PE-21 Electromagnetic pulse protection: requirements and evidence

What PE-21 electromagnetic pulse protection requires in practice

A tailoring decision or a contract clause has added PE-21 to a system, and no SP 800-53B baseline includes it. That is the usual starting point. The control asks the organization to employ defined protective measures against electromagnetic pulse damage for defined systems and system components. Two blanks must be filled before anything can be built or tested: which systems and components are in scope, and which measures protect them. NIST leaves both to the organization. Because PE-21 is not allocated to the low, moderate or high baselines or the privacy baseline, its presence in a system's control set is a deliberate choice, typically driven by a risk assessment or by an applicable requirement that names electromagnetic threats.

That design freedom is what makes the control hard. An assessor cannot test PE-21 against a fixed checklist. The SP 800-53A procedure asks whether the organization has procedures and documentation addressing protective measures against EMP risk, and whether mechanisms for mitigating that risk exist and function. The reader therefore has to define the scope first, in writing: which racks, rooms, power paths or field devices count as defined components, what threat level the organization is designing against, and what measure applies to each group. Measures can range from facility-level shielding to equipment selection and surge protection, and the choice should trace back to the risk assessment that justified adding the control in the first place.

Start by asking the owner of the tailoring decision for the source of the requirement, the threat assumption behind it and the list of systems it covers. Then confirm with the facilities and engineering teams which components sit inside that list and what protection each already has. Gaps between the written scope and the installed measures become the items for the plan of action and milestones. Confirm with the assessor, before work starts, how they expect the procedures, documentation and mechanisms to be presented, since the assessment objects are described generally in the catalog and their expectations may differ. Open-source platforms can help with the inventory and configuration evidence for the components in scope, but EMP mitigation itself is a physical and engineering matter that the organization must own.

Which systems and facilities PE-21 applies to once it is added

PE-21 has no SP 800-53B baseline, so the organization decides whether it applies at all and to what. The scoping choices below determine which systems, components and facilities must be protected and how the evidence is organized. Each card covers one decision to settle before work starts.

Defining the systems and components

PE-21 requires the organization to define the systems and system components that need EMP protection, so the first decision is the boundary. Start from the system inventory and the authorization boundary, then decide whether protection applies to the whole system, to specific racks or to only the components whose loss would stop a critical function. A narrow definition is easier to evidence, but an assessor will test whether the definition matches the system's actual dependencies, including network equipment, power distribution and control hardware outside the main rack.

Owned facilities versus colocation

Who controls the facility decides who can implement PE-21. In an owned data center, the organization can specify shielding, grounding and surge protection in its own design. In colocation, many of those measures belong to the provider, so the organization must obtain the provider's EMP design documentation, contract terms and inspection records, then document what is inherited and what remains its own responsibility. Confirm these terms before the contract is signed.

Overlap with PE-18 location

PE-18 covers where components are positioned within a facility to reduce hazards and unauthorized access. Placing a rack away from exterior walls or sources of exposure can reduce EMP exposure, but PE-18 does not require EMP protection by itself. Record placement decisions made under PE-18 that also affect EMP exposure, so the two controls share one set of facility drawings and do not contradict each other during assessment.

Difference from PE-19 leakage

PE-19 protects against information leaving the system through electromagnetic emanations, which is a confidentiality concern. PE-21 protects against damage to equipment from an electromagnetic pulse, which is an availability and integrity concern. The two controls can share shielded enclosures and grounding work, but their tests and evidence differ, so the organization should not treat a TEMPEST or emissions assessment as proof of EMP protection.

When a contract or risk assessment adds PE-21

Because no SP 800-53B baseline includes PE-21, the control enters a system only through tailoring. A customer contract, an agency requirement or a risk assessment that identifies EMP as a credible threat to a critical function can justify adding it. Document the requirement or risk finding that drove the decision in the system security plan, since an assessor will ask why a control outside the baseline was selected and why it was excluded where it was not.

