What PE-4 access control for transmission requires in practice
PE-4 requires that physical access to defined system distribution and transmission lines inside organizational facilities be controlled with defined security controls. It applies to the moderate and high baselines only, so a low-impact system does not carry it, but a compliance lead told that PE-4 applies to a moderate or high system should expect to show how cabling in the relevant facilities is protected from damage, tampering and eavesdropping. The risk is concrete: a cut or spliced line can disrupt availability, an altered patch can redirect traffic, and a tapped line can expose data in transit without any change to the system's logical configuration.
The control is hard to satisfy because the cabling is often not owned by the system owner. Facilities teams may control the building's risers and ceiling trays, telecom or network carriers may run circuits into a suite, and the security team may never have walked the path from a server rack to the demarcation point. Start by asking who holds keys to each wiring closet and cable pathway, who approves new drops, and whether anyone has a current diagram of where the system's lines run. Those answers usually decide whether the control can be evidenced at all.
The NIST discussion uses a few illustrations: locked wiring closets, disconnected or locked spare jacks, cabling protected by conduit or cable trays, and wiretapping sensors. These examples are not a checklist, and an assessor will ask whether the controls you chose fit the risk of your facility. Confirm the exact defined controls in your system security and privacy plan with your assessor before you buy hardware or change a closet lock, because the parameters are set by your organization rather than by the example list.
Which cabling, rooms and third parties PE-4 reaches
PE-4 is parameterized, so the organization decides which transmission lines and rooms fall inside the control. The decisions below set how much cabling, how many rooms and which third parties the control reaches, and they should be documented before anyone estimates effort. PE-4 is not in the low baseline and not in the privacy baseline, so these decisions matter most for moderate and high systems.
Defining the lines in scope
Start by naming which distribution and transmission lines count as in scope for the system, such as links between server rooms, runs to the patch panel serving the system, or cabling to field devices. The NIST discussion points to examples including locked wiring closets, cabling in conduit or cable trays, and disconnected or locked spare jacks. Record the definition in the system security plan so an assessor can trace each control decision to a defined boundary. Confirm whether lines leaving the facility to other sites are included.
Owned versus colocated facilities
Where the organization owns the building, it controls the wiring closets, risers and ducts directly. In a colocation facility, the provider usually controls the room, the cage and the building risers, so the organization's PE-4 work narrows to its own racks, cross-connects and locked cabinets. Ask the provider for its physical security description and for evidence of how it protects distribution paths, then decide which part of PE-4 the organization must document itself.
Cabling in shared buildings
In multi-tenant buildings, risers, shared telecom rooms and landlord-owned conduit may carry the system's cables alongside other tenants' lines. Map where each run physically passes, identify who holds keys or badges to those spaces, and decide whether the organization can protect the path itself or must rely on the building owner. Agreements with the landlord or carrier should state who grants access and how access is logged.
Carrier and provider controls
Carriers, internet exchanges and colocation providers often operate the physical distribution paths between sites and the customer. Determine which transmission segments the provider controls, then confirm through contract terms and reports what physical protection the provider applies. The organization still owns the control outcome for the system, so the gaps in provider coverage must appear in its plan of action and milestones or in an agreed inheritance statement.
Baseline applicability check
PE-4 is allocated to the moderate and high baselines only, and it is not part of the low baseline or the privacy baseline. Confirm the system's impact level before scoping this control, because a low system does not require PE-4 unless the organization chooses to adopt it or a contract requires it. Tailoring decisions should be recorded with their rationale so an assessor can see why the control was included or excluded.
Related controls to coordinate
Several related controls shape how PE-4 is met, including PE-2 and PE-3 for physical access, PE-9 for power cabling, SC-7 and SC-8 for boundary protection and transmission confidentiality, and MP-2 and MP-4 for media. Assign owners for each shared item so the same cable run is not documented three different ways. Confirm the ownership split with the assessor early, since shared evidence is easier to accept when its scope is written down.
