PE-15 Water damage protection: requirements and evidence

What PE-15 water damage protection requires in practice

When an assessor or customer asks for PE-15 evidence, they want proof that the system is protected from water leakage damage by master shutoff or isolation valves that are accessible, work properly and are known to the people who would need them in an incident. In plain terms, someone must be able to reach the valve, it must actually close, and the right staff must know where it is and how to operate it. The control is allocated to the low, moderate and high baselines in SP 800-53B and is not part of the privacy baseline. At the high baseline, an enhancement adds automated detection of water leakage, which is covered later on this page.

This control is hard to evidence for three reasons. The valves are physical objects in a building, so the evidence is a walkthrough, a photo or a labeled location rather than a log entry. Valves are rarely operated, so there may be no recent test record unless someone has scheduled one. Ownership often sits with facilities or building management rather than IT, which means the system owner may not hold the documents, drawings or maintenance contracts that show the valves work. Assessors use the SP 800-53A procedures to examine the water damage procedures and facility records, interview the personnel responsible for environmental controls, and test the master water-shutoff valves themselves.

A practical first step is to ask the facility owner for the valve locations on a current drawing, the date of the last operational test, and the named people who can close the valves after hours. Confirm these details with the facility team and the data center operator before you describe them in a system security plan, because the answers depend on your own building and are not a property of the control. If the system runs in a leased or shared facility, check which party is responsible for the valves in the contract. The NIST CPRT entry for PE-15 gives the control text, and the assessment objects in SP 800-53A show which records to prepare.

Which facilities, systems and teams PE-15 covers

PE-15 applies to the facility where the system actually sits, so scoping starts with the building, not the rack. The cards below separate what the organization controls from what a landlord, colocation operator or cloud provider controls, and show how that split changes the evidence an assessor will ask for.

The facility housing the system

Start by identifying every room where system components reside, including data halls, server rooms, network closets and telecom rooms. For each one, trace the water path: overhead sprinkler and chilled water pipes, roof drains, plumbing risers and condensate lines from cooling units. A server room on an upper floor can be exposed to a leak from a unit two floors above, so the facility boundary for PE-15 is the water path, not only the room door. Record these paths in a facility diagram that assessors can compare against the shutoff valve inventory.

Shared buildings and water paths

In a multi-tenant or shared building, water may enter the room from systems the organization does not operate, such as floor plumbing serving other tenants or a building-wide chilled water loop. Confirm in writing which party owns each water line, which party owns the isolation valves on it, and how a leak is escalated. Where the organization cannot control the valve, document the building's shutoff location, the contact who can close it, and the response time the lease or service agreement promises.

Leased space and colocation

In leased space and colocation, the operator usually owns the master shutoff valves and the building management system. The organization still needs evidence that the valves are accessible to its personnel, work properly and are known to key staff. Ask the operator for its valve test records, its written emergency procedure and the process for notifying tenants during a leak. Confirm whether the contract gives the organization a right to inspect the facility or receive its assessment report.

Cloud components and provider-owned valves

Where a component runs in a cloud region, the provider owns the data center and its water systems. The organization does not own PE-15 evidence for that facility, but it does own the decision to rely on it. Review the provider's assessment package and how it maps to PE-15, and record which controls are inherited, shared or retained locally. Cloud-hosted components that the organization operates through its own hardware, such as on-premises edge nodes, stay fully in its own scope.

How inheritance changes your evidence

When a provider's assessment covers the facility, the organization can usually inherit that part of PE-15 and document it as a common control rather than repeating the test. The inheritance must be stated in the system security and privacy plan, with the provider's report, its date and its scope. Any gap the provider does not cover, such as a local closet with its own plumbing, still needs the organization's own evidence. Confirm with the provider and your assessor how far the inherited scope extends.

Facilities, building management and key personnel

Three parties must be named in PE-15 scope: the facilities team or building management that operates the valves, the on-site or on-call personnel who must find and close them, and the system owners who need to know the valve locations during an event. Assign a named owner for each facility, record the valve locations and access method, and confirm that key personnel have walked the route. Interviews under the assessment procedure often test whether these people can describe the valve location without looking it up.

