PE-23 Facility location: requirements and evidence

What PE-23 facility location asks for and why it is often missed

PE-23 requires that the location or site of the facility where the system resides is planned with physical and environmental hazards in mind. For a facility that already exists, those hazards must also be considered in the organization's risk management strategy. That means the facility choice is treated as a documented risk decision, not an assumption. Many teams reach an assessment with a data center, colocation room or office closet that was selected years ago, often by a landlord, a colocation provider or a cloud region chosen for cost or latency, and nobody revisited the hazards against the current system.

The control is missed for two structural reasons. First, it is a planning and risk decision rather than a device or setting, so no scanner or configuration export proves it. Second, no SP 800-53B baseline includes PE-23 in the low, moderate, high or privacy baseline. It appears only when an organization adds it during tailoring because its risk assessment or an applicable requirement calls for it. A team that never tailors the baseline may never see the control at all, even though the related controls in the catalog are already in scope. Confirm with your authorizing official or contract owner whether PE-23 has been added to your system's control set and, if not, why.

The control sits next to several others that assessors will read together. CP-2 covers contingency planning, PE-18 covers where system components are positioned within a facility, RA-3 covers risk assessment, and PM-9 covers the organization's risk management strategy. The practical check is to find the site-selection rationale, the hazard analysis behind it and the risk strategy entry that accepts or mitigates those hazards, then confirm that the contingency plan and component placement reflect the same findings. Ask your colocation provider or landlord for the facility's own hazard documentation, since you will need it to show that you considered what they already know about flood, seismic, power and fire exposure.

Which facilities, systems and decisions PE-23 applies to

PE-23 Facility location applies to wherever the system physically resides, but the work it creates depends on who controls that site and how the site was chosen. The cards below separate the decisions that change scope: facility ownership model, the hazards in scope, what providers already cover, whether the site is new or existing, and which contingency plans rely on the site.

Facility ownership and hosting model

Start by confirming whether the system sits in an owned data center, a leased space, a colocation cage or a cloud provider's region. PE-23 asks the organization to plan the location, so the degree of influence over site selection decides whether the control is largely a design decision or a documented review of a site chosen by someone else. Ask the provider or colocation operator for their site selection records and any hazard assessment they hold, and confirm which of them you can request.

Physical and environmental hazards in scope

Define the hazard categories the assessment must cover before reviewing any site. Typical categories include flood and water ingress, seismic activity, severe weather, fire exposure from neighboring properties, proximity to hazardous industrial sites, and access routes that could be cut off. The hazard list should come from the organization's own risk assessment, so it can be compared against the site documentation an assessor will examine.

Shared responsibility with providers

When the system runs in a cloud provider's facility, the provider typically owns site selection and hazard mitigation, while the organization owns how it uses multiple locations and how it documents its reliance. Obtain the provider's compliance documentation for its facilities and check whether it covers PE-23 hazard planning. Where the provider's evidence does not address the organization's specific hazards, the gap needs a documented decision and, if required, a supplemental control.

New sites versus existing facilities

The control text treats new and existing facilities differently. A new site should have hazards weighed during planning, before construction or lease signature. An existing facility should have those hazards reflected in the organizational risk management strategy. Confirm which category each system's facility falls into, because the evidence for a new site is planning records, while the evidence for an existing site is risk strategy entries and risk responses.

Systems whose contingency plans depend on the site

Identify the systems whose recovery depends on a single facility, since a site hazard becomes a contingency event for them. Review the contingency plan and any alternate site arrangements for these systems, and compare them with the hazards recorded for the primary location. PE-23 is linked to the contingency planning family (CP-2) and to risk assessment (RA-3), so the site decision and the recovery design should be read together.

How an assessor tests PE-23 under SP 800-53A

This table maps each SP 800-53A assessment method for PE-23 to the assessment objects an assessor examines, interviews or tests, and the findings that usually come up. Read it as a checklist of what to have ready before an assessment, since PE-23 has only two determination statements but touches policy, planning, risk and contingency documents.

