PE-18 Location of system components: requirements and evidence

What PE-18 location of system components asks for and why it is hard to prove

PE-18 Location of system components requires that system components be positioned within the facility so that defined physical and environmental hazards cause minimal damage and so that opportunities for unauthorized access are minimized. In practice, an assessor will ask where the servers, storage, network gear and other components sit inside each building, why those positions were chosen, and whether the organization can show that the decision considered the hazards it has defined. Under the SP 800-53B baselines, PE-18 applies only at the high baseline, so it is typically raised by a contract, an agency or a regulator that has classified a system as high impact rather than by a general audit of physical security.

The control is a single base control. All of its numbered enhancements are withdrawn in SP 800-53 Release 5.2.0, so there is no enhancement to point to and no separate test for each hazard. The assessment procedure in SP 800-53A Rev. 5 is one determination statement, which asks whether component positioning is addressed by procedures, documented in the location and position of components within the facility, understood by the people responsible for it, and carried out through real processes. The reader should confirm the current wording against the NIST CPRT entry for PE-18 before building the evidence set.

The proof is hard because the evidence is scattered. The positioning decision may sit in a data center design document, the location of a rack may appear only in a floor plan, the hazard list may live in the risk assessment, and the reasoning may exist only in the memory of a facilities manager. A useful first step is to inventory which facilities house high-impact components, collect the current floor plans or rack elevations, and confirm that each one matches the live asset inventory. Then ask the people responsible to explain, in their own words, how a new component is placed and which hazards they considered. Gaps found at that stage are cheaper to close before an assessor arrives.

Which systems and facilities PE-18 reaches at the high baseline

PE-18 applies only where a system is categorized at the high baseline, so scoping starts with the impact level of each system and then moves to the buildings that hold it. The cards below follow that chain, from system categorization through facility inventory to providers whose facilities sit outside your control.

Systems categorized high

PE-18 is allocated to the high baseline alone in SP 800-53B, so it reaches only systems whose security categorization is high. Start from the current categorization record for each system, not from memory or from the baseline a system was first assigned. A system that moved to high after a change in mission or data holdings brings PE-18 with it. Confirm that the categorization is documented and approved before you draw the boundary of work.

Facilities that house high systems

Once high systems are identified, list every physical location where their components reside, including server rooms, data halls, network closets and backup sites. The control asks you to position components to limit damage from hazards and unauthorized access, so each location needs a record of what sits there and where. Facilities that hold a high system and also a low system are still in scope for the high components. Incomplete facility lists are the most common reason a scoping exercise misses a room.

Hazards that define the boundary

PE-18 requires positioning that minimizes damage from defined physical and environmental hazards, so the organization must name those hazards first. Typical examples include flooding, fire, seismic activity, water intrusion from overhead piping and proximity to public access points. The hazard list determines which rooms and positions are reviewed and what evidence proves the positioning decision. Ask who approved the hazard definitions and when they were last reviewed.

Facility inventory as the work boundary

A current inventory that maps each high system component to a room, rack or floor position is the practical boundary for PE-18 work. Assessors examine documentation of component location and the locations that house components, so the inventory is both a working tool and the evidence. Check that asset records, rack diagrams and floor plans agree with one another. Gaps between them usually surface during the interview and examine steps.

Colocation and cloud facilities

Where a provider operates the building, the organization still owns how its own components are positioned, but it depends on the provider for the facility itself. Obtain the provider's facility controls, location documentation and any independent assessment reports, then decide which parts the organization can verify directly. Confirm in the contract whether the provider will supply location information for components it hosts. Treat these as shared responsibilities and record the split in the system security plan.

Privacy baseline does not change scope

PE-18 is not part of the privacy control baseline, so a privacy-only designation does not bring it into scope. A system can hold large volumes of personal information and still fall outside PE-18 if it is not categorized high for security. Document this reasoning in the scoping record so reviewers can see why privacy handling did not extend the boundary. If privacy and security impact levels both apply, the security categorization still decides whether PE-18 is required.