Confirming the scope before assessment

Before assessment, confirm three items in writing: the defined list of systems and components, the facility arrangement (owned or colocated), and the requirement or risk finding that justifies the control. Ask the assessor which assessment objects they expect for the chosen scope. Ask the facility provider or internal facilities team to confirm the protective measures in place, since the examine and test methods depend on those facts being accurate.

How an assessor tests PE-21 under SP 800-53A

This table maps the single PE-21 determination statement in SP 800-53A Rev. 5 to the examine, interview and test methods an assessor uses, the assessment objects they request and what passing looks like. Read it as a checklist of what to have ready before an assessor arrives, and note where findings usually occur.

Assessment element	What the assessor does	What to have ready	Where it usually fails
Determination statement	Decides whether the EMP protective measures for defined systems and components are employed, as the single PE-21 statement requires	A written scope naming the systems and components covered by EMP protection, plus the measures applied to each	Scope is undefined, so the assessor cannot tell which components the measures must cover
Examine: procedures	Reads procedures that address protective measures to mitigate EMP risk to systems and components	Procedures that name the responsible owner, the trigger for review and how measures are applied to new or relocated components	Procedures exist only as general statements with no link to the defined components
Examine: documentation	Reviews documentation detailing the protective measures chosen to mitigate EMP risk	Records that describe each measure, the components it protects and the date the design or configuration was last reviewed	Measures appear only in a design document or proposal and were never built or recorded as operating
Interview: personnel	Asks personnel with physical and environmental protection responsibilities how measures are applied and maintained	Named staff who can explain the measures, their scope, and how they are checked	Staff responsible for the facility are unaware the EMP measures exist or cannot describe their coverage
Test: mitigation mechanisms	Observes or tests the mechanisms that mitigate EMP risk to confirm they operate as documented	Inspection or test results for the mechanisms, including the configuration or physical state at the time of testing	Mechanisms are present but untested, or test results do not match the documented configuration
Evidence that passes	Finds the scope defined, procedures and documentation consistent with each other, interviews consistent with records, and tests that confirm operation	A consistent set of scope, procedure, documentation, interview notes and test results for each defined component	Documents, interviews and observations contradict one another
Common finding: undefined scope	Records a finding when no component list or boundary is stated for EMP protection	A scope statement tied to the system boundary and the facility where it resides	Scope is inherited from a general facility statement and never mapped to system components
Common finding: design-only measures	Records a finding when measures exist only in a design document and cannot be seen operating	Evidence from the installed state, such as inspection records or test outputs dated after installation	Organization treats a plan or specification as proof that the measures are in place

Implementing PE-21 step by step

This sequence turns PE-21 from a tailoring decision into documented, tested EMP protection for the systems the organization defines. Each step ends with an output that an assessor can examine, interview against or test.