How an assessor tests PE-4 under SP 800-53A
This table breaks down the single SP 800-53A determination statement for PE-4 by assessment method, showing what an assessor examines, interviews and tests, the evidence each step asks for, and the gaps that most often appear. Read each row as one line of the assessor's work plan, and use the evidence column to prepare files before fieldwork starts.
| Assessment method | What the assessor examines or tests | Evidence requested | Common findings |
|---|---|---|---|
| Examine: procedures | Written procedures addressing access control for transmission mediums inside the facility, including who may open wiring closets and how spare jacks are secured | Current PE-4 procedure, approval record and review date, plus the link to the physical security procedures under PE-1 | Procedure exists but does not name the cabling, closets or jacks it covers |
| Examine: wiring diagrams | Facility communications and wiring diagrams that show where distribution and transmission lines run and which segments serve the system | Current floor and riser diagrams, labeled closets, and a record showing when the diagrams were last reconciled with installed cabling | Missing or outdated wiring diagrams, or cabling that does not match the drawings |
| Examine: safeguard list | The list of physical security safeguards applied to system distribution and transmission lines, such as locks, conduit, cable trays and tamper sensors | Inventory of safeguards by location, with installation records or photographs and the owner of each safeguard | Safeguards listed but not present, or present but not inventoried |
| Interview: physical access control staff | Personnel with physical access control responsibilities, asked how they issue keys or codes for closets and how they respond to a tamper alarm | Named roles and responsibilities, key or access device logs, and a record of who was trained on the closet procedure | Staff cannot describe the closet process, or keys are held by people outside the documented roles |
| Test: access control processes | Organizational processes for controlling access to distribution and transmission lines, observed in operation, for example a closet opened on request | Sample access requests, approvals, entry logs and a walk-through of a locked closet and a capped spare jack | Processes exist on paper but are bypassed in practice, such as propped doors or shared combinations |
| Test: undocumented cabling | Whether cabling carrying system traffic can be traced to a documented route and protected segment | Cable labeling records and a sample trace from a patch panel to the protected area | Cabling added during projects that never reached the diagrams |
| Test: unlocked closets | Whether wiring closets and spare jacks are locked or disconnected when unattended | Walk-through notes with dates, and any tamper or door alarm logs for the closets | Closets found unlocked or jacks live and unused in an open area |
| Determination outcome | Whether the organization meets the single PE-4 determination statement for the system's baseline | Assessment report entry for PE-4 with findings, evidence references and any plan of action and milestones item | Findings recorded without a remediation owner or completion date |
Implementing PE-4 in six steps
This sequence turns PE-4 from a policy statement into a tested set of facility controls, with a documented inventory of transmission lines, owners who answer for them, and records an assessor can examine. Each step produces an artifact that the next one depends on.
Define the lines and rooms in scope
Start from the cabling and wiring diagrams for each facility that houses the system, and list every distribution and transmission line that carries system traffic or power-adjacent signaling between rooms, floors and buildings. Record the wiring closets, patch panels, spare jacks, conduit runs and cable trays that each line passes through. Confirm the list with facilities staff, since diagrams often lag behind changes. The output is a scoped inventory of line segments and the rooms that contain them, approved by the system owner.
Document safeguards for each line segment
For every segment in the inventory, record the physical safeguard that protects it: a locked wiring closet, disconnected or locked spare jacks, conduit or cable trays, or wiretapping sensors where the defined risk calls for them. Note where a segment has no safeguard and why, and decide whether to add one. The output is a safeguard register keyed to segment IDs, which becomes the core of the examination evidence the NIST assessment objects describe.
Assign owners across facilities and telecom
Name one accountable owner for each facility and one for the telecommunications or network cabling function, and write down who maintains locks, keys, closet inspections and sensor alerts. Facilities usually controls the physical space, while telecom or the network team controls the cable plant, so the boundary between them needs a written agreement. The output is a responsibility matrix signed off by both teams, linked to the policy and procedures required under PE-1.
Align access lists with PE-2 and PE-3
Check that the people who can open wiring closets and reach spare jacks appear on the authorized access list maintained under PE-2, and that entry to those rooms is enforced through the mechanisms described under PE-3. Remove cabling-room keys and badge rights that no longer match a current role, and inventory physical keys and combinations for each closet. The output is a reconciled access list for transmission areas, with a record of each exception and its approver.
Set up monitoring and inspection records
Define how the safeguards are checked: scheduled closet inspections, review of door alarm or badge logs for transmission rooms, and alert handling for any wiretapping sensors. Decide who receives alerts, how a tamper finding moves into incident response, and how each inspection is recorded. Confirm the inspection frequency with your own policy, since the researched facts do not set one. The output is an inspection schedule, a log template and a documented alert path.
