenance log so gaps are visible.

Shutdown or alternate power decision record

This record captures which response the organization selected: an orderly shutdown of the system or a transition to long-term alternate power. It should give the reasons, the runtime that justified the choice, the systems covered, and the approver. The assessor checks that the decision matches the procedures and the UPS documentation. Revisit the record when the load grows, when generator capacity changes, or when the mission requirements for the system change, and record the new decision with its date and approver.

Responsible personnel records

These records name the people accountable for emergency power, their roles, and their contact paths during an outage. The assessor interviews these people to confirm they know the procedure and their part in it. Keep the list current through a review date and by updating it on every staff change, contractor change or reorganization, and check that the on-call and escalation details still work. An outdated roster can fail an interview even when every document is correct.

Training records tied to AT-3

Role-based training under AT-3 should cover the emergency power procedure for each person named as responsible, with completion dates and the training content. The assessor checks that the people in the responsibility roster were trained before they were relied on and that training repeats when the procedure changes. Tie each training session to the procedure version it covered, so a reviewer can see whether staff were trained on the current document. Confirm the training frequency with your own AT-3 owner.

What meeting PE-11 costs in money and effort

This table breaks the cost of meeting PE-11 into its components, showing who is paid, whether each cost is one-time or recurring, and what moves it up or down. Use it to scope a quote, because most of the spend sits in the UPS hardware, battery service and test records rather than in the assessment itself. No price or duration is given here because none was supplied; ask each party for its figure in writing.

Cost component	Who is paid and for what	One-time or recurring	What drives cost up or down
UPS purchase or lease	Equipment vendor or leasing company, for the unit and its installation	One-time (purchase) or recurring (lease)	Load size, runtime needed for orderly shutdown or transition, and redundancy design; a lease spreads cost but adds contract terms to review
Maintenance and battery service	UPS vendor or electrical service provider, for inspections and battery replacement	Recurring	Battery age and chemistry, service level in the contract, and site environment; ask whether battery replacement is included
Engineering time for sizing and documentation	Electrical engineer or implementation partner, for load calculations and the emergency power description	One-time, with updates when load changes	Number of systems on the UPS, changes to rack density, and how current the single-line diagrams are
Test execution and records	Facility staff or service vendor, for scheduled tests and the test logs assessors examine	Recurring	Test frequency set in your own procedures, number of UPS units, and whether tests are scripted and logged automatically
External electrical or testing review	Independent electrical engineer or testing firm, if you choose an outside check	Optional, one-time	Age of the installation, scope of changes, and whether internal staff can perform the review
Auditor sampling time	Independent assessor, for examining procedures, interviewing staff and testing the UPS	Per assessment cycle	Sample size, quality of evidence on first request, and whether the UPS test history is organized before fieldwork begins
Monitoring layer	Software license or self-hosted tooling for alerting on UPS and power metrics	Recurring license or one-time setup for self-hosted tools	Number of data sources and alert rules; self-hosted open-source monitoring can reduce license spend for this layer only, not for the UPS itself

How open-source monitoring can produce PE-11 evidence

Monitoring does not satisfy PE-11 on its own, because the control is about the UPS and the shutdown or transfer behavior it supports. Telemetry from the power path can, however, show that the UPS was online, that outages happened, and that the organization acted on them. The two tools below are commonly used to collect and alert on that data.

Prometheus collects power telemetry

Prometheus pulls metrics over HTTP from jobs it scrapes and stores them as time series identified by metric name and labels. For PE-11, the question is whether an exporter exists for your UPS, power distribution units or building management system. If one does, Prometheus can retain battery charge, input voltage, load and on-battery status as a record over time. Confirm the exporter's coverage for your hardware and whose responsibility it is to maintain it, since a gap in scraping becomes a gap in evidence. Prometheus records what the UPS reports, not whether the UPS works.

Grafana alerts on metrics and logs

Grafana Alerting builds alert rules from queries and expressions across multiple data sources, so a rule can combine power metrics with logs from the facility or the systems the UPS protects. Alerts on loss of primary power, low battery or failed transfer give the operations team a documented trigger for the orderly shutdown or alternate power steps the organization has chosen. Confirm which data sources your facility systems expose and who receives notifications outside business hours.

Single view for alert management

Grafana lets teams create, manage and act on alerts from a single view. For PE-11 evidence, this matters because the record of alerts, acknowledgements and follow-up actions can sit in one place rather than in scattered notes. Assessors typically look for evidence that power events were detected and handled, so ask how alert history is retained, who can change alert rules, and how changes are logged. This is a process decision for your team to define and confirm.

