PE-19 Information leakage: requirements and evidence

PE-19 information leakage: why it is not in any baseline by default

PE-19 is not in the low, moderate or high baseline, so a contract, customer or authority that asks for emanations protection is asking for something the baseline does not give you. Electromagnetic leakage happens when a system's electrical activity radiates signals that can be picked up outside the facility, and in principle those signals can reveal the data being processed. The control requires the system to be protected against that kind of information leakage. Because SP 800-53B leaves it out of every baseline and the privacy baseline, the decision to add it belongs to your organization during tailoring, driven by your threat picture or by a specific requirement you have been given.

The first question to answer is whether the requirement applies at all. Ask the requesting party to name the threat it is worried about, the classification of the information and the systems in scope, and whether it refers to a national emissions policy. Those answers decide whether you need protection for a whole facility, a room, or a limited set of devices. Scoping is hard because leakage depends on physical layout, shielding, cabling, equipment type and proximity to uncontrolled areas, so the same server may be fine in one building and exposed in another. Treat the scope as a risk decision that is documented, approved and reviewed, not as a checkbox.

PE-19 has one active enhancement, which concerns national emissions policies and procedures. Related controls are AC-18, PE-18 and PE-20, which cover wireless and access points, placement of system components, and asset tracking. Evidence for PE-19 is usually a documented risk decision, procedures addressing emanations, records of the protective mechanisms in place, and interviews with the staff who manage facility environmental controls. The assessment procedure in NIST SP 800-53A Rev. 5 makes the examine, interview and test methods explicit. Confirm with your assessor, and with the program that imposes the requirement, which methods and evidence they will accept before you invest in testing or shielding.

Which systems and facilities PE-19 applies to

PE-19 has no SP 800-53B baseline, so an organization adds it only when risk or an applicable requirement calls for it. The decisions below determine whether the control reaches a single rack, a room, a facility or a provider's building, and each one changes what evidence an assessor will ask for.

Systems that process classified or sensitive information

Start by listing which systems handle information whose disclosure would cause material harm, including classified material, controlled unclassified information and sensitive personal data. These are the systems where an emanations risk is most plausible to justify. Document the reasoning in the system security plan, because an assessor will test whether the scope decision matches the system's categorization. A system that is categorized moderate or high for confidentiality without any PE-19 decision needs an explicit justification either way.

Rooms and areas that house those systems

Map which rooms, racks, cabinets and work areas hold in-scope components. Emanations protection is a property of the physical space as well as the equipment, so a secured server room and an open office with a workstation may need very different answers. Confirm the boundaries of each room in your facility drawings and note any shared corridors, adjacent tenants or nearby wiring that could extend the area of concern.

Shielding as a facility, equipment or procurement matter

Decide whether protection will come from building construction, from shielded equipment or enclosures, or from purchasing rules that select lower-emanating hardware. Each path has different owners, costs and proof points. Facility shielding is usually a construction decision, equipment protection is a procurement and configuration decision, and both need acceptance testing. Ask each path's owner which one they will be accountable for before the scope is signed off.

Hosting and colocation providers

If in-scope systems run in a colocation facility or a provider's data center, the provider's physical controls become part of your evidence. Contractually require the provider to show how it protects its space against emanations, or confirm that the provider's own assessment covers the relevant room. Your contract should name the artifacts you can request and how often, because you will not have direct access to inspect the facility yourself.

Requirements that trigger the control

Identify which laws, contracts or internal policies require emanations protection for your data or systems. Because SP 800-53B does not allocate PE-19 to any baseline, the trigger has to come from your own risk assessment or from an applicable requirement that you have read and recorded. Keep the source of each trigger with the scope decision so an assessor can trace why the control was added or excluded.

How an assessor tests PE-19

This table breaks down the single SP 800-53A determination statement for PE-19 by assessment method, the assessment objects an assessor may examine, interview or test, and the findings that commonly appear. Use it to prepare the documents, people and mechanisms an assessor will ask for, and to see where a PE-19 assessment usually stalls. The main takeaway is that PE-19 is assessed only when the organization has chosen to adopt it, so a documented decision comes before any evidence.