How an assessor tests PE-18 against SP 800-53A

An assessor tests PE-18 through a single determination statement in SP 800-53A Rev. 5, and that statement asks whether the organization positions system components within the facility so that exposure to defined physical and environmental hazards is reduced and opportunities for unauthorized access are minimized. Because the control has one determination statement, the assessor's work is a short chain of evidence: a documented process, a record of where each component actually sits, the people who made those placement decisions, and proof that the process is followed in practice. The assessor will not accept a floor plan alone. Confirm the exact wording of the determination statement and its assessment objects in the SP 800-53A Rev. 5 publication before you build your evidence package.

The examine method looks at three kinds of documents. First, procedures that address how components are positioned, which should name the hazards the organization considered, such as water sources, shared walls, exterior glazing, and heat or electrical risks, and the access concerns it considered, such as public corridors or shared tenant space. Second, documentation of the location and position of each component, typically a rack elevation, room layout or asset register that ties each server, storage array or network device to a room and position. Third, descriptions of the locations that house components, including whether each room is a controlled area. Ask whether the rack and room records match what a physical walk-through shows, because a mismatch is the most common reason an examine finding fails.

The interview method asks the people who decide or carry out placement, such as data center managers, facilities staff and the engineers who rack new hardware, how they choose a location and what they check before moving equipment. The test method asks the assessor to observe the positioning process in operation, for example by selecting a recent installation or relocation and tracing it from the placement decision to the updated location record. Plan for this by keeping change tickets, installation sign-offs and a hazard review tied to each move, because the assessor will select samples and ask for them.

PE-18 assessor test approach, evidence requested and common findings

This table sets out how an assessor applies the single PE-18 determination statement through examine, interview and test methods, what each method asks for, the evidence that passes and where findings usually arise. Read it as a checklist for preparing the positioning records and the process behind them before an assessment starts.

Method	What the assessor asks for	Evidence that passes	Common finding
Examine: positioning procedures	Procedures that address how system components are positioned within the facility, and whether they reference the hazards and access risks the organization has defined	A written procedure or standard that names the defined physical and environmental hazards, the placement criteria used and the approver, with a revision history	Procedures are generic and never mention hazards or unauthorized access, so the defined hazards are not traceable to placement decisions
Examine: facility location and room documentation	Documentation showing where system components sit in the facility and in which locations they are housed	Current floor plans, room or rack layouts and an inventory that ties each component to a room, row and position, dated and tied to a named owner	Layouts are outdated after moves or expansions, or rack positions exist only in a diagram that does not match the asset inventory
Examine: hazard and risk linkage	Evidence that placement decisions were informed by the risk assessment and the facility's physical and environmental hazards	Risk assessment entries or placement rationale that cite flood, fire, power, access or proximity hazards and the location chosen in response	Placement rationale is absent for existing racks, so assessors cannot see that hazards were considered
Interview: facilities personnel	Whether facilities staff know which areas hold system components, which hazards apply to them and how they are consulted on new placements	Consistent answers from facilities staff that match the layouts and procedures, with a named contact for placement requests	Facilities staff describe rooms that differ from the documented layout or are unaware that IT placements require their review
Interview: IT and platform staff	How system owners decide where new or relocated components go and who approves placement	Staff describe the same approval path as the procedure, including the physical access and hazard checks they perform before installation	Staff rely on informal decisions made when equipment is racked, with no record of who approved the location
Test: placement process	Whether the placement process operates as documented for recent installations, moves or decommissions	Sample of recent placements showing the request, hazard review, approval and updated layout or inventory entry	Recent moves were completed without updating the layout, or the approval step was skipped under deadline pressure
Test: hazard and access checks at placement	Whether the locations chosen limit exposure to defined hazards and unauthorized access, as observed on site or in records	Walkthrough of the room or records showing components away from identified hazard zones and within the controlled access boundary defined for the facility	Components sit near water sources, in shared or uncontrolled areas, or in rooms outside the physical access controls the organization documents

How to implement PE-18 in a facility in six steps

This sequence turns PE-18 from a sentence in the control catalog into a documented set of hazard decisions, component positions and placement rules that an assessor can trace from the facility to the system boundary.