Confirm the tailoring decision and defined systems
Start by recording that PE-21 is not in the low, moderate or high baseline, and that the organization added it during tailoring because risk or an applicable requirement called for it. Then name the systems and system components the control covers, and the facilities where they sit. The control has two organization-defined parameters, so the defined systems and the defined protective measures must be written down. The output is a tailoring entry in the system security and privacy plan that states the reason for adding PE-21 and lists the covered systems.
Assess EMP risk with the facility team
Bring together the people who run the facility, the system owner and security staff to assess electromagnetic pulse risk to the defined components. Review the site's location, power and cabling layout, equipment rooms, and any nearby sources the team can identify. Keep the assessment tied to the organization's own risk method and record who took part. The output is a dated EMP risk assessment that names the threats considered, the components exposed and the residual risk the organization is accepting.
Select and document protective measures
Choose the protective measures that address the risks identified in the previous step, and write each one against the component it protects. Measures vary by facility and risk, so confirm options with qualified engineers and vendors rather than assuming a single approach. Document the procedures for operating and maintaining each measure. The output is a protective measures document and the procedures that address EMP risk, which the assessor will examine.
Implement or confirm the measures
Put the selected measures in place, or verify that existing ones meet the documented design. Work with facility and engineering staff, and keep change records for any modification to equipment, enclosures or grounding. Where a measure depends on a contractor or equipment vendor, obtain the installation documentation and the vendor's own specifications. The output is a signed implementation record and an updated asset inventory that shows where each measure is installed.
Test the mechanisms
Test each protective mechanism against its documented design. The test method depends on the mechanism, so agree the approach with the engineers who designed it and keep the scope within what the organization can safely test. Record what was tested, the observed results, any deviations and the corrective actions. The output is a test report that links each mechanism to its result, which supports the test method in SP 800-53A.
Interview personnel with physical protection responsibilities
Confirm that the people responsible for physical and environmental protection know the measures, their roles in operating them, and the procedures to follow after a fault or alarm. The assessment procedure includes an interview method directed at these personnel. Record the interviews, the questions asked and any gaps found, then fix gaps through training or procedure updates. The output is interview notes and any training records that close the gaps.
Record results in the system security and privacy plan
Update the system security and privacy plan so PE-21 shows the tailoring decision, the defined parameters, the implementation description, the responsible role and a pointer to the risk assessment, procedures, test report and interview records. Schedule the periodic reviews the organization sets, and feed any open findings into the plan of action and milestones. The output is a complete PE-21 entry that an independent assessor can trace from requirement to evidence.

Which evidence passes a PE-21 assessment

An assessor testing PE-21 looks for documents that show the organization decided which systems and components need electromagnetic pulse protection, chose measures for them, and can prove those measures exist. The defined scope is the starting point: a list naming the systems and components covered, tied to the protective measures applied to each. Without that link, the assessor cannot tell whether the measures match the organization's own definition. The SP 800-53A procedure for examination asks for procedures addressing EMP protective measures and documentation that details them, so a written EMP procedure, a register of covered components, and the matching measure descriptions form the core evidence set. Because the organization owns its controls, these artifacts must be written by its own physical and environmental protection owners, not generated by an implementation partner and left unreviewed.

The test method asks for evidence that the mechanisms work. Depending on the measures chosen, that can be shielding inspection records, grounding or bonding verification reports, surge protection device test results, or vendor certificates for shielded enclosures, where the organization holds them. Confirm with your facility engineers which test or inspection reports exist for each covered component and how recent they are, because an assessor will compare the dates against the procedure. Interview notes complete the picture: staff with physical and environmental responsibilities should be able to explain the procedure, name the covered components, and describe what they do when an inspection finds a gap. Record those interviews as dated notes with attendees and the questions asked.

Evidence stays useful only if it is refreshed between assessments. Assign an owner to the covered-component register and set a review trigger tied to facility changes such as new racks, relocated equipment, or a new power or cabling design, since each change can alter which components need protection. Keep inspection and test reports in a controlled repository with versions and dates. A self-hosted document or ticketing platform inside your own infrastructure can hold these records with access logs, so the same evidence is available to the assessor and to your own review. Independent assessors examine this material and issue findings; DeployOpen can help prepare the register, procedures and evidence folders, but it does not issue assessment results.

Evidence artifacts that satisfy PE-21

PE-21 is assessed through documents, interviews and a test of the mechanisms themselves, so the evidence has to cover all three. The artifacts below connect the defined EMP protection procedure to the components it protects and to the records that show those measures still work.

Defined EMP protection procedure

This is the written procedure that sets out the protective measures against electromagnetic pulse damage and how they are applied to the defined systems and components. Assessors examine it first, so it must name the scope, the responsible roles and the trigger for reviewing the measures. Check that it matches what the facility actually does, not only what the organization intended. Review it on the schedule in the organization's PE policy and after any facility change.