Assessment method	Suggested assessment objects	Common findings
Examine	Procedures addressing information leakage due to electromagnetic signal emanations	Procedures exist but do not name the system or facility they cover
Examine	Mechanisms protecting the system against electronic signal emanations	No record showing which mechanisms were selected, installed or approved
Interview	Organizational personnel with responsibilities for system environmental controls	Facilities and system owners cannot describe how emanation risk was decided
Test	Mechanisms supporting or implementing protection from electromagnetic signal emanation leakage	Mechanisms were specified but never tested or verified after installation
Risk decision	Documented decision on whether PE-19 applies to the system	No recorded risk decision to adopt or reject the control during tailoring
Scope	Facility and components where the system operates	Procedures are generic and do not address the environment where the system runs
Evidence currency	Test results and procedures that match the current system	Evidence predates a relocation, hardware change or major configuration change

How to implement PE-19 step by step

The sequence turns PE-19 from a tailoring decision into protective mechanisms, written procedures and test records that an assessor can examine, interview against and test.

Document the requirement that triggers PE-19
Because SP 800-53B does not allocate PE-19 to any baseline, the first step is a documented tailoring decision. The system owner, with the risk function, records the risk or applicable requirement that calls for protection against electromagnetic signal emanations, and states why the control is added to the baseline. Done means a signed tailoring record in the system security and privacy plan that cites the risk assessment or the requirement and names the approver. Without this record, the absence of PE-19 in a baseline will look like an oversight to an assessor.
Define the in-scope facilities and equipment
Identify which facilities, rooms and equipment that process, store or transmit information in the system fall under the decision. Include workstations, servers, network equipment, displays and printers where the risk analysis calls for it. The output is a bounded inventory linked to the system boundary and the asset records already kept for PE-22 and PE-20, where those controls apply. Confirm the list with facilities staff, because building layouts and shared spaces often change who can be near equipment.
Select the protective mechanisms
Work with the security engineering and facilities teams to choose the mechanisms that protect the in-scope equipment from information leakage through electromagnetic emanations. The choice depends on the threat model and the environment, so it should come from the risk analysis rather than a product catalog. Record each selected mechanism, the equipment it covers and the rationale. Confirm with vendors and qualified TEMPEST or emissions specialists which technical standards and testing methods apply in your jurisdiction and sector.
Write procedures for protection and maintenance
Write the procedures that the organization follows to operate and maintain the chosen mechanisms. Cover how equipment is placed and shielded, how changes to the room or equipment are reviewed for emanation impact, who may authorize exceptions, and how staff report suspected leakage. The procedures should also address any national emissions policy or procedure the organization must follow, which is the enhancement in the control. The output is an approved procedure document that an assessor can examine, with a review date set by the organization.
Assign roles and train the responsible staff
Name the people who own the mechanisms, the facilities staff who maintain them and the personnel who must be interviewed about environmental controls. An assessor will interview these people, so each should be able to explain the procedure and their part in it. Record role assignments and training completion. Done means each named role has an acknowledged responsibility and the training record shows that the people who will be interviewed received the procedure.
Test the mechanisms in their installed state
Test the installed protective mechanisms in the facility where the system operates, not only on a vendor datasheet. The test plan should state what is measured, the acceptance criteria taken from the selected standard or policy, the equipment under test and the people who witness the results. Retain the raw results, the test conditions and any remediation. This step produces the test evidence that matches the SP 800-53A test method for PE-19. Where testing requires specialist equipment or accreditation, confirm who performs it and whether the results must be reported to a third party.
Record outputs and map them to the assessment
Gather the tailoring record, inventory, mechanism selection, procedures, role and training records and test results into one evidence package indexed by the PE-19 assessment objects: procedures to examine, personnel to interview and mechanisms to test. Store the package in the system's documentation repository and keep it current through change control. The package is ready when an independent assessor can trace each determination statement to a named artifact. Ask the assessor to confirm the format and depth they expect before the package is finalized.

What a test of emanations protection actually looks like

Testing protection against electromagnetic emanations is specialized work, and the method depends heavily on the facility and the equipment inside it. Before any testing is commissioned, the organization should agree the test methods and scope with its assessor, because the assessor's procedure for PE-19 names three kinds of evidence: procedures, mechanisms and personnel who understand the environmental controls. Ask the assessor which of these will be examined on paper, which will be interviewed, and which will be tested in the room. Confirm in writing what the assessor expects to see for each, and whether the assessor will accept results from a specialist test provider or needs to witness the work directly.

Documentary review and technical testing answer different questions. A document review checks that the organization has written procedures addressing information leakage from electromagnetic signal emanations, that the procedures name who owns them, and that the mechanisms protecting the system are described and maintained. Technical testing checks whether those mechanisms work in the actual space and with the actual equipment. Because PE-19 is not allocated to any SP 800-53B baseline, many organizations will find that the assessor's scope is set by a risk decision or a specific requirement rather than a standard baseline, so the first document to request is the record of why PE-19 was selected and what it covers.