Define the hazards the organization will address
Start by listing the physical and environmental hazards the organization has chosen to guard against, such as flood, fire, power loss, water leakage and unauthorized access paths. The control asks for positioning that minimizes damage from defined hazards, so the list must be explicit and approved by the risk owner. Record the rationale for each hazard and for any hazard deliberately left out. Output: a signed hazard register that the rest of the sequence refers to. Hazard definition also connects to sibling controls PE-23 (facility location) and PE-20 (asset monitoring and tracking), which the assessment team may review alongside PE-18.
Inventory facilities and rooms that house the system
Build a list of every facility, floor, room and rack location where system components sit, including colocation space, data centers and any secondary equipment closets. For each location, note the owner, the access arrangements and which hazards from the register apply. Confirm the list with facilities staff, because building drawings and actual use often differ. Output: a location inventory that ties each room to the hazards it faces and to the system boundary it supports.
Record the position of each system component
Capture where each component sits within each room: rack, row, height, distance from exterior walls, proximity to water sources, overhead pipes, power distribution and entry doors. Use existing asset records and a physical walk-down to confirm them. Record the date and the person who verified each position. Output: a component position record that an assessor can examine against the physical layout, which is the documentation the control's assessment procedure looks for.
Set positioning rules for hazards and access
Write rules that state how components must be placed relative to each hazard in the register. Examples include keeping core equipment away from exterior walls and below water-bearing lines, placing sensitive racks away from public or shared corridors, and keeping components out of areas where unauthorized people can reach them without passing a controlled point. Have the physical security lead and facilities engineers approve the rules. Output: an approved positioning standard tied to each hazard and access concern.
Document decisions, exceptions and owners
Record each positioning decision, the rule it follows and any exception with its compensating measure and approver. Assign an owner for each room and for the standard itself. Link the documents to the physical security policy and procedures that PE-1 covers, so the positioning standard is part of the same governed set. Output: a positioning decision log and an exception register, both approved and version controlled, that give the assessor a complete trail from hazard to placement.
Review placement after every relevant change
Set a trigger for review whenever equipment moves, racks are added, rooms are reconfigured, facilities work changes walls, pipes or power paths, or the hazard register is updated. Re-run the walk-down for affected components, update the position record and the decision log, and note what changed. Confirm the review with the control owner. Output: updated records with a dated change history showing that the positioning remains current. Confirm with the assessor how often reviews must occur for your authorization, since the sequence does not set a fixed interval.

Choosing positions that reduce hazards and access exposure

PE-18 asks the organization to position system components inside its facility so that defined physical and environmental hazards cause less damage and so that unauthorized people have fewer chances to reach the equipment. The control sets the goal but leaves the layout to the organization. Your team decides which hazards matter for each facility, which rooms or racks are candidates, and which placement trade-offs are acceptable. Start by listing the hazards you have already defined under PE-14, PE-13 and PE-15, then mark where each one could reach your equipment. Exterior walls exposed to weather or vehicle impact, water lines running above racks, and mechanical rooms that share a slab or ceiling with server space are common examples to review. Assessors will expect the reasoning to be written down and tied to the hazard list, not just a floor plan.

Access exposure works the same way. Equipment placed along public corridors, loading docks, shared tenant areas, or rooms reached through a lobby is easier to approach than equipment deep inside a controlled area behind the badge readers covered by PE-3. Consider placing the most sensitive components in interior rooms with the fewest entry points, and keep the paths from visitor areas and delivery zones to those rooms as long as possible. Placing components near the controlled areas that PE-2 and PE-6 already cover usually makes monitoring simpler, because cameras, guards and access logs are already focused there. Confirm the choices with facilities staff, since they know the actual water routes, fire zones and tenant arrangements that drawings may not show. Record the result in the documentation that PE-18 assessors will examine, including the location of each component and the reasons for it.

Plan for the placements to change. Equipment moves, new racks, and facility renovations can quietly put a component next to a water line or in a room that a new tenant can reach. Treat placement as a recurring review item, linked to change control and to any facility risk assessment, rather than a one-time drawing. For organizations that rent space or use a colocation provider, confirm in writing which hazards and access routes the provider controls and which your team must manage, because the provider's data hall layout may limit what you can move. If your team lacks the facility engineering background to judge water, fire or structural exposure, bring in a qualified facilities or engineering specialist for the review, and keep the final decisions and their documentation with the organization that owns the control.