How an assessor tests PE-15 under SP 800-53A

An assessor testing PE-15 works through four determination statements in *SP 800-53A Rev. 5*, the companion publication that gives an assessment procedure for each control. The procedure combines three methods: examine, interview and test. Each determination statement asks whether the organization has done something specific, so the assessor collects evidence for each one separately. The publication lists potential assessment objects for each method, and those objects are suggestions rather than a fixed checklist. The assessor decides how deep to go based on the system, its environment and the risk. The NIST CPRT entry for PE-15 shows the control text alongside its assessment reference.

For the examine method, the suggested objects are the procedures that address water damage protection, the facility that houses the system and the master shutoff valves themselves. The assessor will read the procedures to confirm they name the valves, explain how personnel reach them and say who is responsible for keeping them working. They will then walk the facility to confirm the documented locations match the real ones. For the interview method, the assessor speaks with personnel who hold responsibility for environmental controls, such as facilities staff, data center operators or building managers. The questions are practical: where is the valve, who closes it, when was it last used and what happens after a leak is found. Answers that differ from the written procedure are a common finding.

For the test method, the assessor asks that the master water-shutoff valves be operated or inspected to confirm they work properly and are accessible. Before the test, confirm with the facility owner who may authorize operating a valve in a live data center, and schedule the test so it does not disrupt service. Ask for the last inspection or maintenance record, the valve's location relative to the room, and any obstruction or labeling problems. Owners often need to confirm this evidence before the assessment starts, because a valve that cannot be found or turned during the test will generate a finding regardless of what the procedures say.

What assessors examine, interview and test for PE-15

This table maps the three SP 800-53A assessment methods for PE-15 to the object each one covers, what the assessor is trying to confirm, the evidence to prepare and the findings that commonly come up. Read each row as a question the assessor will ask, then check whether your facility can answer it with a document, a person and a valve.

Method and object	What the assessor confirms	Evidence to prepare	Common findings
Examine: water damage protection procedures	The documented procedures address water damage protection for the system and name who operates the master shutoff valves.	Written water damage procedure, valve location references, review dates and approval records.	Procedure exists but does not mention master shutoff valves or names no owner.
Examine: facility housing the system and master shutoff valves	The facility layout shows where water enters and where the master shutoff or isolation valves sit relative to the system.	Facility drawings or floor plans marking supply lines and valves, photographs of valve tags, site walk-through notes.	Valve locations missing from drawings or changed by later building work without a document update.
Interview: personnel responsible for environmental controls	Staff with responsibility for environmental controls know the valve locations, the isolation sequence and when to act.	Roster of responsible roles, training or briefing records, notes from a shift walk-through with the assessor.	On-shift staff cannot locate the valves or describe the isolation steps, or the responsible role is vacant.
Test: master water-shutoff valves	The valves are accessible, operate as intended and close the supply to the protected area.	Test records showing date, operator, valve identifier, result and any corrective action, plus photos of clear access.	Valves unlabeled, blocked by stored equipment, never exercised, or found seized when turned.

How to implement PE-15 step by step

This sequence turns PE-15 from a policy statement into a working set of valves, named owners, tested procedures and recorded results that an assessor can examine, interview staff about and test.