Method	What the assessor looks at	Evidence that passes	Where it usually fails
Examine	Physical and environmental protection policy and site planning documents	Policy text that requires site location to account for physical and environmental hazards, and site planning records that show those hazards were considered	Policy covers access control but says nothing about site selection or hazards
Examine	Organizational risk assessment and risk mitigation strategy documentation	Risk assessment entries for the facility hosting the system, and a strategy that addresses hazards at existing facilities	Risk strategy is silent on existing facilities, so hazards at current sites are never assessed
Examine	Contingency plan documentation	Contingency plan references to site hazards such as flood, fire or power loss tied to the facility's location	Contingency plans are generic and not linked to the site's actual hazard profile
Interview	Personnel with site selection responsibilities for the facility housing the system	Consistent answers about how the site was chosen or reviewed, and who signed off	Staff cannot name who decided the site or whether hazards were part of that decision
Interview	Personnel with risk mitigation responsibilities	Clear explanation of how identified site hazards feed into risk treatment decisions	Risk owners describe hazards informally with no record of decisions or follow-up
Test	Organizational processes for site planning	A repeatable process that reviews location hazards before a new site is used and re-reviews existing sites	No documented process exists, or the process was applied once and never repeated
Common finding	No record of site hazard review	Dated site hazard assessment with scope and reviewer named	Assessor cannot find any record that the location was reviewed
Common finding	Risk strategy silent on existing facilities	Strategy text that expressly includes existing facilities in hazard consideration	Strategy only addresses new construction or relocation

How to implement PE-23 step by step

This sequence confirms whether PE-23 applies to your system, maps every facility that houses it, records hazards and siting rationale, and carries the results into your risk management strategy, contingency planning and risk assessment.

Confirm PE-23 scope in your baseline
Check your selected SP 800-53B baseline for the system. PE-23 is not allocated to the low, moderate or high baselines or to the privacy baseline, so it appears only if your team added it during tailoring because of identified risk or an applicable requirement. Record the decision and its justification in the system security and privacy plan. The output is a documented yes or no for PE-23 with the reason, which the assessor will ask to see first.
Inventory every facility housing the system
List each physical location where system components reside, including primary sites, backup sites, colocation spaces, cloud regions you can identify and any alternate processing location named in your contingency plan. Assign an owner to each site, typically the facilities or site selection function. The output is a facility register that the rest of the sequence uses as its scope. If a cloud or hosting provider controls a site, ask it to confirm the location it will disclose to you in writing.
Identify hazards for each site
For each facility, document the physical and environmental hazards your organization has defined as relevant, such as flood exposure, fire, seismic activity, power supply reliability, climate extremes and unauthorized access. Use authoritative local sources and your own incident history rather than assumptions. Have personnel with site selection and risk mitigation responsibilities review the list. The output is a hazard table per site with the source of each rating and the reviewer's sign-off.
Record siting rationale for new facilities
For any site that is planned, not yet built or not yet selected, write down how hazards shaped the choice: why this location was chosen, what alternatives were rejected on hazard grounds, and which mitigations were required before commissioning. Keep the rationale with the site planning documents so an assessor can examine how planning was done. The output is a signed siting memo for each new facility, linked to the hazard table.
Reflect existing-site hazards in risk strategy
For facilities that already exist, the control expects the hazards you identified to be considered in the organizational risk management strategy rather than changing the site. Add each relevant hazard to the enterprise risk register with an owner, likelihood and impact rating under your own method, and a stated response such as accept, mitigate or transfer. The output is a risk register entry for every hazard that affects a housed system, approved by the risk owner.
Link results to contingency planning
Connect each site hazard to the contingency plan (CP-2) so that a loss of the facility triggers the documented recovery approach, including the alternate site and any relocation steps. Confirm that the recovery objectives in the plan reflect the hazard the site faces. The output is a cross-reference from each hazard in the register to the matching contingency plan section, reviewed by the people who run recovery.
Link results to risk assessment
Feed the site hazards into your risk assessment process (RA-3) so they are rated with the same method as other threats and tracked to a response. Confirm that the risk assessment cites the same facility inventory and hazard table used earlier. The output is a risk assessment report that covers each facility, with a traceable path from hazard to rating to treatment. Ask your assessor to test this trace during the assessment.
Retain evidence for assessment
Store the baseline decision, facility register, hazard tables, siting memos, risk register entries and the cross-references to CP-2 and RA-3 in a controlled repository with version history and review dates. Set a recurring review trigger for when a facility changes, a new hazard is identified or the system moves. The output is an evidence pack that lets an independent assessor examine the policy, planning documents and risk documentation for PE-23 without reconstructing them.