Collect evidence for the assessor
Assemble the artifacts an independent assessor will examine and sample: the procedures for access control to transmission lines, the cabling and wiring diagrams, the safeguard register, the access reconciliation, inspection logs and a record of any tamper events and their handling. Interview the owners so they can explain the process in their own words, and run a walkthrough of one closet or conduit path to confirm the records match the physical reality. The output is an evidence package indexed to PE-4, which the assessor uses to determine whether the control is met.
How conduit, locked closets and tamper sensors fit together
The main design decision behind PE-4 is that no single safeguard protects transmission lines on its own. Physical barriers slow down someone who wants to reach a cable, disconnection removes the easiest way in, and sensors reveal an attempt that gets past the first two layers. Start by mapping where the distribution and transmission lines run inside each facility, from the wiring closet to the patch panel to the desk, and mark which segments pass through areas that people without authorization can reach, such as shared corridors, ceilings or raised floors. Those segments decide where the barriers and sensors go. The defined scope of PE-4 is set by the organization, so the boundary you document here is the boundary an assessor will test against.
In practice the layers stack in a fixed order. Locked wiring closets and cable trays keep cabling out of reach, and conduit protects runs that must cross uncontrolled space. Unused wall jacks should be disconnected or locked at the patch panel, because a live spare jack is the simplest point of access to a network segment. Tamper or wiretapping sensors cover the runs that remain exposed and alert personnel to a break in the path. Consider how these layers meet the related controls. PE-9 covers protection of power equipment and power cabling, which often shares the same pathways, so a conduit or tray decision should be made once for both. SC-8 addresses protection of transmitted information in the network, so physical protection in PE-4 supports, but does not replace, the cryptographic and integrity measures that SC-8 requires. Confirm with your own engineering team which runs carry sensitive traffic before deciding how much of the physical layer needs sensing.
Decisions to record and review include the list of protected segments, the disconnection procedure for spare jacks and who may reactivate one, the alert path from any sensor to a monitored response team, and the test that shows a sensor fires as intended. Each of these becomes evidence an assessor can examine, so keep the wiring diagrams, the physical safeguard list and the change records together and current. Ask any vendor of sensors or locks to state in writing what the device detects, how it reports and what maintenance it needs, because the performance you can claim depends on those specifics, not on the product category.
Evidence that passes a PE-4 review
An assessor testing PE-4 checks whether the organization can show where its distribution and transmission lines run, who can reach them, and how those protections are watched. The cards below cover the records that prove this and the routines that keep them accurate between assessments.
Cabling and wiring diagrams
Current diagrams show which wiring closets, conduit runs, cable trays and spare jacks serve the system, and they are the first thing an assessor compares against the facility. Check that each diagram shows routes between rooms, not just logical network topology, and that it names the physical security safeguard on each segment. Ask who signs off on revisions and when the diagram was last walked against the building.
Inventory of distribution lines
A register of transmission paths, closets and unused jacks gives the assessor a population to sample from. Each entry should record the location, the protection applied (locked, conduit, disconnected or sensored), the owner and the systems it carries. Gaps between this inventory and the diagrams are a common finding, so reconcile the two during each review cycle.
Lock, key and closet access lists
Access lists for wiring closets and spare-jack areas should match what the key or badge system actually grants. Keep a record of who holds keys or credentials, when they were issued and when they were returned or revoked. Compare the list against the facility's physical access authorizations so that a person removed from one register does not remain in the other.
Wiretap sensor configuration and alert logs
Where sensors detect tampering on cabling, the configuration file, alert thresholds and escalation contacts are evidence in their own right. Keep logs of alerts, how each was triaged and whether it fed into incident response. Confirm which sensor types are deployed, since the control text names wiretapping sensors only as an example of protection.
Inspection records
Dated walk-through records show that someone checked closet doors, locks, conduit seals and unused jacks against the diagram. Record what was found, what was corrected and who verified the correction. A schedule with completed entries is more persuasive to an assessor than a policy that states inspections happen.
