PE-16 Delivery and removal: requirements and evidence

What PE-16 delivery and removal asks for and why it is hard to prove

PE-16 Delivery and removal asks the organization to authorize and control the defined types of system components that enter and leave the facility housing the system, and to keep records of them. In practice, an assessor will want to see that a server, drive, switch or laptop arriving at a loading dock was expected and approved, and that one leaving the building (for repair, disposal or relocation) was signed out and traceable. The risk is concrete: a drive with unencrypted data walking out in a returned shipment, or unvetted hardware arriving and being racked without anyone knowing where it came from. The control is allocated to the low, moderate and high SP 800-53B baselines, but not to the privacy baseline. The organization owns the control and must run it every day. An independent assessor then tests it against the SP 800-53A procedures, so the organization has to be able to demonstrate the control, not just describe it.

It is hard to prove because the movement often happens outside the places where IT records are kept. Receiving docks, loading areas and third-party carriers sit with facilities or logistics staff, and a courier handing over a crate may never touch a change ticket or an asset register. Items can also move under other controls, such as maintenance returns, vendor warranty swaps or equipment loaned to a project, so the paper trail is scattered. Before an assessment, confirm who signs for deliveries, which component types are in the defined scope, whether removals for repair or disposal create a record, and how those records are linked to the asset inventory. Ask your assessor which examples they will sample, because the proof is usually a set of matched delivery, removal and inventory entries rather than a policy document.

A workable approach is to decide the defined component types first, then make every crossing of the facility boundary generate one record that a receiving or shipping person completes and an IT owner approves. Those records should match the component inventory so an assessor can pick a serial number and trace it from delivery to rack to removal. Open-source inventory tools can hold that link. GLPI's Assets module tracks computers, network equipment and racks, and Wazuh's Syscollector collects hardware and installed-software data from endpoints, which can help show that a component reported by the system matches a logged delivery. Neither tool performs the physical control itself, so confirm with your own environment and assessor how the gate, the sign-off and the tool-based record fit together.

Which systems, locations and parties fall under PE-16

PE-16 applies to the system components a defined set of items that enter or leave the facility, so scope starts with which facilities house the system and which item types the organization has defined. The cards below cover the decisions that change the work and the related controls where delivery, removal and supplier records connect to PE-16.

Facilities that house the system

Start with every location where system components are installed or stored, including primary data centers, server rooms, network closets and spare or staging rooms. PE-16 applies to the facility housing the system, so each site needs its own answer about who authorizes deliveries and removals. Confirm with the system owner which sites are in the authorization boundary. Sites outside the boundary may still matter if components move through them on the way in.

Defined component types

The organization defines which item types count as system components for PE-16. A typical definition covers servers, storage arrays, network equipment, laptops and removable media, but the list should match the authorization boundary and the data the system handles. Write the list down, because an assessor will compare delivery records against it. Removable media is often missed, so confirm whether it is in or out of scope and how it is tracked.

Loading docks and receiving areas

Loading docks are where most components first enter a facility, often before anyone with system knowledge sees them. Scope questions include whether the dock is shared with other tenants, whether deliveries are staged there before being moved, and who signs for and inspects items. Confirm with the facility operator whether dock access is restricted and whether receiving staff can record items against the defined list.

Colocation and cloud-hosted facilities

When components sit in a colocation site or a cloud provider's facility, the organization may not control the dock or the removal process. Confirm which party performs receiving, who keeps the delivery and removal records, and how the provider reports them to the customer. Contract terms and the provider's shared responsibility documentation should state these duties. Where the organization relies on the provider, document the inheritance and the evidence it will request.

Contracted carriers and suppliers

Carriers and equipment suppliers move components before they reach the facility, and sometimes return them for repair. Related controls CM-8 (component inventory), MA-2 (controlled maintenance), MA-3 (maintenance tools) and SR-2 (supply chain risk management plan) cover records, removals and supplier duties. SR-3, SR-4 and SR-6 cover supply chain controls, provenance and supplier assessment. Confirm which carrier and supplier duties must appear in contracts and which records the organization will request from them.