How the hazard review turns into a defensible record

An assessor testing PE-23 Facility location will not accept a single sentence saying the site was considered. The record needs to show a documented, repeatable analysis that someone can rerun, with named participants, a defined list of hazard categories, and a visible path from each finding to a risk decision. Start by writing down the hazard categories the organization uses for the facility housing the system, such as flood or water ingress, fire, power supply, extreme temperature and humidity, seismic activity where relevant, and proximity to hazardous or high-traffic activities. Categories should be specific enough that each one can be answered yes, no or mitigated with a reference to evidence. Confirm with your facilities team which categories they already track for building operations, because duplicating an existing survey is usually cheaper than starting a new one.

Participation matters as much as the categories. Facilities staff hold the building data (elevation, drainage, utility feeds, fire compartments), security staff assess access and surrounding threats, the system owner states which components depend on the site, and the risk owner accepts or treats each finding. Record who attended, what they reviewed and the date, because assessors test the interview and examine evidence methods against the people named in your documents. The outputs should flow into three places: the organizational risk register, where each hazard gets a rating and treatment; the contingency plan under the CP family, where relocation or recovery steps for the hazard are described; and the placement decisions for components, which connect to PE-18 Location of system components. A finding that goes nowhere in these documents will be hard to defend.

A record stays defensible only if it is refreshed. Set a review trigger in the policy and procedures for any change to the facility, such as a new tenant, a renovation, a change in utility supply or a relocation of racks, and for any update to the hazard assessment itself. Keep the prior version so you can show what changed and why. Ask your independent assessor, before fieldwork, which evidence they expect for existing facilities versus new sites, since the control distinguishes these cases. If your organization is pursuing a federal or contract requirement, confirm with the authorizing body how often reviews must occur, because NIST does not set that interval for you.

Evidence that passes a PE-23 assessment

PE-23 is assessed by reading documents, interviewing the people who choose and manage sites, and testing whether site planning actually happens. The artifacts below connect those three checks, so each one should cite the others and carry a named owner and review date.

Site planning documents with hazard analysis

These are the records that show the facility location was planned with physical and environmental hazards in mind, such as flood zones, seismic exposure, fire load, power grid reliability and proximity to hazardous sites. For each facility housing the system, check that the analysis names the hazards considered, the data sources used, the decision taken and who approved it. Record a review date so the analysis is revisited when the surrounding area or the system changes.

Organizational risk assessment entries per facility

Assessors look for a risk entry for each facility where the system resides, showing that existing-site hazards were considered in the organizational risk management strategy. Each entry should state the hazard, likelihood and impact rating, the affected components, and the risk owner. Confirm the entries match the facility inventory used in your risk assessment and that they are refreshed on the cycle set by your risk management program.

Risk mitigation strategy for existing sites

For facilities that predate the current risk program, the mitigation strategy shows how each identified hazard is treated: accepted, reduced by relocating components within the facility, backed by additional controls, or transferred. Check that every hazard in the site analysis maps to a decision here, and that accepted risks carry a named approver and an expiry or review date. Assessors commonly test whether this strategy changes when a hazard assessment changes.