Register of protected components

A register lists each defined system and component, the EMP measure applied to it, and the location where it sits. It is the link between the abstract requirement and physical hardware, and it lets an assessor pick a component and trace it to a control. Keep it in the asset inventory or configuration management database so new equipment is added when it is installed. Confirm that every entry has an owner and a measure.

Mechanism test records

Where the tailored control calls for test methods, the test records show that the chosen mechanisms were checked against the stated protection. Record the test date, the scope, the method, the result and the person who performed the test. Specialist testing of EMP mechanisms is usually performed by a qualified external engineering firm, so ask whether the vendor or testing firm can provide a report that names the components tested. Retain the records with the component register.

Facility inspection records

Inspection records show that the protective measures were examined in the facility on a schedule and after relevant changes such as equipment moves, shielding repairs or building work. Each record should identify the inspector, the areas covered, any defects and the corrective action taken. These records give assessors evidence that the measures are maintained in practice. Confirm the inspection interval with the organization's own policy, since no supplied source sets one.

Interview evidence from responsible personnel

Assessors interview the people who run physical and environmental protection to confirm they understand the EMP procedure and their duties under it. Prepare a short list of the roles, the procedure sections each role owns and the records each role produces. Staff who can explain the measures without reading the document usually give a stronger assessment outcome. Keep training or briefing records that show who was told about the procedure and when.

Tailored control entry in the security plan

Because no SP 800-53B baseline includes PE-21, the decision to add it must be recorded in the system security and privacy plan with the risk or requirement that justifies it. The entry should name the defined systems, the defined measures and the owner of the control. Review the entry whenever the baseline is tailored or the system boundary changes. Assessors use this entry to confirm the control was deliberately chosen rather than overlooked.

What meeting PE-21 costs and what drives it

This table breaks down the cost components of meeting PE-21 by who is paid, whether the cost is one-time or recurring, and what moves it up or down. No fee or duration is supplied for PE-21, and NIST does not estimate compliance costs, so the table tells you what to ask for in a written quote rather than what to expect to pay.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it
Scope and measure definition	Internal engineering, facility staff and any outside consultant preparing the scope	One-time, revisited on change	Number of defined systems and components, and whether the organization's risk or contract requirements call for PE-21 at all
Protective measures and shielding	Equipment vendors, electrical or facility contractors	One-time capital, with later replacement	Size and sensitivity of the defined components, and the protective approach chosen for each
Installation and facility work	Facility contractors and internal facilities teams	One-time	Whether the work fits into existing facilities or needs construction, and access constraints in occupied sites
Testing of mechanisms	Test engineers, qualified test providers, and staff who support the test window	One-time per test, repeated after changes	Number of mechanisms to test, test method agreed in advance, and the need to take systems offline
Procedures and documentation	Internal policy owners and an implementation partner preparing evidence	One-time to draft, recurring to review	Whether procedures already exist in the physical and environmental protection policy or must be written from scratch
Evidence upkeep	Facility and security staff collecting and filing records	Recurring	Review cycle set by the organization, changes to the facility, and how evidence is stored and indexed
Assessor effort	Independent assessor or internal assessment team	Recurring per assessment cycle	Assessment scope, depth of testing and how ready the evidence is when the assessor arrives
Quote contents to request	Vendor or partner preparing the written scope	Stated before work starts	Ask for named deliverables, assumptions about facility access, test method, evidence list, and exclusions such as equipment supply

Who owns PE-21 and what a partner can take on

The organization owns PE-21. It decides whether the control applies to a given system, based on its risk assessment, its impact level and any requirements from contracts, regulators or customers. SP 800-53B does not allocate PE-21 to the low, moderate or high baselines, so the decision to add it is a tailoring choice that must be documented. Once the organization decides to adopt it, it defines the systems and components in scope, selects the protective measures and accepts the residual risk. Those decisions belong to named leaders, not to a vendor.