DeployOpen plans and documents the surrounding environment, including system placement, procedures and evidence packages, and it can run security testing on the systems within a client's own infrastructure. It does not perform emanations or TEMPEST-style measurements as a certified service, does not issue attestations, and does not certify emissions performance. Any claim that a facility meets PE-19 must come from an independent assessor or a qualified specialist test provider engaged by the organization. The practical step is to ask both your assessor and any test provider for a written scope, a list of deliverables, and the qualifications of the people who will perform the measurements before work begins.

Evidence that passes a PE-19 assessment

A PE-19 assessor starts with the documented decision to include the control, then looks for procedures, protective mechanisms and records that show the decision was carried out. Each artifact below answers one part of that chain, and each needs a named owner and a refresh trigger so it stays current between assessments.

Tailoring decision in the SSP

Because no SP 800-53B baseline allocates PE-19, the system security plan should state whether PE-19 was added during tailoring and why. Record the risk or applicable requirement that drove the decision, or the reason it was judged not applicable. An undocumented omission is the most common gap an assessor will raise. Re-check the decision whenever the system's classification, facility or regulatory obligations change, and note the review date in the plan.

Procedures addressing emanations

Assessors examine whether written procedures address information leakage caused by electromagnetic signal emanations and name who carries them out. The procedures should describe how the organization identifies systems that need protection, how it selects mechanisms, and how it validates them. Keep the document under version control with an owner and an annual review date, and update it after any change to the systems or sites it covers.

Equipment and facility records

Maintain an inventory of the system components in scope, with location, make, model and the protective mechanisms installed on each. Facility records should show where the equipment sits and whether it is within a controlled area. Asset tracking records under PE-20, if used, can supply part of this. Reconcile the inventory against physical audits and change tickets so that moved or replaced equipment does not drop out of scope.

Test and inspection reports

Where a mechanism is tested, the assessor will look for a report that names the equipment, the test method, the date and the person or firm who performed it. Ask qualified providers to state their credentials and the scope of the work in the report. Retain each report with the configuration it tested, because a later hardware or layout change can make an old result irrelevant. Schedule retesting when the equipment or its surroundings change.

Periodic review records

The assessment method for PE-19 includes interviews with personnel responsible for environmental controls, so the review record should show that those people looked at the procedures, inventory and test results. Date each review, record its findings and track corrective actions in the plan of action and milestones. Set a review cadence in the procedures document and treat missed reviews as a finding in your own internal checks.

Staff interview readiness

Assessors interview the people who run environmental controls, so those staff need to explain the protections without reading from notes. Confirm that the named owners can point to the current procedures, inventory and latest test report, and that they know what changed since the last review. Keep an up-to-date role description for each owner, and refresh staff briefings whenever the owners change.

What meeting PE-19 costs in money and effort

This table breaks down the cost components of PE-19 by who is paid, whether each cost is one-time or recurring, and what drives it up or down. No prices or durations are given because none were supplied, so use the questions in the last rows to build a comparable written quote.

Cost component	Who is paid	One-time or recurring	What drives the cost
Facility emanation assessment	Specialist TEMPEST or emissions consultant, or a cleared test lab	One-time, repeated after major changes	Number of rooms or sites in scope, classification level of the data, and how many emitting devices are present
Shielding or protective equipment	Equipment vendor, facility contractor or integrator	One-time capital cost, plus maintenance and recertification	Size of the shielded space, the protection approach chosen, and whether existing construction can be reused
Specialist emissions testing	Accredited test provider	Recurring at the frequency the organization sets	Test scope, equipment under test, and whether testing is repeated after hardware or layout changes
Procedure and policy writing	Internal staff or implementation partner	One-time drafting, then recurring review	Number of facilities, whether national emissions policies apply, and how many existing procedures can be reused
Evidence upkeep	Internal compliance or facilities staff	Recurring	Frequency of test records, change tracking for equipment and layout, and how well evidence is stored from the start
Assessor time	Independent assessor or internal assessment team	Recurring at each assessment cycle	Number of assessment objects examined, interviews required, and whether test results are ready when the assessor arrives
Implementation support	Implementation partner under a written, fixed scope	One-time, with optional retainer for ongoing support	Depth of technical work, number of sites, and whether the partner also prepares the evidence package
Quote question: scope boundaries	Requested from every bidder	Not a cost, but it sets the price	Which facilities, rooms and systems are in scope, and which classification level the quote assumes
Quote question: deliverables and exclusions	Requested from every bidder	Not a cost, but it prevents surprises	Ask which items are excluded, such as shielding construction, third-party test fees and assessor fees, and whether each is priced separately

Who owns PE-19 and what an outside partner can prepare

Your organization owns PE-19 in full. Because SP 800-53B does not allocate PE-19 to any baseline, the first decision is whether the system needs protection from electromagnetic signal emanations at all. That decision belongs to the authorizing official and the risk management process, informed by the system's impact level, the facility, and any applicable requirements from a regulator, customer or contract. Your facilities, security and procedures teams then carry the controls themselves.