Contingency plan sections tied to site hazards

The contingency plan should contain site-specific scenarios for the hazards named in the site analysis, such as flooding of the facility, loss of the site, or fire affecting the data hall, along with the alternate processing arrangements used in each case. Confirm the scenarios reference the same facility identifiers and hazard list as the planning documents. Keep a record of when the plan was last tested against these scenarios and who signed off the results.

Facility review records and approvals

Dated review records show that someone with site selection or risk responsibility examined each facility against current hazard information and approved it or required changes. Each record should list the reviewer, the hazard sources consulted, the findings, and the approval or follow-up actions. Schedule these reviews on a fixed cycle, keep the approval chain in your document management system, and confirm that interviewees can explain the outcome of the most recent review.

Change records when a site is added or moved

When a system component is moved to a new facility or a new site is brought into service, the change record should show that the location was planned against hazards before the move and that the risk entries were updated. Link each change ticket to the site analysis, the risk entry and the contingency plan revision. Without this linkage, assessors cannot confirm that new locations received the same consideration as existing ones.

What meeting PE-23 costs in money and effort

This table breaks down the cost components of documenting PE-23 facility location, showing who is paid for each, whether it is one-time or recurring, and what drives it up or down. NIST does not estimate compliance costs, so use the table to build your own scope and request quotes against it.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it
Initial hazard analysis of each facility	Internal facilities and risk staff, plus any external survey firm you choose to hire	One-time per facility, then revisited	Number of facilities, site age, and whether hazard data (flood, seismic, fire, power grid) must be gathered from outside sources
External site or engineering survey (optional)	Engineering or environmental survey firm, if commissioned	One-time, repeated only after major site change	Whether the organization relies on its landlord's reports or commissions independent surveys; leased sites often rely on landlord documents
Consultant time to structure the risk record	Implementation partner or internal GRC lead, to map hazards to the risk management strategy and PE-23 assessment objects	One-time setup, then light upkeep	Documentation maturity; mature risk registers and site planning files shorten this work
Facility change assessments	Facilities, security and risk staff reviewing relocations, expansions or new hazards nearby	Recurring, triggered by events	Frequency of site changes, acquisitions and new tenants in shared buildings
Annual review of site hazards in the risk strategy	Risk management and facilities staff	Recurring, typically annual under your own policy	Number of sites in scope and how many hazards each one carries
Evidence upkeep	Internal document owners, with time spent keeping site planning documents, risk records and mitigation strategy current	Recurring	How many documents must be kept in sync and where they are stored
Auditor or assessor sampling	Independent auditor or assessor, as engaged by the organization	Recurring per assessment cycle	Number of facilities sampled, quality of the evidence trail, and how many open findings need retesting

Who owns PE-23 and what a partner can prepare

The organization owns PE-23 in full. Facilities, risk management, contingency planning and the business owner who accepts residual risk each hold a part of the decision. Facilities staff know the site, its neighbors and its utilities. Risk staff decide how hazards such as flooding, seismic activity, fire, and power or telecommunications dependence feed into the organizational risk management strategy. Contingency planners tie the site to alternate processing and recovery. The business owner signs off on the residual risk, because accepting it is a management decision, not a technical one.

Site selection decision: The organization decides whether to build, buy, lease or keep an existing facility, and documents the reasons.
Hazard identification: Facilities and risk staff record physical and environmental hazards for each candidate or existing site.
Risk acceptance: The named business owner accepts or rejects residual risk in writing.
Contingency links: Contingency planners connect site hazards to recovery and alternate site plans.
Policy alignment: Staff confirm the physical and environmental protection policy and risk strategy reference the same hazards.

Confirm that a named person holds each of these roles and that the risk acceptance is recorded before any assessor is engaged.

