PE-22 Component marking: requirements and evidence

What PE-22 component marking asks for and why it is often missed

A tailored system or a customer contract now asks for PE-22 component marking, and the first question most teams face is whether anyone already owns it. No SP 800-53B baseline includes PE-22, so it does not arrive with the low, moderate or high baseline. An organization adds it during tailoring when its risk assessment or an applicable requirement calls for it. That origin explains most of the gaps. The control is not on the default checklist, so the physical security team, the asset owners and the compliance lead each assume another group has it.

In plain terms, PE-22 asks that defined hardware components, such as computers, displays and printers, carry a visible marking showing the impact level or classification of the information they are permitted to process, store or transmit. The risk it addresses is mishandling. A monitor or printer that once served a higher-sensitivity system can be moved, reused or left unattended in an area where staff with lower clearance or need-to-know can see its output. A marking makes the sensitivity visible to anyone who handles the device, including staff who were never briefed on the system.

Before you accept the requirement, confirm three things with the authorizing official or customer: which components are in scope, which classification or impact level each component carries, and who sets the marking format. Then assign an owner, usually the asset management or physical security function, and tie the marking to the component inventory so that a reassigned or redeployed device is re-marked or re-classified. Ask your assessor which artifacts they expect to examine, since the assessment procedure for PE-22 centers on component marking procedures, the list of marking attributes and the component inventory. The NIST CPRT catalog entry for PE-22 is the natural next read for the exact wording of the control in your release.

Which components and decisions bring PE-22 into scope

PE-22 applies only to the hardware the organization chooses to mark, so scope is set by decisions made before any label is printed. The cards below cover the component types, the impact and classification levels, the tailoring step that adds the control, and the related controls where marked hardware and its handling meet.

Defining the in-scope hardware types

Start with the system component inventory and decide which device classes the control covers: workstations, laptops, monitors, printers, multifunction devices and similar peripherals that display or output information. Be explicit about edge cases such as thin clients, docking stations and removable storage readers, since assessors will ask why a device class was excluded. Record the decision and its rationale so the scoped list can be defended without interviews.

Mapping impact levels to each system

Each marked component needs a level that matches the most sensitive information it may process, store or transmit. Confirm the impact level of the system first, then the classification of the data it holds, and assign the higher value when they differ. Devices that move between systems or classification boundaries need the highest level they will ever handle, not the level of their home system.

Tailoring PE-22 into a baseline

PE-22 is not allocated to the low, moderate or high baselines or to the privacy baseline, so it appears only when the organization adds it during tailoring. Add it when a risk assessment, an authorizing official or a contract clause calls for marked hardware. Document the addition in the system security and privacy plan so the reason is traceable to a decision rather than to habit.

Where AC-3 and AC-4 enforce handling

Marking only has value if systems respect it. AC-3 covers access enforcement and AC-4 covers information flow enforcement, so the markings on hardware should match what those controls allow. Check whether a device labeled for a higher level can connect to a lower-level network, and whether print or display paths enforce the same restriction that the label states.

Connecting AC-16 and MP-3 to marked devices

AC-16 addresses security attributes on information and MP-3 addresses marking of media. Where a marked component stores or displays removable or portable media content, the markings on hardware and media should agree and follow the same handling rules. Confirm which attribute and marking schemes apply so staff do not carry conflicting labels between devices and media.

Keeping the scoped list the organization's decision

The list of components, levels and tailoring choices belongs to the organization, not to an outside party or to NIST. Consultants can prepare the inventory data, the marking records and the evidence, but the authorizing official or system owner must approve the scope. Confirm with your authorizing body or contract owner whether they expect PE-22 explicitly, because that expectation drives how much inventory detail assessors will sample.

How an assessor tests PE-22 component marking

This table breaks down the single SP 800-53A determination statement for PE-22 into its examine, interview and test methods, with the assessment object each one points to. Read each row as a question the assessor will ask, the evidence to have ready, and where organizations usually fall short.