Risk decision: Record whether PE-19 is selected, the threat or requirement behind the choice, and who approved it in the system security and privacy plan.
Facilities and shielding: Decide and operate any physical measures in the facility, such as shielding or emanation controls, and keep records of their condition.
Procedures: Write and maintain the procedures that address information leakage from electromagnetic emanations, and assign an owner to review them.
Interviews and staff knowledge: Make sure the personnel responsible for environmental controls can explain the protections and their role in them.
Vendor and equipment choices: Decide which hardware is deployed in protected areas and document any emissions-related requirements you place on suppliers.

Confirm with your authorizing official and assessor, before work starts, exactly which procedures and mechanisms the assessment will examine.

Where PE-19 programs usually fall short

PE-19 is rarely missing from a plan because teams reject it. It is usually missing because nobody recorded whether it applies, the procedures stay generic, or shielding and provider controls exist on paper without evidence. The cards below cover the gaps assessors most often find and a practical first step for each.

No recorded applicability decision

SP 800-53B does not allocate PE-19 to any baseline, so a system categorized as low, moderate or high can legitimately omit it. The gap appears when nobody wrote down why. Record a decision for each system stating whether emanations risk applies, which requirement or threat drove that answer, and who approved it. Revisit the decision when the system's classification, facility or applicable requirements change.

Procedures that name no facility

An assessor examining PE-19 looks for procedures addressing information leakage from electromagnetic signal emanations. Generic wording that never names the room, rack, device types or site covered will not show that anyone planned for the actual environment. Write the procedure against named locations and equipment, state who inspects them and how often, and tie the procedure to the system security plan so the scope is traceable.

Shielding bought but never tested

Shielded rooms, enclosures or emanation-reducing hardware are only evidence if someone tests them. SP 800-53A expects the test method to show the mechanisms actually protect the system. Ask the vendor for installation and test records, define a test plan with pass criteria, and retain the results with dates, equipment identifiers and the person who witnessed the test. Retest after changes to the room or equipment.

Inherited provider controls with no evidence

When a colocation provider, cloud operator or landlord runs the facility, part of PE-19 may be inherited. Inheritance only holds if the organization has the provider's description of the control and evidence it works. Request the provider's assessment documentation, confirm which emanation protections are the provider's responsibility, and file that evidence with your system security plan. Where the provider cannot supply evidence, the gap stays with the organization.

Interviews with no named owner

SP 800-53A also assesses PE-19 by interviewing personnel responsible for environmental controls. Teams often cannot name that person, so the interview has no one to answer it. Assign an owner in the facilities or security function, document their responsibilities in the procedure, and keep a record of who held the role during each assessment period.

Enhancements dismissed without review

PE-19 has one enhancement that refers to national emissions policies and procedures. Programs sometimes skip it without noting that it exists. Check whether any national or contractual emissions requirement applies to the system's facilities, and if none does, record that finding alongside the applicability decision. Confirm the current enhancement wording in the NIST catalog before drafting the record.

PE-19 questions buyers ask before bringing in help

Is PE-19 required for my system if no baseline includes it?

Usually not by default, but it may become required through your own tailoring. SP 800-53B does not allocate PE-19 to the low, moderate or high baselines or to the privacy baseline, so it applies only when your organization adds it while tailoring a baseline. The usual triggers are a risk assessment that identifies electromagnetic emanations as a credible threat to a sensitive system, or an applicable requirement from a contract, agency or regulator that names it. Ask the authorizing official or contracting officer to confirm whether PE-19 is in scope before any work starts, because the answer decides whether the effort is needed at all.

What drives the cost of meeting PE-19?

The main cost driver is how much of the facility and hardware must be assessed, not the control text itself. PE-19 has one determination statement in SP 800-53A, so the assessment is narrow, but the protective mechanisms may involve shielding, facility design, equipment selection and emissions testing, which are physical and specialist work. Costs split into one-time items (risk analysis, design or procurement of protective measures, initial testing) and recurring items (re-testing after equipment or facility changes, documentation upkeep). Ask any vendor or consultant for a quote that separates these, names who performs each task, and states which items depend on your facility layout.