Where PE-23 programs usually fall short

PE-23 is short, but programs that satisfy it on paper often fail at the same few points. The gaps below cluster around one question: whether the site decision is revisited as hazards, facilities and dependencies change, and whether someone can show that it was.

Hazards assessed only at build time

Many teams document flood, seismic, fire and power exposure once, when a data center or server room is selected, then never revisit it. Floodplain maps, utility grid conditions, nearby industrial activity and local weather patterns change over time. For PE-23, check that the site planning record has a review trigger, a named reviewer and a date of the most recent review, and that the hazard inputs were refreshed at that review.

Colocation and cloud sites left to others

Organizations that rent colocation space or use a cloud region often assume the provider owns the site hazard question entirely. The provider may own the building, but the organization still decides which facility and region hold its system. Ask for the provider's site hazard documentation, confirm which of it you are entitled to review, and record how your own risk strategy accepts or mitigates what the provider reports.

Risk strategy silent on existing facilities

PE-23 expects hazards at existing facilities to be considered in the organizational risk management strategy, not only in new site selection. A common gap is a risk strategy that describes how new sites are chosen but says nothing about sites already in use. Check whether the strategy names existing facilities, states how their hazards are scored, and links those scores to risk treatment decisions.

Contingency plans that ignore site hazards

Continuity plans often describe failover to another site without asking whether the primary facility's hazards would also reach the alternate. A flood or fire that affects both sites in one metro area is an illustrative example of correlated risk. Compare the contingency plan's assumptions against the hazard analysis for each facility, and confirm that the alternate site was selected with the same hazards in mind.

No owner for the site decision

Site selection often falls between facilities, IT, risk and procurement, so no one is accountable when a facility's hazard profile changes or when a lease renews. Assign a named owner for the site decision and for the risk acceptance that follows it, and write both into the physical and environmental protection policy. Confirm that the owner can require a site review without waiting for an outage to prompt one.

Evidence scattered across facilities and risk tools

Site surveys sit with facilities teams, hazard data sits in spreadsheets, risk scores sit in a GRC tool and contingency plans sit in a document repository. An assessor testing PE-23 has to rebuild the chain from site selection to risk treatment by hand. Agree on one record per facility that links the hazard inputs, the review date, the risk decision and the contingency plan, and make sure each linked artifact can be produced on request.

PE-23 questions buyers ask before hiring help

How much effort does PE-23 facility location take?

For most organizations the effort sits in document review and risk analysis rather than in construction, because PE-23 asks for the site to be planned with physical and environmental hazards in mind and, for existing facilities, for those hazards to be considered in the organizational risk management strategy. The work usually breaks into four parts: collecting the site selection record or the reasoning behind an existing location, mapping hazards such as flooding, seismic activity, fire, power instability and nearby industrial or access risks, checking whether the risk management strategy mentions those hazards, and recording decisions and accepted residual risk. The effort grows with the number of facilities, the number of systems housed in each, and how little of the site history has been written down. Ask the provider to state how many sites, systems and stakeholder interviews the quote assumes.

Can we do PE-23 in-house without outside help?

Yes, in most cases an organization can complete PE-23 itself, because the control is about planning and documented consideration rather than a specialized technical build. The owner of the control is the organization, and the people who make the call are usually facilities, risk management and the system owner. Outside help is most useful when no one on staff has run a site hazard review before, when the risk register does not reflect physical threats, or when the assessor's expected evidence is unclear. A useful split is that the organization owns the decision and the accepted risk, while an implementation partner can prepare the hazard analysis, the documentation package and the evidence trail. DeployOpen prepares systems, controls and evidence for assessments, but it does not issue assessment reports or certifications, which remain the role of independent assessors.

What do facilities and risk teams need to provide for PE-23?