Maintenance and media handling links

Components removed for maintenance or repair must follow PE-16 controls and the related maintenance and media rules. CM-3 (configuration change control) and MP-5 (media transport) affect how removals are approved and recorded, and PE-20 (asset monitoring and tracking) can supply location data for defined assets. Confirm with the system owner which removals require a ticket, who approves them, and whether asset tracking tools are expected to show movement history.

How an assessor tests PE-16 and what they ask to see

This table maps each of the five SP 800-53A determination statements for PE-16 to the assessment methods used, the evidence an assessor typically requests and the findings that come up most often. Read it as a preparation checklist: each row names what the organization must be able to show before the assessor arrives at the loading dock or the facility door.

Determination statement	Assessment methods and objects	Typical evidence requested	Common findings
Defined types of system components entering and exiting the facility are identified	Examine the procedures addressing delivery and removal of system components from the facility and the facility housing the system	Written list of component types in scope, delivery and removal procedure, facility diagram showing receiving areas	Component types are undefined or the list omits laptops, storage devices and spare parts
Entry of defined component types is authorized	Interview personnel responsible for controlling system components entering and exiting the facility; examine authorization records	Approved delivery requests, purchase order links, named approvers and the approval workflow	Items arrive with no authorization record, or approval is given verbally and never documented
Exit of defined component types is authorized	Interview personnel who release equipment for repair, return, disposal or relocation; examine removal authorizations	Removal tickets or gate passes signed before equipment leaves, with the approver named	Equipment leaves for vendor repair on a courier's word with no signed removal record
Entering and exiting components are monitored and controlled	Test the organizational process for authorizing, monitoring and controlling items entering and exiting; observe the receiving area during a walkthrough	Receiving logs, sign-in and sign-out records, delivery area access logs and evidence of inspection at intake	Procedures exist but are not followed at the dock, or receiving staff bypass the log during peak delivery periods
Records of entering and exiting components are kept and match the asset inventory	Examine records of delivered and removed components and compare them with the asset inventory and configuration records	Reconciled records showing serial numbers, asset tags, dates and the inventory entry for each item	Records do not match the asset inventory, so assets appear in the inventory with no delivery record or vanish without a removal entry

How to implement PE-16 in a sequence that produces evidence

This sequence turns PE-16 from a policy statement into a chain of records an assessor can sample: defined component types, named approvers, delivery and removal requests, logged receipts and removals in a controlled area, reconciliation against inventory, and periodic exception review. The organization sets the defined types and review frequencies; the framework only requires that they exist and are followed.