Map every water path into the system's space
Start by listing each water source that could reach the system, including domestic supply lines, building cooling loops, fire suppression piping, condensate drains and any sprinkler or roof drainage routed above equipment. Walk the facility housing the system and trace each line back to its origin. The output is a water path register that names each line, its route and the valve intended to isolate it. Confirm the register with facilities staff, because building plans often omit retrofitted lines. The step is done when every line that could reach the room has a documented isolation point or a documented reason it cannot.
Verify valve accessibility and labeling
For each master shutoff or isolation valve in the register, physically confirm it can be reached without moving equipment, opening locked enclosures or relying on a ladder. Check that the valve is tagged with its service, direction and location, and that the tag matches the register. Photograph each valve and its approach path, and record any obstruction. The output is an accessibility and labeling checklist with a corrective action for every gap, such as relocating stored materials or replacing a missing tag. The step closes when each valve has a dated, signed inspection entry.
Write the valve operating procedure and assign an owner
Document how to close each valve, how to confirm it is closed, how to report a leak and who must be notified first. Keep the procedure short enough to use during an incident and reference the valve tags from the register. Name one accountable owner for the procedure, usually a facilities or data center operations role, and a backup. Store the procedure with the other environmental controls documentation for the facility, and align it with the physical and environmental protection policy and procedures. The output is an approved procedure with a named owner, version and review date.
Name and train key personnel
Identify the staff who must be able to operate each valve during an incident, including on-shift operators, facilities responders and system administrators who would decide whether to power down equipment. Provide each person with the procedure and a walkthrough at the valve location, not only a classroom session. Record attendance and the date of each walkthrough, and note any person who cannot reach a valve after hours. The output is a roster of key personnel mapped to valves, with completed training records. An assessor will expect to interview these people, so confirm they can describe the location and procedure in their own words.
Test valves on a defined schedule
Operate each master shutoff or isolation valve under controlled conditions, confirming that it turns fully, seals and that downstream flow stops as expected. Coordinate testing with facilities and the system owner so that no production service is interrupted without approval. Record the valve tag, date, tester, method, observed result and any defect, then open a remediation item for every valve that binds, leaks or fails to seal. The schedule itself should be defined in the procedure and approved by the control owner. The output is a dated test log that shows each valve was exercised and what happened.
Track defects and close remediation
Route every failed inspection or test into the organization's ticketing or plan of action and milestones process so that repairs have an owner, a target and a verification step. Re-test each repaired valve and attach the result to the original finding. Review the open items at the control owner's regular governance meeting so that repeated failures on the same valve trigger a root cause review. The output is a closed loop from observation to repair to retest, which is the evidence most assessors examine first when they look for a control that is maintained rather than installed once.
Decide on automated leak detection
PE-15 has one enhancement, which is automated detection of water leakage and notification of organizational personnel. The high baseline in SP 800-53B adds this enhancement, so confirm with your authorizing official or compliance lead whether your system is categorized as high before treating it as mandatory. If it applies, select leak sensors for the locations identified in the water path register, connect alarms to a monitored channel and test the alarm path end to end. If it does not apply, record the decision and rationale so the omission is documented. The output is either a tested detection and notification design or a signed decision record.

Deciding whether to handle PE-15 in-house or with a partner

When the organization owns or leases the building and runs its own facilities function, most of PE-15 sits with that team. Facilities already knows where water lines run, who maintains the shutoff valves and how isolation is done during a leak. The internal team can own the valve inventory, the schedule for operating and testing the valves, the training for staff who would need to shut water off, and the records that prove each step happened.

Valve location and labeling: Facilities keeps an accurate map of master shutoff and isolation valves for every room that houses system components, with labels that match the map.
Operational checks: The team schedules and records checks that confirm each valve is accessible and turns as expected.
Key personnel knowledge: Facilities briefs the people who would act in an incident, such as on-call IT staff and building operators, on where the valves are.
Leak detection maintenance: If automated detection is in place (an enhancement, not a base requirement), facilities owns its maintenance and alarm routing.
Outsourcing candidates: An outside partner can help package valve survey records and check that the evidence matches what an assessor will examine. The facilities team and the independent assessor still own the physical controls and the test results.

Before relying on this split, confirm which parts of the building the organization actually controls and whether the valve maps are current.

Evidence that passes a PE-15 assessment

An assessor testing PE-15 needs to see that the master shutoff valves exist, work and are known to the people who would use them in a leak. The cards below cover the records and procedures that prove each of those points, and each one needs a refresh cycle the organization sets and keeps.

Valve location drawings and floor plans

Drawings that mark each master shutoff or isolation valve, the water lines it controls and the rooms it protects are the first thing an assessor compares against the facility. Check that the drawings match the building as it is today, including any walls, rooms or pipe runs added since the last revision. Keep a dated revision history and store a copy where responders can reach it during an outage, not only on the system that caused the leak.

Valve inspection and test logs

Each valve needs a dated record showing it was operated and found working. The log should name the valve, the person who checked it, the result and any corrective action, such as a stuck handle or a corroded fitting. Assessors look for entries that follow a defined schedule and for evidence that failures were fixed and retested, not only recorded.