Evidence that satisfies PE-18 and how to keep it current

PE-18 is judged on whether the organization can show where its system components sit and why those positions limit hazard and access exposure. The artifacts below connect that location picture to the risk decisions behind it, and each one goes stale unless it is updated when equipment moves.

Floor plans and rack elevations

Floor plans and rack elevations show where each component sits relative to walls, doors, water sources, power feeds and cooling. An assessor will compare them against the physical inventory, so mismatches are the first thing to find. Keep them under version control, tie each rack position to an asset ID, and reissue them after every installation, decommission or relocation. Confirm that the drawings reflect the facility as it is now, not as it was at the last audit.

Facility location records

These records state the position of the facility and of each room that holds system components, including the hazards identified for that site. They support the claim that positioning was a deliberate choice. Review them when the building, lease or hazard profile changes, and record the date and reviewer of each review. Ask your facilities team to confirm which hazards are listed and whether the list matches the current risk assessment.

Positioning standards

A positioning standard sets the rules for where components may be placed, such as distance from exterior walls, separation from water lines, and restricted zones for sensitive equipment. It is the document an assessor reads to learn what the organization expects, and it should name the defined hazards and access risks it addresses. Confirm that the standard is approved, dated, and referenced from the physical security procedures under PE-1.

Change records for equipment moves

Change records document each time a component is installed, moved or removed, with the before and after position, the approver and the date. They are the link between the location picture and what actually happened on the floor. Require a change ticket for every move, including moves made during outages, and reconcile the ticket log against the floor plans at least once per audit cycle. Ask whether moves made by vendors or contractors follow the same process.

Risk assessment inputs

Positioning decisions should trace to the risk assessment under RA-3 and to the contingency planning under CP-2, which together identify the hazards and the recovery impact of losing a location. PE-5 is related because output devices in sensitive areas affect the access picture. Keep the risk register entries that cite component positions, and update them when a relocation changes exposure. Confirm that the risk owner signed off on each position decision.

Interview notes from responsible staff

Assessors interview the people who decide and record component positions, then compare their answers with the documents. Notes from these interviews show who owns positioning, how hazards are considered, and what happens when a move is urgent. Record the interviewee's role, date and points covered, and refresh the notes after staff changes or reorganizations. Make sure the answers match the floor plans and change log, because contradictions will be noticed.

What meeting PE-18 costs in money and effort

This table breaks down the cost components of meeting PE-18 by who is paid, whether each cost is one-time or recurring, and what drives it up or down. NIST does not estimate compliance costs, so no figures appear here; use the drivers and quote questions to compare offers on your own facility.

Cost component	Who is paid or who carries it	One-time or recurring	Main drivers and how to reduce them
Facility survey and documentation	Internal facilities and security staff, or an outside consultant for a written survey	One-time, then revisited after changes	Number of rooms, hazard types in scope and how current floor plans are. Reduce by starting from existing building drawings and defined hazard lists.
Floor plan and rack drawing upkeep	Internal facilities or data center operations, sometimes an implementation partner	Recurring	Frequency of moves, additions and decommissioning. Reduce by tying drawing updates to change tickets so each move is recorded once.
Engineering time for repositioning	Internal engineers, facilities contractors or an implementation partner under a written scope	One-time per relocation, recurring when hardware changes	Number of components to move, downtime windows and dependencies such as power and cabling. Reduce by planning placement at design time rather than retrofitting.
External facility review	Independent hazard or site assessors, or a consultant reviewing hazard exposure	Periodic, often tied to a risk assessment cycle	Site age, hazard profile and whether the review covers only the data hall or the whole building. Ask whether the scope matches your defined hazards.
Auditor sampling and evidence preparation	Independent assessor (fees set by the assessor and the engagement terms)	Recurring with each assessment cycle	Number of locations, how many placement records the assessor samples and whether evidence is current. Ask for the assessor's sample approach before agreeing to scope.

Who owns PE-18 and what an implementation partner can take on

The organization that operates the system is accountable for PE-18. Only it can decide where its components sit inside each facility, which hazards matter for those locations, and whether the placement is acceptable to its risk owners. Those decisions belong to facilities, security and system owners, and they must be recorded and approved by people with the authority to accept the residual risk. An outside party cannot make them on the organization's behalf.