Grafana AGPL-3.0-only license caveat

Grafana is licensed under AGPL-3.0-only, which carries source-availability obligations if you modify the software and make it available to users over a network. Organizations that run Grafana unmodified for internal operations usually have a simpler position, but legal review should confirm how the license applies to your deployment, customizations and any hosted access by third parties. Prometheus is licensed under Apache-2.0, so the two components do not carry the same obligations.

Who does what: your team, a partner and the auditor

Your organization owns PE-11. That means the decision about how the system is protected from loss of primary power, the accountability for the uninterruptible power supply and any alternate power source, and the responsibility for the procedures and test records that show the control works. No partner or auditor can accept that ownership on your behalf. Your facilities, data center or colocation provider, and power engineering staff hold the operational knowledge that the assessment will ask about.

Selecting the response: Decide whether the system performs an orderly shutdown or transitions to long-term alternate power when primary power fails, and document why.
Owning the UPS and generator records: Keep maintenance contracts, battery and generator test logs, and capacity assessments current and retrievable.
Interviewing and approving procedures: Make sure the people responsible for emergency power can explain the procedures in an interview.
Running the tests: Schedule and perform failover or shutdown tests, and record the results, including failures and corrective actions.
Coordinating with third parties: If a colocation provider supplies power, obtain its evidence through contract terms.

Before engaging anyone, confirm that a named owner can produce the procedures, UPS documentation and test records on request.

Where organizations fall short on emergency power

PE-11 is short to state but easy to under-deliver. Most gaps are not missing hardware; they are undocumented decisions, stale test records and disconnected monitoring. The cards below cover the gaps assessors most often find and the specific fix for each.

No recorded shutdown or alternate power choice

PE-11 requires the organization to select whether the UPS supports an orderly shutdown of the system or a transition to long-term alternate power. Many facilities have a UPS but no written decision on which outcome it is meant to deliver. Record the selection in the PE-11 implementation statement, name the system or components it covers, and state the time the UPS must bridge for that outcome. An assessor will ask who made the choice and when it was last reviewed.

UPS test records missing or undated

The assessment procedure for PE-11 expects UPS test records to be examined, so a UPS that is tested but not logged shows no evidence. Keep a dated log for each test with the unit identifier, the test type, the load, the result and the person who signed off. Store the log with the system's other physical protection records. A test that failed and was repaired is still a valid record, and hiding it creates a larger finding later.

Procedures that do not name roles

Emergency power procedures often describe what to do during an outage without saying who does it. Assessors interview the personnel responsible for emergency power and planning, and they expect those people to match the procedure. Name the role that owns the UPS, the role that runs tests, the role that starts a shutdown, and the backup contact for each. Confirm that the named people can explain the procedure in an interview without reading it aloud.

UPS not re-sized for added load

A UPS sized for the original rack layout may not carry the load added since. New servers, storage or network equipment can push the unit past the runtime or capacity it was built for, and the shutdown sequence then fails in practice. Compare current measured load against the UPS rating and runtime at least when equipment changes, and record the result. Ask the facility or electrical contractor to confirm the runtime at the present load, not the nameplate figure.

Alerts without a retained record

UPS monitoring that sends an alarm to a phone or an inbox leaves no durable record of battery state, load or events. Route UPS telemetry such as input status, battery state and runtime into a monitoring stack that stores time series, so the organization can show the state of power over time. Grafana Alerting can build rules across data sources and keep alert history, and Prometheus can store metrics locally. Confirm the UPS network card or agent exposes the values you need before you rely on them.

No link to contingency plans

PE-11 sits alongside CP-2 contingency planning and CP-7 alternate processing, so an outage that triggers a shutdown or a transition should appear in those plans too. Where the UPS supports only an orderly shutdown, the contingency plan must describe how the system returns after restoration. Cross-reference PE-11 in the contingency plan and confirm that the shutdown or transition steps match what the UPS can actually support.

Questions buyers ask about meeting PE-11

How much does it cost to meet PE-11 Emergency power?

No supplied fact gives a price for PE-11, and the cost depends on the written scope. The largest cost component is usually the uninterruptible power supply and its installation, which the organization buys or leases, and the cost depends on the size of the load it must carry and how long it must hold power. Recurring costs include battery replacement, maintenance contracts, and periodic UPS testing. Ask any provider for a quote that separates one-time hardware and installation from recurring testing, monitoring and evidence collection, and that states which items the organization already owns. DeployOpen does not publish a price list; a quote follows from the written scope.