Define the component types that need authorization
Start by listing the system components that must be authorized before they enter or leave the facility. Typical examples include servers, storage arrays, network equipment, laptops used for administration, and removable media that holds system data. Record the types as defined parameters in the PE-16 procedure, because the control expects the organization to name them. The output is a short, approved list of component types, owned by the facility or security owner and signed off by the system owner. An assessor will compare this list against what actually moves through the delivery area, so keep it specific enough to test.
Name the roles that approve movement
Assign which roles may approve a component entering or leaving the facility, and who may approve exceptions. Separate the requester from the approver where your staffing allows it, and write down the alternates for absences. The output is a written approval matrix that links each component type to an approving role. Interviews under the assessment procedures commonly ask personnel who controls entry and exit of components, so the people named in the matrix should be able to describe their duties in their own words.
Open a delivery and removal request for each movement
Require a request record before any defined component is delivered to or removed from the facility. The record should capture the component identifier or serial number, type, origin or destination, reason, requester, approver, and planned date. Use a ticketing system, the asset management platform or a controlled form, whichever your organization already runs. The output is an approved request for each movement, which becomes the first sampleable artifact. Requests that arrive without an approval should be rejected or flagged rather than processed.
Route receipts and removals through a restricted area
Direct deliveries and outbound removals through a restricted or isolated delivery area where staff can check items against the approved request before they reach the rest of the facility. Log the arrival or departure time, the person handling the item, the condition on receipt, and any discrepancy. Keep the log in a tamper-resistant form, such as a controlled register or a system with access restrictions and audit logging. The output is a dated movement log tied to each request. Confirm with your facility team how the isolated area is physically separated and monitored, because that layout is part of what the assessor will examine.
Reconcile movement logs against the asset inventory
After each receipt or removal, update the asset inventory so that the component's location and status match the log. Compare the two sources on a defined schedule to find components that arrived without a record, left without approval, or are missing from the inventory. The GLPI Assets module can hold computers, network equipment, peripherals and racks, and a Wazuh Syscollector deployment can report hardware and endpoint details from the systems themselves, which helps confirm that a component seen on the network is one the organization has recorded. The output is a signed reconciliation record showing matched items and open differences.
Investigate and close exceptions
Each unmatched item, unapproved movement or log gap becomes an exception with an owner, a root cause, and a resolution. Escalate exceptions that may involve loss of system data or unauthorized removal to the incident response process. Record the closure decision and who approved it. The output is an exception register that shows how discrepancies were handled, which is often the most informative artifact for an assessor because it shows the control working when something goes wrong.
Review exceptions and procedures on a defined cycle
Set a review cycle for the exception register, the approval matrix, and the list of component types, and record who performed each review and what changed. The organization defines the frequency and should confirm it against its own policy and any contractual or regulatory requirement that applies. The output is dated review minutes or sign-offs that show the control is maintained over time. Assessors typically ask to see several review cycles, so start the record on the day the procedure is adopted.

Which evidence passes a PE-16 test and how to keep it current

An assessor testing PE-16 looks for a written procedure, authorizations for individual movements, and records that show the procedure was followed. No single artifact carries the control, so the cards below describe how each record connects to the others and what to check between assessments.

Written delivery and removal procedure

This document defines which system component types must be authorized before they enter or leave the facility, who approves each movement, where deliveries are received, and how removals are logged. Assessors examine it against the defined component types and the facility housing the system. Review it on the organization's own schedule, and confirm that the receiving, staging and removal steps match what staff actually do at the dock or loading area. A procedure that describes a process nobody follows fails the examine step even when the paperwork is complete.

Authorization records for each movement

Each movement of a defined component should trace back to a recorded approval by someone with the authority to grant it. Keep the approval attached to the request, with the requester, the component, the destination and the approver's name and date. Between audits, sample a handful of recent movements and confirm that each one has an approval that predates the physical movement. Gaps usually appear for emergency swaps and vendor returns, so check those categories first.

Delivery and removal log

The log records the date, component identifiers such as asset tags or serial numbers, the direction of movement, and the responsible persons on both sides. A log is only as useful as its consistency, so confirm that identifiers match the asset inventory and that entries are not left blank or filled in after the fact. Review the log on a fixed cadence and reconcile any entry that lacks a serial number or a named handler before the assessor selects it.

Sign-out, receipt or ticket records

Sign-out forms, receiving slips or system-generated service tickets show custody passing from one party to another. Whether they are paper or digital, they should be sequentially numbered or otherwise traceable to a single movement. Check that receipts are countersigned and that tickets close only after the component reaches its recorded destination. Retain these records for the period your own policy defines and confirm that retrieval works in practice.

Inventory reconciliations

Reconciling the movement log against the asset inventory shows whether every component that entered is accounted for and every removal is recorded as an exit. Discrepancies, such as a server that appears in inventory but never in the log, are the findings most likely to draw assessor attention. Open-source asset management and discovery tools can supply the inventory side of this comparison, and the reconciliation itself should be dated, signed off and kept with the exception records.

Reviewed exception records

Unplanned movements, such as an urgent hardware replacement after a failure, will happen. Record each exception with its justification, the approver who accepted it after the fact, and a follow-up showing the record was completed. Review exceptions periodically to spot patterns that suggest the standard process does not fit real operations. Assessors often ask how exceptions are reviewed, so a closed-out exception log is strong evidence that the control operates as designed.