Assessment method and object	Evidence to prepare	Common finding
Examine: procedures addressing component marking	Written component marking procedure that names the marking scheme, the impact or classification levels used, who applies the marks and when marking happens in procurement and deployment	Procedure exists but does not say which hardware types are in scope or how marks map to the information each component may handle
Examine: list of component marking security attributes	Documented list of the marking attributes (impact level or classification value) and the format of each mark, with the rule that links each attribute to a component type	Attribute list is missing, or it uses labels that do not match the system security plan's categorization
Examine: component inventory	Inventory export showing each defined hardware component, its marking attribute and the location or asset owner, drawn from an asset management record	Inventory lacks a marking field, or marked components are recorded in a separate spreadsheet that is not reconciled with the inventory
Interview: personnel with component marking responsibilities	Named roles, role descriptions and records showing who applies, checks and approves markings, ready for the assessor to speak with	Staff applying labels do not know the scheme, or responsibility sits with a role no one has assigned
Interview: personnel with component inventory responsibilities	Named inventory owners, their update process and evidence of how new or moved hardware is added to the inventory	Inventory owners describe updates that happen only at annual reviews, so new hardware is unmarked for long periods
Test: organizational processes for component marking	Sample of recently received, deployed and reassigned components, each traced from procurement to a marked and inventoried state	Processes work for new purchases but reassigned or repurposed components keep old or no markings

Implementing PE-22 marking step by step

This sequence turns PE-22 from a policy statement into marked hardware that an assessor can trace from the label to the inventory record, the classification rule and the named owner. Each step produces a document or record that the next step depends on.

Define components in scope and marking levels
Start by listing which hardware components the organization has defined as system components for the system under assessment, such as computers, displays, printers and similar devices that may hold or display information. Then map each component class to the impact level or classification of the information it may process, store or transmit, using the system's categorization and data handling rules. The output is a defined component list paired with the marking levels that apply to each class. Confirm the scope with the system owner before moving on, since an unclear list makes every later step harder to test.
Set the marking format and placement standard
Write a short marking standard that states the exact label text or code for each level, the material and size of the label, and where it goes on each device class, for example on the chassis or bezel. Decide how marks are handled for components that cannot be labeled physically, such as virtual desktops or components inside a rack, and record that decision explicitly. The output is a marking standard signed off by the owner of the physical security or asset management function. Keep the standard short enough that technicians will follow it without interpretation.
Assign owners for marking and inventory
Name one accountable owner for applying marks and a separate owner for the component inventory that records them. Separating these roles creates a check, because the person who labels a device should not be the only person who confirms the label matches the record. Document each person's responsibilities, the backup for each role, and who may approve exceptions. The output is a responsibilities section within the PE-22 procedure, which an assessor will test by interviewing the people named in it.
Build marking into asset intake and redeployment
Add the marking step to the existing workflow for receiving new hardware, staging it and issuing it to a user or a system. Redeployment, repair returns and transfers between classified and unclassified areas should trigger the same check. Where a device is moving to a different impact level, the mark must change before the device goes into service. The output is an updated intake and redeployment checklist that includes a marking line item, with the checklist retained as evidence that the step ran for each device.
Record each marked component against its inventory entry
For every component, record the marking level, the date it was marked and the person who marked it in the inventory entry for that device. Open-source inventory tools such as GLPI can hold asset records with custom fields for this purpose, and the GLPI Agent or Wazuh Syscollector can help confirm which devices are present on the network, though neither is documented here as providing a marking attribute out of the box, so confirm that with the vendor before relying on it. The output is an inventory where each marked device has a traceable record that an assessor can compare with physical samples.
Test sampled components against the records
Select a sample of marked components across device classes and locations, then check that the physical label matches the inventory entry and the classification of the information the device is authorized to handle. Record any mismatches, the corrective action taken and the person who verified the fix. This test mirrors what an assessor does when examining the component marking list and comparing it with the component inventory. The output is a dated verification record that shows the marking process operates in practice, not only on paper.
Set a review point for reclassification and repurposing
Define when the marking must be reviewed: when a system's categorization changes, when a component is reassigned to another system, when information handling rules are updated, and when a device leaves service. Assign the reviewer and specify what the review checks, including whether the label, the inventory record and the authorized information level still agree. The output is a review procedure, signed by the owner, plus a log of completed reviews. Ask the organization's compliance lead to confirm how often reviews should occur, because the researched facts supplied here do not set a review frequency for PE-22.

Evidence that passes a PE-22 assessment

An assessor testing PE-22 Component marking looks for a written marking procedure, a defined set of marking attributes, an inventory that shows which components carry which marks, and proof that people follow the process. The cards below cover the artifacts that connect those pieces and how to keep each one current between assessments.

Component marking procedure

This is the written procedure that says which hardware components are marked, what marking format is used, who applies it, and when. Assessors use it to confirm the organization has a defined process rather than ad hoc labels. Check that it names the classification levels your systems actually handle, covers replacement and repair of components, and carries a review date tied to your policy review cycle. Record each revision with an approver and date.