Scope decision: Name the systems and components that need EMP protection and record why they were chosen.
Measure selection: Choose the protective measures and document the reasoning, including any alternatives considered.
Risk acceptance: A accountable executive signs off on what remains after the measures are in place.
Policy and procedures: Keep the procedures and documentation that the assessor will examine current and approved.
Ownership over time: Assign someone to review the decision when facilities, equipment or threats change.

Before engaging anyone, confirm with your own risk owner which systems are in scope and who signs the acceptance decision.

Where PE-21 programs usually fall short

PE-21 asks for defined protective measures against electromagnetic pulse damage, applied to defined systems and components. Most shortfalls come from that definition work being skipped, so the gaps below follow the order an assessor would test: scope, decision, tailoring, mechanisms and evidence.

Systems and components never defined

PE-21 only works once the organization has named the systems and system components it protects. Programs often say the data center is covered without listing which servers, network devices, storage arrays or control equipment sit in scope. Start with an inventory tied to the system boundary, then record the components that would be unacceptable to lose. The closing action is to produce a written list of defined systems and components and have the system owner sign it.

Measures not tied to an EMP risk decision

Protective measures should trace back to a documented decision that EMP risk applies to the defined components, and that the risk was weighed against other hazards. Many programs have equipment shielding or surge protection in place but no record of why it exists or who accepted the residual risk. Check that the risk assessment or risk register entry names the components and the chosen measures. The closing action is to add or update that entry with the decision owner and date.

Tailoring not recorded in the plan

Because SP 800-53B does not allocate PE-21 to any baseline, the control only appears in a system's security plan when someone adds it during tailoring. If the control is applied informally, an assessor finds nothing to test against. Confirm that the system security and privacy plan lists PE-21 as a supplemental control, states the defined systems and measures, and gives the reasoning. The closing action is to add the tailoring rationale to the plan and to the baseline decision record.

Mechanisms never tested

The assessment procedure for PE-21 includes a test method aimed at the mechanisms that mitigate EMP risk, so documentation alone will not satisfy an assessor. Shielding, grounding, surge suppression and similar measures can drift out of working order without anyone noticing. Ask for functional or inspection results that show each mechanism performed as designed. The closing action is to schedule a recurring inspection or test for each mechanism and keep the signed results with the plan.

Facility vendor holds the evidence

Protective measures in shared or colocated facilities are often designed, installed and documented by the facility operator. The security team may hold the control obligation without being able to retrieve drawings, inspection certificates or test reports. Review contracts and service agreements for evidence access, retention and notification duties before the assessment. The closing action is to add a clause or service-level evidence request that names the EMP documents the organization must receive and how often.

Staff responsibilities left undefined

The assessment asks interviewers to confirm that personnel with physical and environmental protection responsibilities understand the EMP measures. Programs often assign the topic to nobody, so facilities, security and system owners each assume another group is handling it. Map the roles in the PE policy and procedures, then confirm that the people named can explain the measures and where their evidence lives. The closing action is to name an accountable owner and a backup, and record the handover in the procedures.

How long, costly and hard is PE-21 for buyers

Is PE-21 electromagnetic pulse protection required by default?

No. SP 800-53B does not allocate PE-21 to the low, moderate or high baselines or to the privacy baseline, so a system only needs it when the organization adds it during tailoring. The usual reasons are a documented risk that EMP could damage the system or a specific requirement from a contract, regulator or internal policy that names it. Without one of those triggers, PE-21 is not a default audit finding. Confirm the current baseline text in the NIST OSCAL profiles before you rely on this, since the profiles are the authoritative machine-readable source.

Who decides whether PE-21 applies to our systems?

The organization decides, through its risk management process and tailoring. The system owner and the authorizing official usually agree on which systems and components are in scope, and the physical security or facilities team documents how they are protected. Where a contract or regulator requires it, that requirement sets the scope. An implementation partner can help document the decision and the rationale, but the organization owns the risk acceptance and the control selection.

What drives the effort and cost of PE-21?