Hazard definition: Management defines which physical and environmental hazards the placement must address, such as flooding, fire, or unauthorized access routes, and records why.
Placement decisions: Named owners decide where racks, storage and network equipment go and approve changes to that layout.
Accountability: A designated role answers for PE-18 in the assessment and keeps the control current when the facility changes.
Risk acceptance: Residual risk from placement is accepted in writing by someone with the authority to do so.
Operation: Staff follow the placement rules when they add, move or retire equipment.

Confirm that the named owner for PE-18 is recorded in your control documentation and that the owner can explain the placement decisions without relying on a consultant.

Common PE-18 gaps and how to close them

PE-18 is easy to state and hard to evidence, because the placement decisions that satisfy it are often made once, during a build or move, and then never written down. The gaps below recur across facilities, from owned data centers to colocation cages, and each one breaks the chain between a hazard, a placement decision and a record an assessor can examine.

Floor plans that no longer match the room

The PE-18 determination statement asks for documentation that shows where system components sit within the facility. Floor plans drawn during the original fit-out often show racks that were moved, decommissioned or added years later. Before assessment, walk the room against the plan, rack by rack, and confirm each component's position. Treat any mismatch as a documentation defect to fix, not a cosmetic issue, because the assessor will use the plan to check hazard exposure.

Colocation evidence that stops at the cage

In a colocation facility, the provider controls the building, power, cooling and floor layout, while the customer controls its own cage or racks. Provider attestation documents may describe the facility in general terms without showing where your equipment sits relative to water, fire suppression or exterior walls. Ask the provider for the hazard and siting information it holds for your suite, and record the gap in your own documentation where the provider's evidence does not reach.

Moves and repositioning with no record

Racks are often shifted during maintenance, consolidation or cabling work, and the change is recorded in a ticket that never reaches the facility documentation. Over time, the documented position and the actual position drift apart. Require every physical move of a system component to update the location record and the floor plan as a closing step of the change ticket, and sample recent moves at review time to confirm the records were actually updated.

Placement decided without the hazard analysis

PE-18 asks that placement minimize damage from defined physical and environmental hazards. In many facilities, racks were placed for cable runs or floor space, and the hazard analysis, if one exists, sits in a separate risk register that nobody consults. Map each defined hazard, such as water, fire, heat or unauthorized public access, to the rooms and positions where it matters, and require that new placements be checked against that map before they are approved.

Placement rules that no one owns

Placement decisions touch facilities, IT operations, security and sometimes the business owner of a system, so responsibility can fall between them. An assessor will interview the people who position components and ask how they know which hazards to avoid. Name one accountable owner for placement standards, document who approves exceptions, and confirm that the people doing the work can describe the rules without looking them up.

Relying on PE-18 alone for PE-23 and PE-19

PE-18 sits next to PE-23 Facility location and PE-19 Information leakage, but the SP 800-53 Rev. 5.2.0 catalog lists related controls that overlap with it in practice, including CP-2, PE-5, PE-19, PE-20 and RA-3. Teams sometimes answer PE-18 with a single placement diagram and assume the related controls are covered. Map each related control to its own evidence, and check whether your risk assessment under RA-3 actually feeds the hazard list used to place components.

PE-18 questions buyers ask before hiring help

Does PE-18 apply to systems at the moderate impact level?

No. SP 800-53B allocates PE-18 to the high baseline only, so it is not selected for low or moderate systems and is not part of the privacy baseline. If your system is categorized as moderate, PE-18 is not required by the baseline, although your organization may still adopt it as a risk decision or because a contract, agency or overlay asks for it. Confirm the impact categorization and any overlay with your authorizing official or contract owner before scoping work. Also check whether your facility already has the PE-18 behaviors documented, since the control is short and often easy to evidence once location decisions are written down.

What does a PE-18 engagement cost, and what drives the price?

Cost depends on how many facilities host system components, how much of the positioning is already documented, and whether the work includes physical changes such as relocating racks. The main cost components are the time to map hazards and access points for each room, the review of existing floor plans and asset records, the writing or revision of the placement procedure, and any engineering work to move equipment. Recurring cost appears when facilities change and the location records must be updated. DeployOpen does not publish a price list. A quote follows from a written scope that names the facilities, the hazards you define and the deliverables, so ask for those items explicitly in any proposal.