What meeting PE-16 costs in money and effort

This table breaks down the cost components of meeting PE-16 Delivery and removal, showing who is paid for each, whether it is one-time or recurring, and what moves it up or down. Use it to structure a written quote and to see where open-source asset records can reduce license spend, while noting that no fixed figures are supplied here.

Cost component	One-time or recurring	What drives it, and how to keep it down
Tooling and licenses for asset records	Recurring (license or subscription) if commercial; one-time setup for self-hosted	Number of assets and sites tracked. Self-hosted GLPI (GPL-3.0-or-later) and Wazuh (GPL-2.0-only) remove license spend for the records, but confirm hosting, backup and support costs in the quote.
Process design by engineering and facilities staff	One-time, with periodic review	Number of facility types, delivery docks and carriers. Keep the scope to the defined component types PE-16 names, and reuse the existing change and asset processes.
Delivery area setup and logging	One-time build, recurring operation	Physical size of the receiving area, whether it is isolated from secure space, and how many shipments arrive weekly. Ask the quote to separate construction or fit-out from the logging workflow.
Recurring evidence upkeep and log reviews	Recurring	Volume of moves in and out and the number of sites. Automated inventory from agents reduces manual entry, but staff still review exceptions and retain records.
Carrier and vendor arrangements	Recurring, set by contract	Number of carriers, courier contracts and whether they accept signed chain-of-custody terms. Ask for these terms in writing before work starts.
External review or testing	Periodic, optional	Scope of the independent review and whether it covers the delivery area walkthrough. An independent assessor or auditor issues any report; an implementation partner only prepares the records.
Assessor sampling and evidence requests	Recurring at each assessment cycle	Number of sampled shipments and the depth of records requested. Keep records consistent and retrievable so sampling takes less staff time.

Open-source tools that keep PE-16 records current

PE-16 depends on a current record of which system components enter and leave the facility. The two tools below can hold that record and reconcile it against what is actually connected, but they do not control the delivery area, the people or the doors. Use them as evidence sources under a documented process owned by the organization.

GLPI asset movement records

GLPI's Assets module tracks computers, monitors, software, network equipment, peripherals, printers, phones and racks. Items can be entered manually or pushed automatically by the GLPI Agent through the native inventory built into GLPI since version 10. For PE-16, the useful pattern is one asset identifier per component, with its status, location and assignment updated at receipt, at installation and at removal, so each movement can be traced to a record. Confirm in the GLPI documentation which history and log entries the Assets module keeps, and whether the GPL-3.0-or-later license terms fit your distribution plans.

Wazuh endpoint reconciliation

Wazuh's Syscollector module collects hardware, operating system, installed software, network interfaces and other details from each endpoint and stores them in the Wazuh indexer, where the dashboard shows inventory views and reports. For PE-16, compare the endpoints reporting to the manager against the removal and delivery records in your asset register. An endpoint that still reports after a recorded removal, or a new endpoint that appears with no receipt record, is a finding to investigate. Confirm the collection frequency and the fields available in your Wazuh version, and check the GPL-2.0-only license terms before you build reporting on it.

Who owns the control, who builds the evidence and who tests it

Your organization owns PE-16. Authorization decisions, the delivery area, the movement logs and the people who sign for equipment all sit inside your facilities and your accountability. No partner or assessor can take over these duties, because the control only means something if staff actually follow it every day.

Authorization decisions: Named staff approve which types of system components may enter or leave the facility, and they approve individual movements against the defined rules.
Delivery area operation: Staff run the receiving and shipping area, including who may access it and how inbound and outbound items are held before they reach the secure space.
Movement logging: Staff record each component that arrives, leaves or is moved, with the date, the item identifier, the sender or recipient and the approver.
Reconciliation: Staff compare logs against the asset inventory and investigate items that appear in one record but not the other.
Ownership of policy: Leadership approves the procedure and assigns someone to review it on a defined cycle.