Personnel contact and responsibility lists

A list of the people who must know where the valves are and how to close them, with after-hours phone numbers and backup contacts, shows that the knowledge exists beyond one individual. Compare the list against staff changes, facilities contract changes and building management handoffs at least each time personnel change. An outdated name on a responsibility list is a common finding because it means the people named may not be able to act.

Water damage protection procedure

The written procedure tells staff what to do when water appears near system components: who to call, which valve to close, how to isolate affected equipment and when to move systems to a safe location. It should reference the drawings and contact list by name, so the three documents agree. Review it on the organization's defined cycle and after any incident or facility change, and record the review date and approver.

Training or briefing records

Sign-in sheets, learning records or briefing logs prove that the people named in the procedure received instruction on the valve locations and the shutoff steps. Record the date, the topic and who attended, and note which staff were missed so they can be briefed. Refresh the briefing when the procedure changes, when valves are relocated and when new facilities or support staff start work on site.

Leak detection alarm records

Claim this card only if the organization relies on automated water detection, which is the enhancement to PE-15 in SP 800-53 Rev. 5. Keep alarm configuration records, test results from sensor checks, alert logs showing who was notified and how fast, and records of any leaks detected. Confirm with the facilities team that the alarm reaches a staffed contact at all hours, because an alarm no one receives does not show that protection works.

What meeting PE-15 costs in money and effort

This table breaks the PE-15 effort into cost components, showing who does the work, whether each cost is one-time or recurring, and what pushes it up or down. NIST does not estimate compliance costs, so use the table to shape a quote and questions for your facilities and security teams rather than as a budget.

Cost component	Who is paid or who does the work	One-time or recurring	What drives it up or down
Valve survey and labeling	Facilities staff or the facilities contractor walking the building to find master shutoff and isolation valves serving the system's rooms	One-time, then re-verified after changes	Number of buildings, floors and rooms housing the system; how well existing plans and drawings match the physical layout
Accessibility and working-condition check	Facilities technicians confirming valves can be reached, are not blocked, and operate as intended	Recurring on a schedule the organization sets	Number of valves, access routes through locked or shared spaces, and the age and condition of the valves
Periodic valve testing labor	Facilities technicians or a licensed plumbing or mechanical contractor exercising valves and recording results	Recurring	Test frequency set in the organization's own procedure, valve count, and whether testing requires building-wide water interruption
Procedure writing	Internal facilities or security staff, sometimes with an implementation partner preparing templates	One-time, with periodic review	Complexity of the building water distribution, number of facility owners, and whether procedures already exist for other facilities controls
Training for key personnel	Facilities, operations and on-call staff who must know where valves are and how to close them	Initial training, then recurring for new staff	Staff turnover, number of shifts, and whether training is combined with other emergency drills
Leak detection hardware (if PE-15(1) applies)	Vendor or installer for sensors, plus internal or contracted staff for placement	Hardware one-time; replacement and calibration recurring	Number of sensor locations under the system, sensor type, and whether sensors integrate with existing building monitoring
Monitoring and alert handling (if PE-15(1) applies)	Facilities or security operations staff, or a monitoring service if the organization contracts one	Recurring	Alert routing, after-hours coverage, and how alerts link to incident response procedures
Evidence upkeep	Internal compliance or facilities staff maintaining test logs, valve maps, training records and change records	Recurring	How evidence is stored, whether records are digital, and how often facility changes occur
Assessor time	Independent assessor examining documents, interviewing staff and testing valves	Recurring with each assessment cycle	Scope of facilities in the assessment, readiness of evidence, and the number of staff interviews needed

Where PE-15 programs usually fall short

PE-15 looks simple on paper: shutoff valves that are accessible, work properly and are known to key personnel. In practice, the gaps tend to sit between documents, people and the building itself. The cards below cover the failure points assessors and facility teams see most often, each with a closing action you can check before an assessment.

Valves missing from drawings

Master shutoff and isolation valves often appear on no current drawing, or only on a plumbing contractor's as-built set from years ago. A valve that is not documented cannot be checked, maintained or handed to the person on call. Compare the facility's water drawings against a physical walkdown of the rooms that house the system, and record every valve that controls supply to those rooms, including valves upstream of the building.