List of marking security attributes

This list defines the marking security attributes the organization uses, such as impact level or classification values, and maps each value to the handling rules that apply to it. Assessors compare it with the components in the inventory to see whether every marked item uses a defined value. Keep it under change control so a new classification level cannot appear on hardware before the list is updated and approved.

Component inventory with marking fields

The inventory is the core evidence that the procedure runs in practice. It should list each defined hardware component with its owner, location, and a marking field that records the classification or impact level it may process, store or transmit. GLPI's Assets module can hold computers, monitors, printers and similar equipment, and the Wazuh Syscollector module can collect hardware details from endpoints, but confirm whether a custom field or external attribute is needed to hold marking values. Reconcile the inventory against physical checks on a set schedule.

Marking samples and labeling records

Photographs or labeling records for a sample of components show that marks exist on the hardware and match the inventory. Assessors use them to test whether the process works, not just whether it is documented. Select samples across component types and classification levels, record who applied each mark and when, and capture any marks that were removed or replaced during repair. Keep the photographs linked to inventory asset identifiers so a reviewer can trace each one.

Personnel responsibility assignments

Assessors interview the people who mark components and the people who maintain the inventory, so the organization needs named responsibilities for both. Document who approves marking changes, who performs the marking, and who owns the inventory, with backup assignments for absences. Confirm that each person knows the procedure and the attribute list. Sign-off on each marking change, recorded in the ticketing or inventory system, shows the assignment is active.

Reclassification and disposal records

When a system changes classification, or a component leaves service, the marks and inventory entries must change with it. Keep records showing the old and new marking, the date, the approver, and the disposal or sanitization event for retired hardware. Ask whether your sanitization records are kept with media protection evidence, since the same asset may fall under both families. Assessors often sample these records to test whether marks were updated after a reclassification.

How GLPI and Wazuh can support PE-22 evidence

GLPI is licensed under GPL-3.0-or-later. Its Assets module manages computers, monitors, software, network equipment, peripherals, printers, phones and racks. Entries can be typed in by hand or pushed automatically by the GLPI Agent through native inventory, which GLPI has offered since version 10. For PE-22, the asset record is the place to note which impact level or classification each component is permitted to handle, so an assessor can match the register against the physical labels.

Asset records: Each computer, display or printer can carry its own record, which makes it possible to tie a marking to a specific serial number and location.
Automatic population: The GLPI Agent can feed hardware data into the register, which reduces the chance that a new device goes unrecorded.
Marking attributes: Confirm whether your GLPI version lets you add a custom field or dropdown for marking level, or whether you need to record it in a linked document or comment.
Lifecycle status: Use the asset status and history to show when a component was moved, reassigned or retired, and whether its marking was checked at each stage.
Reporting: Export asset lists for assessors and confirm that the export includes the fields your marking procedure depends on.

Before relying on GLPI, confirm with your own installation which attributes it stores, how the agent reports, and whether the marking data stays consistent after a migration.

What meeting PE-22 costs in money and effort

The table breaks down the cost components of marking hardware with classification levels, who is paid for each, whether it is one-time or recurring, and what drives it up or down. Use it to scope a quote and to see where self-hosted inventory tools reduce spend and where they do not.

Cost component	Who is paid or who bears the cost	One-time or recurring	What drives it up or down, and what to ask for in a quote
Marking labels and materials	Organization purchases; a partner may apply them as part of scope	Initial application is one-time; replacements are recurring	Count of components and classification levels, plus churn from replacements. Ask for label format, placement standard and replacement handling.
Scheme design and intake integration	Partner or internal engineering and operations staff	One-time, with occasional revision	Number of classification levels and how many procurement and intake paths exist. Ask what the marking scheme covers and who signs it off.
Inventory tool licenses	GLPI and Wazuh carry no license fee under their open-source licenses (GPL-3.0-or-later and GPL-2.0-only)	Not applicable for licensing	Licensing is zero, so costs shift to hosting and staff time. Ask what commercial support, if any, the quote includes.
Hosting and staff time for self-hosted inventory	Organization pays cloud or data center costs and internal staff time	Recurring	Number of endpoints the GLPI Agent and Wazuh Syscollector report from and retention settings. Ask for sizing assumptions and who operates the stack.
Evidence upkeep	Organization staff, with partner support if retained	Recurring	Frequency of hardware changes and reclassifications. Ask how marking records link to the component inventory and how often they are reconciled.
External review of the marking scheme	Independent assessor or consultant, if engaged	Usually periodic	Scope of review and whether it covers both the scheme and sampled components. Ask for the review deliverable and the reviewer's independence.
Assessor sampling effort	Assessor's fees, billed to the organization	Recurring with each assessment cycle	Number of components the assessor samples and how well the inventory matches physical marking. Clean, consistent records reduce sampling time.
Retainer or ongoing support	Partner, under a separate written agreement	Recurring	Whether marking changes are handled on request or as part of routine operations. Ask for response expectations in writing before work starts.