How long does it take to implement PE-11 for a data center?

Duration depends on the written scope, the state of the existing power infrastructure, and whether the organization must procure new equipment. Work that only documents and tests an existing UPS takes far less time than specifying, purchasing and installing a new one, and the choice between an orderly shutdown and a transition to long-term alternate power affects the design. Procurement lead times for power equipment are often the longest item, so confirm delivery dates with vendors early. DeployOpen agrees timelines in writing before work starts, so ask for a scope-based schedule rather than a generic estimate.

What does PE-11 require from our facilities and IT teams?

Facilities teams own the physical power chain: the UPS, its batteries, the connection to primary power, and any generator or alternate source. IT teams own the mapping of which systems sit on the UPS, the shutdown sequence or the alternate power transition, and the test records. Both teams must agree on what the system does when primary power is lost and who makes that decision. Expect to provide equipment documentation, current single-line diagrams, load figures and maintenance records. Confirm these inputs during scoping so that gaps are found before the assessment.

Can we meet PE-11 in-house without an outside partner?

Yes, an organization can meet PE-11 with its own staff if it has the facilities expertise to specify, test and document the UPS and the team to maintain the evidence. The control is owned by the organization, and NIST does not require a particular provider. An outside partner is usually useful for preparing systems, drafting procedures, collecting test records, or running a readiness review against the assessment procedure. Only an independent assessor can issue an assessment result, so plan for that step regardless of who does the preparation.

Will an assessor accept Prometheus or Grafana output as evidence for PE-11?

Possibly, but the assessor decides, and you should confirm this before relying on it. SP 800-53A asks an assessor to examine UPS documentation and test records, interview responsible personnel, and test the UPS and its supporting mechanisms. Prometheus collects metrics from instrumented jobs and stores them as time series, and Grafana Alerting builds alert rules from queries across data sources, so either can show UPS status, battery metrics and alert history if the UPS or its monitoring agent exposes those signals. Metrics alone rarely show that a load test or a shutdown test happened, so keep signed test reports alongside the dashboards. Confirm with the assessor which records they will accept.

Does PE-11 apply to systems in the low baseline?

No. SP 800-53B allocates PE-11 to the moderate and high baselines only, not the low baseline, and it is not part of the privacy baseline. Systems categorized as low impact do not need PE-11 under the baseline, although the organization may still choose to protect them with an uninterruptible power supply as a risk decision. Moderate and high systems do need it, and the high baseline adds the enhancement PE-11(1) for an alternate power supply. Confirm the system's impact categorization before scoping this control.

What evidence should we prepare before an assessment of PE-11?

Prepare the documents that SP 800-53A names for examination: the procedures addressing emergency power, the UPS documentation, and the UPS test records. Add evidence of who is responsible for emergency power and planning, because assessors interview those people. For high-baseline systems, document the alternate power supply and its testing as well. Keep records current and tied to the specific system, since a generic facility statement rarely satisfies an examination. A short readiness review against the assessment procedure often finds missing records before the assessor does.

How DeployOpen scopes and prepares PE-11 evidence

DeployOpen works on PE-11 Emergency power as an implementation partner. We help the organization scope the systems that need an uninterruptible power supply, prepare the power documentation and test records an assessor will examine, and hand over the evidence. The organization keeps ownership of the control, and an independent assessor reaches the conclusion.

How we scope

We agree in writing which systems, rooms and power paths fall under PE-11 for your impact level.
We confirm whether the moderate or high baseline applies, and whether PE-11(1) alternate power is in scope.
We record whether your system shuts down in an orderly way or moves to long-term alternate power.

How we build

We help configure the uninterruptible power supply monitoring and alerting so power loss events are captured and reviewed.
We set up self-hosted dashboards and alert rules, for example in Grafana, that record UPS status and power events.
We document the shutdown or transfer procedure so it can be exercised and checked against the scope you agreed.

How we hand over

We deliver the UPS documentation, procedures and test record templates that an assessor will examine.
We produce a mapping from each assessment object for PE-11 to the artifact or system that supports it.
We document open items and the owner who must confirm vendor-specific UPS capabilities in your environment.

How we support

Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
Ongoing support, upgrades and continuous testing of the power monitoring are available as a retainer.
We help your team rerun UPS test records after changes so the evidence stays current between assessments.