Valves never exercised

A valve that has not been turned in years may seize, corrode or leak at the stem, so it fails when it is needed. PE-15 asks that the valves work properly, which means someone has to confirm that they do. Ask facilities for the schedule and records of valve operation, and confirm whether the operating test covers the valve itself or only the room it serves.

Staff who cannot find the valves

PE-15 requires the valves to be known to key personnel, and that knowledge fades with staff turnover and outsourced facility contracts. A data center operator on night shift may be the only person present during a leak. Check that named roles, not individuals, are documented with valve locations, and that the people in those roles have walked to the valves in the last review cycle.

Leak detection without response steps

Sensors under raised floors or near chillers can alert the monitoring desk, but an alarm without a written response does not stop water damage. Confirm that the detection alerts route to a staffed contact, that the response procedure names the valve to close and who may close it, and that the procedure has been tested against a real or simulated alarm. Detection is the enhancement in PE-15, so it should be tied to the shutoff steps.

Colocation evidence that stops at the cage

A colocation provider's report may show that the building has water shutoff valves and leak sensors, but it describes the provider's systems, not the organization's own water paths. Branch lines, in-rack cooling loops or water supplies that the organization installed may fall outside the provider's evidence. Ask the provider which water paths it covers, and document the organization's own valves and sensors separately so the assessor can see both boundaries.

PE-15 questions buyers ask before hiring help

How much effort does PE-15 water damage protection take?

The effort is usually modest in engineering terms but depends on how the facility is built. PE-15 asks for a master shutoff or isolation valve that is accessible, works properly and is known to key personnel. Most of the work is confirming where the valves are, testing that they close, and documenting the result. Effort rises when the room has water lines running from outside the facility, several separate supply branches, or valves that sit above ceilings or behind locked spaces. Ask any partner to break the work into a site walk, valve testing, documentation and staff briefing, and to price each part separately.

Can we meet PE-15 in-house without outside help?

Yes, in many organizations facilities or building management staff can do it, because the control is physical and procedural. The organization owns the control and its evidence in every case. Internal teams usually need to locate the valves, confirm they operate, label them, record the test, and make sure the people who would act during a leak know where they are. Outside help makes most sense when the facility team is small, when the room is shared with a landlord or colocation provider, or when assessors will test the control and the organization wants an independent review of the evidence before the assessment starts.

What does PE-15 require from facilities teams?

Facilities teams carry most of the operational load. They need to know the water supply path into the room, identify the master shutoff or isolation valves, and confirm that each one can be reached without moving equipment or obtaining special access. They also need to test the valves on a schedule the organization defines and keep a record of each test. Useful inputs include:

A drawing or plan that marks the valves and the water lines they control
Access arrangements that let authorized staff operate the valves at any hour
A short procedure telling staff how to shut off water during a leak
Test records that show the date, the valve tested and the result

How does PE-15 relate to PE-10 and AT-3?

PE-15 covers water, PE-10 covers emergency shutoff for power, and AT-3 covers role-based security training. The three are linked because each depends on people knowing what to do during an incident. PE-10 concerns emergency power switches placed where authorized personnel can reach them, so the same facility walk can check both. AT-3 is relevant because staff who would operate water valves or respond to a leak should receive training that covers their role. The catalog lists PE-10 and AT-3 as related controls for PE-15, so assessors may look at them together. Confirm the exact scope of each with the assessment team, since the related controls do not change what PE-15 itself requires.

Is automated water leak detection required for PE-15?

Automated leak detection is not part of the base PE-15 requirement. The base control asks for the shutoff valves. SP 800-53B allocates PE-15 to the low, moderate and high baselines, and the high baseline adds PE-15(1), which is the enhancement for automated detection. If the system is categorized at high impact, plan to include detection sensors, alarm routing and a documented response. At low or moderate impact, detection is still good practice, but the organization should confirm with its assessor whether it is required for its own system. Ask the assessor to state which baseline applies before buying sensors.

How long does PE-15 preparation take?

The schedule depends on the facility, not on the control text. A single room with clearly labeled valves can be documented quickly, while a multi-floor building with shared risers may need coordination with a landlord, a building engineer or a colocation operator before any valve testing can happen. The main variables are how long it takes to get site access, whether valves need repair before they can be tested, and how quickly the organization can schedule tests that do not disrupt operations. No duration is set by NIST for this control. Ask a partner for a timeline tied to a written scope, and confirm access windows with the facility owner before work starts.