Check that each of these duties has a named owner, a backup, and a record that shows it was performed in practice rather than only written down.

Where PE-16 programs usually fall short and how to close the gap

PE-16 programs rarely fail on the policy itself. They fail where delivery and removal happen in practice: the loading dock, the carrier's clipboard, the repair vendor's pickup and the inventory spreadsheet nobody reconciles. The cards below describe what an assessor is likely to find in each case and what to change before the assessment.

Delivery areas left open

Loading docks and receiving bays often sit in shared corridors with no separation from the rest of the building. An assessor testing PE-16 will ask whether incoming components are handled in a restricted, isolated area before anyone moves them into the facility. Check who can enter the receiving space, whether staff can walk through it unescorted, and whether components wait there in an untracked state. Designate a controlled receiving area, limit access to named roles, and keep incoming equipment there until it is logged.

Carrier drop-offs without receipts

When a courier leaves servers or network gear at the door and a receptionist signs for a box, there is no record of what arrived, from whom, or when. PE-16 expects the organization to authorize and control components entering the facility and to keep records of them. Require a receiving form or ticket for every delivery, list serial numbers against the purchase order, and have the person who signs confirm the count. Ask suppliers for packing lists that match your order.

Repair and disposal removals outside the log

Drives pulled for warranty replacement, laptops sent to a repair vendor and hardware leaving for destruction often walk out through a side door on a verbal approval. Assessors look for the same authorization and record for exits as for entries, including the destination and the person removing the item. Route every removal through a single exit request that names the component, the reason, the recipient and the expected return or destruction date. Tie that request to the media sanitization process where data-bearing devices are involved.

Logs that disagree with the inventory

A receiving log that shows 40 devices and an asset inventory that shows 37 will fail a test of PE-16 records. Assessors compare entries and exits against the inventory and ask how discrepancies were found and resolved. Use one inventory as the system of record, with a receiving step that creates or updates the asset entry. The GLPI Assets module can hold computers, network equipment and racks, and the GLPI Agent can push inventory automatically, which helps confirm that a device recorded at the dock is the one that later appears on the network. Wazuh Syscollector can also show which hosts are reporting, so an unexpected device or a missing one stands out.

Procedures that name roles nobody holds

A procedure that assigns delivery approval to the facilities manager, when that post is vacant or the holder has never seen the document, is a finding waiting to happen. Assessors interview the people named in the procedure and check whether they understand their responsibilities for controlling items entering and leaving. Name roles, not individuals, and keep a current list of the people who hold them. Confirm each role holder knows the approval steps and where the records are kept, and update the procedure whenever staffing changes.

Exception reviews that never happen

Emergency deliveries, after-hours removals and items released without a ticket are common, and most programs record them without reviewing them. PE-16 assessments test whether the organization monitors authorized movements and follows up on exceptions. Set a recurring review of exceptions by someone outside the receiving team, record the outcome, and open a corrective action when a movement lacked authorization. Keep the review record as evidence, since a review that exists only in memory cannot be shown to an assessor.

PE-16 questions buyers ask before bringing in help

How much effort does PE-16 take to implement?

The effort depends on how many doors, loading areas and handoff points your system components pass through, and on how many kinds of components PE-16 covers under your own definition. The control asks you to authorize and control defined types of system components entering and leaving the facility and to keep records of them. The work splits into a one-time part (defining the component types, writing the procedure, setting up the log and training receiving staff) and a recurring part (logging each movement, reviewing the records and handling exceptions). Ask any partner to break its quote into those two parts, and to state which facility areas and asset classes the written scope includes.

Can a small team handle PE-16 without outside help?

Yes, a small team can often run PE-16 internally if the facility is small and the set of covered components is limited. The harder part is consistency: receiving, shipping and facilities staff must all know that a rack, server, laptop or storage device needs an entry in the record before it moves. If the team already runs an asset register and a change process, PE-16 mostly adds a physical movement step to those routines. Bring in outside help when the team cannot staff the recurring log, when several sites or third-party carriers are involved, or when the first assessment is approaching and nobody has tested the process end to end.