How long does a PE-19 implementation usually take?

No researched duration is available for this control, so treat any timeline as something to confirm, not assume. The timing depends on whether the risk decision is already documented, whether the facility can be modified or only equipment can be selected, and whether specialist testing must be scheduled and repeated. Organizations that already maintain a physical and environmental program and a current risk assessment usually have a shorter path than those starting from no documented requirement. Ask for a milestone plan in the written scope that shows which steps depend on procurement, facility work or outside testers.

What does the client have to provide for a PE-19 engagement?

The client owns the control and must supply the facts that decide how it is met. Typically that means the system boundary and the facility where it resides, the risk assessment that justified or rejected PE-19, existing physical and environmental procedures, equipment inventories, floor plans and access to the spaces where the mechanisms would sit. The client also names the people who answer the SP 800-53A interview questions for system environmental controls. Without these inputs, scope cannot be fixed in writing, so ask the partner to list every input and owner in the proposal.

Can our own team implement and evidence PE-19 without an outside partner?

Yes, if your team has the right skills and the emissions testing is handled correctly. The control requires you to define a protection approach, put mechanisms in place, and show through examination, interview and testing that they work, so internal staff can do this when they have facilities, security and test expertise. Outside help is most useful for the risk analysis, the design of protective measures and independent-quality testing evidence. Whichever route you pick, the organization still owns the control. Ask a partner to state in writing which tasks they would perform and which remain with your staff.

Can DeployOpen issue the PE-19 assessment or certify our compliance?

No. DeployOpen plans, prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. Assessment of PE-19 is performed by the organization's own assessors or by an independent assessor, depending on the authorization process your agency or contract requires. Any partner who offers to certify you should be treated with caution. When you evaluate help, ask who will sign the assessment results and confirm that person's independence from the implementation work.

How does PE-19 relate to PE-18 and PE-20?

PE-18 and PE-20 address different risks, so they are related but not interchangeable. PE-18 concerns where system components are positioned within a facility to reduce hazards and unauthorized access, and it is the only PE control allocated to the high baseline alone. PE-20 concerns tracking the location and movement of defined assets with asset location technologies, and no SP 800-53B baseline includes it. PE-19 concerns protecting against information leakage from electromagnetic signal emanations. Placement decisions under PE-18 can affect how exposed equipment is to emanations, so teams often review them together, but each control needs its own determination and evidence.

What should we ask an engineer or partner to check before the work starts?

Ask them to confirm the scope, the risk basis and the evidence plan before any equipment or facility work begins. Specifically, check that the risk assessment names the system and facility, that the protective mechanisms are identified by type and location, and that the test method for emanations protection is described in advance. Also confirm how the results will be documented for the SP 800-53A examine, interview and test methods, and which national emissions policies, if any, your organization must follow under the enhancement. Ask for these points in writing so the scope is fixed before costs are committed.

How DeployOpen prepares PE-19 evidence

DeployOpen's work on PE-19 starts with a written decision about whether the system needs this protection at all. Because SP 800-53B does not allocate PE-19 to the low, moderate, high or privacy baselines, the organization has to add it during tailoring, and that decision belongs to the organization's authorizing official and risk owners, not to the implementation partner. We help prepare the record behind that decision: the system boundary, the facilities and rooms where classified or sensitive processing happens, the threat or requirement that triggered the control, and the reasons the team chose or declined the enhancement on national emissions policies. Before any hardware is touched, we recommend confirming the tailoring decision in the system security plan and the scope of the assessment in writing.

Once the scope is agreed, the work is concrete. We map the TEMPEST-related procedures, equipment placement records, shielding and enclosure documentation, and facility inspection records that an assessor would examine for the 1 determination statement in SP 800-53A. For the interview step, we prepare the facilities and environmental control staff who would explain how emanation risks are handled, and we set up the test evidence: documented measurements or vendor certificates for shielding, and a record of which mechanisms protect which components. Where a national emissions policy applies, the organization should confirm which authority or standard governs it, since that is a customer or regulator question rather than a technical one. Any measurement or certification must come from a qualified specialist and the vendor, and the organization should ask for both in its quote.

DeployOpen plans, implements, documents and prepares the systems, procedures and evidence described above inside the client's own facilities, under a fixed scope with deliverables and timelines agreed in writing before work starts. We do not issue assessment reports, attestations or certifications. Those come only from an independent assessor, and the organization owns the control decisions and the outcome. If you need PE-19 evidence prepared for an assessment, request a written scope from DeployOpen so that the boundary, the assumptions and the deliverables are clear before anyone starts work.