Can our own team implement PE-18 without an outside partner?

Often yes, because PE-18 has one assessment determination statement and the work is largely documentation and decision making. Your facilities, security and data center teams already know where equipment sits and what hazards exist. An outside partner adds value when the team lacks time, when several sites must be reviewed consistently, or when a location decision requires engineering changes to the facility. Be clear about roles: your organization owns the control and the decisions, a partner can prepare the documentation and evidence, and only an independent assessor reports on whether the control is met.

How long does a PE-18 project take?

The duration depends on the number of facilities, the number of hazards you define, and whether physical relocation is needed. A single room with documented floor plans can be reviewed quickly, while several data centers with mixed hazard profiles take longer and may need site visits and coordination with facility owners. No standard duration is set by NIST for this control. Ask any provider for a timeline that is tied to the written scope, the number of sites and the dependencies on facility teams, and confirm who will supply floor plans, asset inventories and access records at the start.

What must we provide before work starts on PE-18?

Gather the information an assessor would ask for first. This usually includes:

Current floor plans or site drawings for each facility that houses high-baseline components
An inventory of system components with their rooms, racks and positions
The hazards your risk assessment defines for each site, such as water, fire, power or flood exposure
Records of who can enter each area and how access is granted
Any existing policy or procedure covering physical placement and facility changes

Having these ready shortens scoping and makes the resulting evidence easier to test against the assessment procedure.

How does PE-18 relate to PE-20 and PE-23?

PE-18 asks you to position components to reduce hazard damage and unauthorized access. PE-20 concerns asset location technologies that track where defined assets are within controlled areas, so it supports evidence about where components actually are. PE-23 concerns planning the facility location with hazards in mind, which affects the choice of site before any components are placed. PE-18 is the only one of the three that the high baseline selects, while PE-20 and PE-23 are not in any SP 800-53B baseline. A practical sequence is to review facility location and hazards under PE-23, then position components under PE-18, and track them under PE-20 if your organization chooses to adopt it.

Which engineering checks should we run to confirm component placement?

Engineers should confirm that each high-baseline rack or component sits away from identified hazards such as overhead water lines, drains, fire suppression discharge zones and exterior walls exposed to weather, and that it is not in a publicly reachable area. They should also record where the nearest access controls and monitoring points are, and check that the placement still holds after cabling or equipment changes. Keep the results as dated records tied to the asset inventory, so an assessor can compare the documented position with what is physically present.

How DeployOpen prepares PE-18 evidence

DeployOpen starts PE-18 work with a written scope that names the facilities, rooms, racks and platform components in the client's own infrastructure that the organization has determined belong to the high baseline. The scope also lists the hazards the organization has defined for each location, such as water, fire, power loss and unauthorized physical access, because PE-18 is measured against those defined hazards. Before any work begins, the client confirms the scope, the deliverables and the owner of each decision. DeployOpen does not decide which hazards apply or which systems fall under the high baseline. The organization owns those determinations, and the scope document records them as the client's decisions.

Once the scope is agreed, DeployOpen prepares the records an assessor will examine: a location and position register for each self-hosted platform component, showing rack, room, floor and facility, along with the reasoning for each placement against the defined hazards and access points. Where the client's facility team already keeps floor plans or asset records, DeployOpen works from those sources and flags gaps rather than creating a parallel record. Each engagement also documents who is responsible for positioning decisions and how those people were interviewed, so the examine, interview and test methods in SP 800-53A have concrete material to draw on. Ask the client to confirm which team owns the register after handover and how often it is reviewed.

DeployOpen does not issue audit reports, attestations or certifications. Only the organization's independent assessor can test PE-18 and form a conclusion, and the assessor decides what evidence is sufficient. DeployOpen prepares systems, records and a walkthrough of the positioning decisions so that the assessor can work efficiently, but the assessment result belongs to the assessor and the authorizing official. Before engaging an assessor, confirm whether the assessor expects the register in a specific format, and whether the high baseline applies to the platform at all, since PE-18 is allocated only to the high baseline in SP 800-53B.

PE-18 Location of system components