What does PE-16 need from facilities and IT staff?

PE-16 needs agreement between two groups that often work separately. Facilities and receiving staff must control the loading and delivery areas, check incoming and outgoing items against the authorized list, and stop unrecorded movements. IT staff must supply the list of component types, tie each entry to an asset identifier, and confirm when equipment is disposed of or returned. Typical inputs include:

A defined list of component types that must be logged
Named owners for the delivery area and for the record
A way to match each movement to an asset record, such as an inventory tool
Procedures for vendors, repair returns and removals

Ask the partner which of these it will prepare and which your staff must sign off.

How long does PE-16 take to put in place?

The framework does not set a duration for PE-16, and NIST does not set federal implementation timelines in its own guidance, leaving that to OMB Circular A-130 and to each agency. Scope drives the timing: the number of facilities, the variety of components, whether a delivery area must be redesigned, and how much existing asset tracking can be reused. Ask for a written schedule that lists each deliverable (procedure, record format, staff briefing, test of the log) with its dependency on your input. A fixed-scope agreement sets those dates in writing before work starts.

Can an implementation partner run the PE-16 record for us?

An implementation partner can design the record, configure the tools that hold it and prepare the procedures and evidence, but your organization still owns the control and the daily entries. DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so an engagement can set up an asset register, such as GLPI with its Assets module, and connect it to inventory collection, such as Wazuh Syscollector, so that hardware records are populated and kept current. Those tools help with records, but a person must still log physical movements at the delivery area unless your process is designed around automated checks. Confirm in the written scope who performs each recurring task after handover.

What will an auditor check for PE-16, and what won't they do for us?

An assessor follows the assessment procedures in SP 800-53A for PE-16. These call for examining the procedures on delivery and removal and the facility, interviewing the staff who control items entering and leaving, and testing whether the process for authorizing, monitoring and controlling those items works in practice. Expect to show the procedure, a sample of recorded movements, and how gaps are followed up. An assessor does not build the process, write the record for you or make the control work. Only an independent assessor or auditor issues an assessment report or certification, and DeployOpen prepares systems, controls and evidence for that assessment but does not issue reports.

What should a quote for PE-16 include?

A quote should follow from written scope and list the work in the same parts as the control itself. Ask for the facilities covered, the component types in the record, the deliverables (procedure, record design, tooling configuration, staff briefing, test run and evidence pack), the assumptions about your staff's time, and what happens after handover. Separate one-time setup from any recurring support or retainer, and ask what is excluded, such as building changes to a loading area. DeployOpen does not publish a price list, and a quote follows from that written scope.

How DeployOpen scopes and prepares PE-16 evidence

DeployOpen works on PE-16 Delivery and removal as a scoped piece of work inside the client's own facilities and systems. We prepare the records, asset tracking and documentation that an independent assessor will examine, while the organization keeps ownership of its delivery and removal decisions.

How we scope

Agree in writing which system component types the delivery and removal control covers, such as servers, storage, laptops and network gear.
Confirm which facilities, loading areas and receiving points are in scope for authorization and recording.
Identify the people, tools and existing procedures the written scope depends on, and list what the client must provide.

How we build

Configure an asset register in self-hosted GLPI so that incoming and outgoing components are recorded with status and location.
Deploy the Wazuh agent to collect hardware and software inventory from endpoints, so records can be checked against what is on the network.
Draft delivery and removal procedures with the client, then test the authorization and logging steps against a sample of real movements.

How we hand over

Deliver the asset records, inventory exports and configuration notes in a format the client's assessor can examine.
Document how each procedure maps to the assessment objectives in SP 800-53A for PE-16, so interviews and tests have a clear trail.
Provide a short runbook that explains who authorizes a movement, who logs it and how exceptions are reviewed.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work is complete.
Support can cover keeping inventory records current as the facility and its components change over time.
Ask any implementation partner to confirm which assessment decisions remain with the organization and its independent assessor.