Facilities and risk teams need to supply the material that shows where the system sits and what the site faces. That includes site plans, building and floor layouts, any original site selection or lease due diligence records, documented hazard assessments such as flood, fire and seismic studies if they exist, utility and power feed descriptions, and the current organizational risk management strategy. Risk teams must confirm how physical and environmental hazards are scored and whether they appear in the enterprise risk register. Assessors will look for evidence that the hazards were considered for existing facilities and that the outcome fed the risk management strategy. Ask the implementation partner to publish a document request list before work begins so these inputs are gathered early and not discovered during the assessment.

How long does PE-23 work take and who sets the timeline?

NIST does not give a timeline for PE-23 or for any other control, and it leaves federal implementation timing to OMB Circular A-130. The duration of the work is set by the written scope, which should state the number of facilities, the number of systems per facility, how many records already exist, and how many interviews are needed. A site with a current hazard study and an up-to-date risk strategy can move quickly, while a multi-site estate with no documented site selection history will take longer because the reasoning has to be reconstructed. Ask for a schedule that separates document collection, hazard analysis, risk strategy updates and evidence packaging, and confirm which dates depend on the client's own facilities team and on the independent assessor's calendar.

Does a colocation provider's audit report satisfy PE-23?

A colocation provider's audit report does not by itself satisfy PE-23 for your organization, because the control requires the organization to plan the location of its system and to consider hazards in its own risk management strategy. A provider's report may show that the facility has its own physical and environmental controls, and that information is a useful input to your hazard analysis. However, it does not show that your organization selected the site with those hazards in mind or that your strategy addresses them. Request the provider's report and its scope, identify which hazards it covers, and then record your own assessment and decisions. Confirm with your assessor which provider documents they will accept as supporting evidence, since acceptance is their call.

What should we ask for in a PE-23 quote?

A useful quote states the scope in writing before work starts, and it should list the facilities, systems, documents to be reviewed, hazard categories to be analyzed, interview roles and the deliverables. Ask the provider to name each deliverable, such as a hazard analysis memo, updated risk strategy text, a control narrative for PE-23 and an evidence index mapped to the two determination statements in SP 800-53A. Ask whether the price covers one-time analysis, and whether any follow-up such as periodic review or retainer support is quoted separately. Confirm what the client must provide, what happens if new information changes the hazard picture, and how assumptions are documented. DeployOpen does not publish a price list, and a quote follows from the written scope.

Open-source tooling for PE-23 evidence

PE-23 evidence is mostly documents: site selection records, hazard assessments and risk mitigation decisions. Open-source tooling helps organize that evidence, map it to the control and keep it current, but the organization still owns the analysis and the facility decisions behind it.

CISO Assistant for framework records

CISO Assistant is a self-hosted, AGPL-3.0-only platform that ships more than 200 frameworks, including NIST frameworks, and can hold risk and assessment records. It maps requirements automatically across frameworks, so a site selection record can be linked to PE-23 and related controls such as CP-2 and RA-3. Confirm which NIST SP 800-53 Release 5.2.0 content and which facility-level fields your installed version supports before you build the workflow around it.

Facility hazard register

A hazard register records each natural and man-made hazard considered for the site, such as flood, seismic activity, fire, power instability and nearby industrial sources, with its likelihood, impact and the decision taken. Keep it in a version-controlled or access-logged store so assessors can see when the analysis was done and who approved it. Open-source spreadsheets and GRC records can serve this purpose, but the hazard inputs must come from your own site survey and external data.

Site selection and siting records

Assessors examine physical site planning documents, so store the siting decision with its drawings, floor plans and the reasons components sit where they do. Link each record to the system inventory so it is clear which components are housed in which location. Confirm with your facility team that the records are updated after moves, expansions or rack changes.

Risk management strategy linkage

For existing facilities, PE-23 requires the hazards to be reflected in the organizational risk management strategy, so the hazard register must feed the enterprise risk register. Use a tool that lets one hazard be referenced from the risk strategy, the contingency plan and the risk treatment record. Confirm that your tool keeps a traceable history of those links.