Who owns PE-22 and what can be outsourced

Your organization owns PE-22 in every sense that matters to an assessor. The control requires defined system hardware components to be marked with the impact level or classification level of the information they are permitted to process, store or transmit, so the decisions about what those levels are and which components carry them cannot be delegated. Your security, compliance and asset management staff remain accountable for the answers, even when a partner builds the tooling.

Classification levels: Define the impact or classification levels in your own policy and state which information each level covers.
Marking procedure: Write the steps for applying, verifying and updating markings on computers, displays, printers and similar components, including who performs each step.
Component inventory: Own the authoritative list of hardware components and the classification each one carries, and keep it current as equipment moves or is retired.
Responsibilities: Name the personnel who handle marking and inventory so they can be interviewed and can show their work.
Supplementing the baseline: Decide whether PE-22 applies to your systems, since no SP 800-53B baseline includes it and it is added through tailoring when risk or applicable requirements call for it.

Before engaging anyone, confirm that these decisions are documented and approved, because a partner cannot supply them and an auditor will ask who made them.

Common gaps that fail PE-22 and how to close them

PE-22 fails less often on the marking itself than on the records around it. The gaps below cluster around scope, inventory, lifecycle ownership and whether procedures are actually used. Each card names the fix and the evidence an assessor would expect to see.

No scope tied to classification

Many organizations label some hardware but never define which components are permitted to process, store or transmit information at a given level. Without that mapping, no one can say whether a label is correct or missing. Fix it by listing the system components in scope, assigning each to the impact or classification level it may handle, and recording the decision with its owner. Evidence to produce: a scope register that links each component class to its level and the approval that set it.

Markings missing from the inventory

A physical label that never reaches the asset record is invisible to audits and to the people who reissue or retire equipment. PE-22 assessors examine the component inventory alongside marking procedures, so the two must agree. Add a marking attribute to each inventory record, populated when the label is applied. GLPI's Assets module can hold custom fields for this purpose, and the Wazuh Syscollector inventory can confirm hardware identity for endpoints. Confirm each field's setup in your own environment. Evidence to produce: an inventory export showing the marking field for each in-scope component.

No owner after repurposing or return

Hardware moves. A laptop cleared for one level is reissued to another team, a monitor leaves a secured floor, or a printer goes back to a leasing vendor with its old marking still on it. Name a single owner for each marking change event, such as reassignment, reclassification, repair or return, and require a recorded re-marking or removal step before the asset moves. Evidence to produce: change tickets for moves and returns that show who re-marked or removed the label and when.

Procedures never examined or updated

A marking procedure that sits in a shared drive and has not changed since it was written does not show that it works. Assessors examine the procedure, interview the people who carry it out, and test whether the process runs as written. Set a review cycle, record each review with its approver, and sample real hardware against the procedure during internal checks. Evidence to produce: dated procedure versions, review sign-offs and a sample test record showing the procedure followed.

Inventory and physical labels disagree

Over time, the label on a device and the record in the inventory drift apart through relabeling, missed updates or assets that were never tagged. A periodic reconciliation between a physical walk-through and the inventory catches these gaps before an assessor does. Sample a defined set of components, compare the visible marking with the recorded level, and resolve each mismatch with a documented correction. Evidence to produce: reconciliation reports listing each mismatch, its correction and the person who closed it.

PE-22 component marking questions buyers ask

How much effort does PE-22 component marking add to an SP 800-53 program?

For most systems, PE-22 adds a bounded but real amount of work, and the effort is driven mainly by how many hardware components are in scope and how often they change. The control asks you to mark defined components with the impact level or classification of the information they may process, store or transmit. Effort comes from three places: deciding the marking scheme, applying labels or records to each component, and keeping those records current as equipment is issued, moved, repaired or retired. Organizations with a stable, small fleet usually see a light recurring load, while large or fast-changing fleets need an inventory process that feeds the marking record. Ask any quote to break out the one-time scheme design from the recurring maintenance of the marking list.

Does any SP 800-53 baseline require PE-22 component marking?