The main drivers are how many systems and components the organization defines for protection, how much of the protection already exists in the facility, and how much new hardware or engineering is needed. Organizations with a small, well-characterized set of components often document existing measures and test them. Larger or distributed estates need more inventory work, more engineering review and more testing. NIST does not publish cost or duration estimates for PE-21, so ask for a written scope and a breakdown of one-time and recurring work from any provider you consider.

Can our own team implement and assess PE-21 without outside help?

Often yes, if you have facilities engineers who understand EMP mitigation and staff who can run the assessment steps. The assessment is small: SP 800-53A Rev. 5 gives one determination statement for PE-21, with examine, interview and test methods. The examine step needs procedures and documentation of the protective measures, the interview step needs personnel responsible for physical and environmental protection, and the test step needs evidence that the mechanisms work. Teams without electrical or facilities expertise usually bring in a specialist for the engineering and test design.

What does PE-21 require from facilities and security staff?

Facilities staff need to identify the defined systems and components, describe the protective measures in place, and keep the documentation current. Security staff need to make sure those measures are part of the physical and environmental protection policy and procedures, are reviewed, and are tested in a way that produces records. Both groups must be able to explain the measures to an assessor. Ask who owns each document and how changes to the facility are reflected in the EMP documentation.

Does DeployOpen issue the PE-21 assessment or certify our compliance?

No. DeployOpen prepares systems, controls and evidence for compliance assessments, and it does not issue audit reports, attestations or certifications. For NIST SP 800-53 work, the authorizing official and the assessors chosen by the organization or the agency make the determination. DeployOpen can plan the scope in writing, prepare the procedures and evidence, and support testing of the self-hosted platform components, with the organization retaining ownership of the controls.

What should we ask for in a PE-21 quote?

Ask for a written scope that lists the defined systems and components, the protective measures to be documented or implemented, the evidence to be produced for each assessment method, and the deliverables and dates. Ask which items are one-time and which recur, such as periodic reviews or re-testing after facility changes. Confirm who performs engineering work inside the facility, who signs off on test results, and what the organization must supply, including access, drawings and staff time. DeployOpen does not publish a price list, so a quote follows from the written scope.

How DeployOpen scopes and prepares PE-21 evidence

DeployOpen's role on PE-21 is to help the organization decide what electromagnetic pulse protection applies to its defined systems and components, then prepare the documentation and test material that an assessor will examine. The organization owns the control. Work starts with a written scope that names the systems and components in question, the facility or facilities where they sit, and the requirement that justifies adding PE-21 to the baseline, since SP 800-53B does not allocate it to any baseline. DeployOpen then works through the scope agreed in writing, with deliverables and timing set out before any work begins, and the scope is the first thing to confirm with the team, because it decides every later artifact.

In practice, preparation covers three groups of evidence that map to the determination statement in SP 800-53A. The first is the procedures and the protective-measures documentation that describe how the defined components are shielded or otherwise protected against EMP damage, including where that documentation sits in the system security and privacy plan. The second is a record of the personnel with physical and environmental responsibilities, because an assessor will interview them about the measures. The third is evidence from testing the mechanisms themselves, such as inspection records, configuration of protective equipment and results of any functional checks the organization has chosen to perform. DeployOpen can help set up the collection and organization of this material and can run agreed checks where the scope includes them, but the choice of protective measures, and any engineering judgment on whether they are adequate, stays with the organization and its qualified facility engineers.

Readers should be clear about the limits. DeployOpen prepares systems, controls and evidence for assessment; it does not issue assessment reports, attestations or certifications, and the independent assessor or authorizing official draws the conclusion on PE-21. Ask any partner to state in the agreement which artifacts are deliverables, which tests are performed by the organization's own staff, and which items depend on work by an outside EMP specialist. Confirm with the assessor, before work starts, which evidence format and level of detail they expect for this single determination statement.

PE-21 Electromagnetic pulse protection