What should a written PE-15 scope include?

A written scope should name the facilities and rooms in scope, the systems housed there, and the valves that will be identified and tested. It should say who owns each valve, whether the facility owner or the organization is responsible for testing, and what evidence will be delivered. Ask for the following in writing:

The list of rooms and systems covered, matched to the system boundary
The valve inventory and the test method for each valve
The documents delivered, such as the plan, test records and staff briefing record
Whether automated detection is in scope or left to the organization
Who performs the independent assessment, which DeployOpen does not do, since only an independent assessor issues assessment results

Does DeployOpen certify that our facility meets PE-15?

No. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. The organization owns its controls. An independent assessor tests PE-15 and reports the result. A typical split is that the organization decides the scope and owns the valves, DeployOpen helps document the configuration and collect test evidence, and the assessor examines the procedures, interviews staff and tests the valves. Confirm that the assessor agrees with the evidence plan before work begins, so the same records do not need to be rebuilt later.

Why PE-15 evidence is mostly physical and documented

PE-15 is satisfied by what exists in the facility and what the organization writes down about it, not by software. An assessor testing water damage protection will want to see the master shutoff or isolation valves, the piping and drawings that show where they sit, and proof that they are accessible and work. The Release 5.2.0 assessment procedure for PE-15 points to examining procedures, the facility housing the system and the valves themselves, interviewing personnel who manage environmental controls, and testing the master water-shutoff valves. Most of that evidence is a walk-through, a photograph or tag, a drawing and a signed inspection record, which means the controls are owned by facilities and operations staff even when an implementation partner helps organize the records.

Open-source tooling has a narrow role here. No open-source platform can confirm that a valve turns, is reachable on a given day or is known to the people who would need it during a leak. Those facts come from a person operating the valve and recording the result. Where automated water leak detection is in place, as the PE-15(1) enhancement describes for the high baseline, the detection hardware, its alerting path and the logs it produces are selected and confirmed by the organization. Ask the vendor or facilities team to show which signals are recorded, how long they are retained, and whether alerts reach a staffed contact. Do not assume that an open-source dashboard or monitoring stack is a substitute for those physical checks.

Before an assessment, confirm three things: that a current drawing identifies each master shutoff or isolation valve, that a recurring inspection schedule exists with dated records showing the valve was operated or verified, and that the named key personnel can describe the shutoff procedure without looking it up. Gaps in any of these are usually easier to close with a written procedure and a walk-through than with new technology. Where the high baseline applies, also confirm which detection devices are installed, who receives their alerts and how alert handling is documented. Any sample record set you prepare should be checked against what the independent assessor actually requests, since the assessor, not DeployOpen, decides whether the evidence is sufficient.

How DeployOpen prepares PE-15 evidence

DeployOpen approaches PE-15 as a facility and evidence task that runs alongside the platform work. We plan and document the water shutoff arrangements for the self-hosted systems inside your own data center or facility, and we prepare the records an assessor will ask to see. The organization keeps ownership of its controls, and an independent assessor reaches the conclusions.

How we scope

The written scope names the facility, rooms and systems where PE-15 applies, agreed before work starts.
We confirm with your facilities team which master shutoff or isolation valves serve each room housing the system.
Scope states whether automated water leakage detection under the PE-15(1) enhancement is in or out of the engagement.

How we build

We document the valve locations, access routes and labeling so key personnel can find and operate them.
We help define the water damage procedures that cover the shutoff process, owners and escalation steps.
Where detection is in scope, we configure monitoring for the defined areas and route alerts to named responders.

How we hand over

Deliverables include a valve and facility map, procedure documents and a record of the functional checks performed.
We provide a checklist that maps each PE-15 assessment item to the artifact that shows it, for your assessor.
Handover includes a walkthrough with the personnel named in the procedures, so the knowledge is not held by one person.

How we support

Fixed-scope engagements finish with written deliverables, and any follow-up work is agreed in a new scope.
Ongoing support is available as a retainer for periodic valve checks, procedure reviews and detection tuning.
Confirm with your facilities provider which valve testing and maintenance tasks they perform and how often they record them.