Contingency plan cross-references

Several related controls, including CP-2 contingency planning and PE-18 location of system components, depend on the same site hazard findings. Maintain cross-references so that a change in hazard status updates the contingency plan and component placement review. Test that the cross-references survive exports, since assessors often request them as separate documents.

Interview and assessment readiness

The SP 800-53A procedures for PE-23 include interviews with personnel who select sites and manage risk mitigation. Keep a short roster of those owners, their responsibilities and the records they maintain, so the examination can be answered quickly. A self-hosted tool can track owner assignments and review dates, but the interviews themselves must be prepared by your staff.

How PE-23 relates to CP-2, PE-18 and RA-3

PE-23 decides where the facility sits, PE-18 decides where system components sit inside that facility, and the two are linked by the hazards both controls are meant to reduce. Read together, they describe a chain: the site is chosen with physical and environmental hazards in mind, then equipment is placed within the building to limit exposure to the hazards that remain. For an existing facility, PE-23 asks that those hazards be reflected in the organization's risk management strategy, so the people who decide rack placement, room use and equipment relocation should be working from the same hazard picture as the people who chose the site. Confirm who owns each decision in your organization, because site selection often sits with real estate or facilities while component placement sits with IT operations.

PE-18 is the only PE control that the SP 800-53B high baseline allocates on its own, and it covers the placement of system components within a facility to reduce damage from hazards and opportunities for unauthorized access. PE-19 (information leakage) and PE-20 through PE-22 are sibling controls outside the baselines, so their presence in a site review depends on your tailoring decisions rather than on the baseline. PM-8 and PM-9 sit at the program level, where the critical infrastructure plan and the risk management strategy that PE-23 refers to are documented. An illustrative check: if a data hall sits beneath a water main or in a flood zone, PE-23 is the control that should have surfaced the issue, and PE-18 is where racks and power equipment can be moved to limit the impact.

CP-2 (contingency plan) and RA-3 (risk assessment) are the controls that consume the hazard analysis. A contingency plan that assumes the facility can be lost needs the site hazards to name realistic recovery scenarios, and an assessor testing PE-23 will look for those hazards in the organizational risk assessment and the contingency plan documentation. The 800-53A assessment objects for PE-23 include site planning documents, the organizational assessment of risk and the contingency plan, which is why the same hazard record should feed all three. SP 800-53A describes PE-23 with two determination statements, so keep the evidence trail short: one site planning record, one risk entry per hazard, and one contingency scenario that cites both. Confirm the exact assessment wording in the CPRT or OSCAL content before you build the evidence matrix, since this page does not state a crosswalk beyond the mapping NIST publishes.

How DeployOpen scopes and prepares PE-23 evidence

DeployOpen prepares the systems, documents and evidence that show how a facility location was planned against physical and environmental hazards, inside your own infrastructure. The organization owns the decision on whether PE-23 applies, and an independent assessor reaches the assessment conclusion.

How we scope

Confirm with you whether PE-23 is in your tailored control set, since no SP 800-53B baseline includes it.
Identify which facilities house the in-scope system and whether each site is new or existing.
Record in the written scope which hazard assessment, site planning and risk strategy documents will be prepared.

How we build

Work with your site selection and risk owners to document hazards considered for each facility housing the system.
Reflect hazards from existing facilities in the risk management strategy and the related risk assessment entries.
Align site planning records with the contingency plan and PE-18 component placement decisions where those apply.

How we hand over

Deliver a documented site planning package that maps each facility to the hazards and mitigations considered.
Provide evidence mapped to the two SP 800-53A determination statements so your assessor can examine it directly.
Document open items, owners and review dates so the evidence stays current after handover.

How we support

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
Ongoing support, reviews and upgrades of site documentation are available as a retainer.
Your independent assessor or auditor issues any report or conclusion; DeployOpen prepares the evidence for that review.