No. SP 800-53B does not allocate PE-22 to the low, moderate or high baselines or to the privacy baseline. Your organization adds it by tailoring a baseline when risk assessment or an applicable requirement calls for it, for example a contract, agency direction or a classification rule that expects hardware to show the data level it handles. Confirm with your authorizing official, contracting officer or compliance lead whether a specific requirement in your environment makes PE-22 mandatory before you scope it in. If it is not required, document the decision and the reasoning in your tailoring record.

How long does PE-22 implementation take, and what drives the timing?

The supplied facts do not give a duration for PE-22 work, so confirm timing in a written quote rather than relying on a general estimate. The main drivers are the size of the in-scope hardware population, whether an accurate asset inventory already exists, the number of impact levels or classifications that must be marked, and whether labeling is done by your staff or by a physical process at your sites. A fixed-scope engagement sets the timeline from the agreed deliverables, so ask the partner to tie each milestone to a specific component group and to state which steps depend on your staff's availability.

What does PE-22 need from our staff?

PE-22 needs people who own the marking decision, people who own the component inventory, and people who apply and check the marks. Assessors expect the roles with component marking responsibilities and the roles with component inventory responsibilities to be named and to understand the scheme. In practice you need a policy owner to define which impact levels or classifications map to which marks, an asset owner to keep the inventory accurate, and facilities or IT staff to physically apply and verify labels. Your own staff must also be able to explain the process when an assessor interviews them, so training on the scheme is a practical dependency.

Can we implement PE-22 in-house with open-source tools?

Yes, a self-hosted open-source asset management platform can hold the marking record and the inventory evidence, although the physical marking itself is done by your people. GLPI's Assets module, licensed under GPL-3.0-or-later, manages computers, monitors, printers, network equipment and other hardware, and it can be populated manually or through the GLPI Agent, whose native inventory has been built into GLPI since version 10. Wazuh's Syscollector, licensed under GPL-2.0-only, collects hardware details from endpoints for inventory views and reports. Neither tool is documented as storing impact levels for you by default, so confirm whether a custom field or asset category can carry the marking attribute before you rely on it. An implementation partner can configure this in your environment and prepare the evidence, but the control remains your responsibility.

What will an assessor ask to see for PE-22?

An assessor working from SP 800-53A will look for evidence that the marking procedure exists, that it is followed, and that the component inventory supports it. The assessment method for PE-22 names examining the procedures that address component marking, the list of component marking security attributes and the component inventory, interviewing staff with marking and inventory responsibilities, and testing the organizational processes for component marking. Prepare the written procedure, the list defining which marks correspond to which impact levels or classifications, a sample of marked components traced back to inventory records, and a short walkthrough showing how a new or retired component is handled. The independent assessor decides whether the evidence meets the control, not your implementation partner.

Which parts of PE-22 are usually outsourced, and what stays with us?

Organizations often outsource the design of the marking scheme, the configuration of an inventory platform and the preparation of assessment evidence, because those tasks need specialist time that is not used every day. The organization keeps ownership of the control, the classification decisions, the physical labeling of its own facilities and the approval of the procedure. An implementation partner such as DeployOpen can plan, implement and document the systems and evidence within your infrastructure under a written scope, but it does not issue assessment reports or certifications. Only an independent assessor can test the control and report on it, so agree in writing which deliverables the partner owns and which decisions stay with your team.

How DeployOpen scopes and prepares PE-22 evidence

DeployOpen approaches PE-22 Component marking as a written, fixed-scope piece of work inside the client's own environment. We help define which hardware components are in scope, how they are marked, and what records show that marking is kept current.

How we scope

Confirm with the organization which hardware classes fall under the system boundary, such as computers, displays and printers.
Agree in writing which impact or classification levels each component is permitted to carry and who decides them.
Record whether PE-22 is added by tailoring, since no SP 800-53B baseline includes it and the decision belongs to the organization.

How we build

Configure the GLPI Assets module to hold a field or record that carries the marking for each component in the inventory.
Use the Wazuh Syscollector inventory on endpoints to confirm hardware details against the recorded marking.
Test that marking records match the component inventory and flag gaps for the organization to resolve.

How we hand over

Deliver the component marking procedure, the list of marking attributes and the component inventory export as evidence files.
Document interview notes covering the personnel who own marking and inventory so assessors can trace responsibilities.
Provide a written record of tests run against the marking process, with open items listed for the organization to close.

How we support

Offer ongoing support and upgrades as a retainer after handover, including updates when the component inventory changes.
Review marking records again when SP 800-53 releases or the organization's classification scheme changes.
Confirm with the organization and its independent assessor which evidence format they accept before work begins.