Change tickets for cabling work
Every new run, relocated closet or re-activated spare jack should trigger a change ticket that updates the diagram and inventory before the change closes. Tickets that show approval, physical verification and a diagram revision let an assessor trace a change from request to record. Ask whether contractors who pull cable are bound to the same process.
What meeting PE-4 costs in money and effort
This table breaks down the cost and effort components of meeting PE-4, showing who is paid for each, whether it is one-time or recurring, and what drives it up or down. No figures are given because NIST does not estimate costs and no supplied fact sets prices, so use the table to build your own quote requests and internal estimates.
| Cost component | Who is paid or who spends effort | One-time or recurring | What drives it |
|---|---|---|---|
| Locks, closets and spare jack protection | Hardware vendor and facilities or installation contractor | One-time, with replacement over time | Number of wiring closets, spare jacks and door types in scope |
| Conduit, cable trays and cable routing | Electrical or structured cabling contractor | One-time for new runs, recurring for changes | Age and layout of cabling, how often moves and adds occur |
| Wiretapping or tamper sensors | Sensor vendor, integrator and monitoring staff | Purchase one-time, monitoring and alert handling recurring | Number of sensed segments and whether alerts route to a monitored queue |
| Facilities labor for access reviews and keys | Internal facilities team or colocation operator | Recurring | Number of facilities, key holders and frequency of access list reviews |
| Wiring diagrams and cable inventory | Internal network or platform engineering, or an implementation partner | One-time build, recurring updates | Size of the cable plant and how often changes are made without records |
| Procedures and evidence upkeep | Compliance lead and system owners | Recurring | Number of facilities and systems covered, and how evidence is stored |
| External testing of physical controls | Independent tester or assessor engaged by the organization | Recurring per test cycle | Scope of facilities, physical testing rules and remediation rounds |
| Auditor sampling of transmission controls | Independent assessor, paid by the organization | Recurring per assessment | Number of locations sampled and quality of ready evidence |
| Colocation or hosted facility terms | Colocation provider, with cross-connect or cage fees set in contract | Recurring | Whether the organization controls the cage, shared distribution and contract access rights |
Who owns PE-4, who prepares the evidence and who assesses it
Your organization owns PE-4. The control requires physical access to defined distribution and transmission lines inside your facilities to be controlled, so the decisions about which lines are in scope, which safeguards apply and who may enter the spaces that hold them belong to you. Those decisions usually sit with the security office working alongside facilities management and telecom or network operations, because the wiring closets, conduit runs and spare jacks are typically managed by those groups rather than by IT alone.
- Scope decisions: Define which distribution and transmission lines are covered, using the system boundary from your security plan.
- Facilities coordination: Facilities and building management control locks, card readers, conduit routes and cable tray access, so their cooperation is required for any change.
- Telecom and network ownership: Network operations confirm how spare jacks, patch panels and fiber runs are actually used and who approves changes.
- Risk acceptance: Any safeguard you decide not to apply, or any gap you carry on a plan of action and milestones, is an organizational decision that needs documented sign-off.
- Ongoing operation: Access lists, key control and closet inspections continue after any outside work ends.
Before engaging anyone, confirm in writing who in your organization holds accountability for PE-4 and who will sign the evidence.
An implementation partner helps your team prepare what the assessor will examine. For PE-4, that usually means building the diagrams and inventories that show where transmission lines run, documenting the safeguards in place, and assembling an evidence pack that matches the assessment objects in NIST SP 800-53A. DeployOpen works in this role. It prepares systems, controls and evidence for an assessment, but it does not issue assessment reports or certifications, and it does not decide the control's scope or accept its residual risk.
- Diagrams and inventories: Facility communications and wiring diagrams, along with lists of the lines, closets and spare jacks in scope.
- Safeguard documentation: Descriptions of locks, conduit, cable trays and wiretapping sensors, with the procedures that govern them.
- Evidence packs: Organized records such as access logs, inspection records and change tickets, mapped to the examine, interview and test items.
- Fixed scope in writing: Deliverables, boundaries and timelines agreed before work begins, so you know what is and is not included.
- Handover: Documentation your staff can maintain after the engagement closes.
Ask any partner to state in writing which deliverables it prepares and which it will not sign or issue.
The independent assessor examines the control, interviews the people who run it and tests whether the processes work as documented. Under SP 800-53A, PE-4 is assessed against one determination statement using the examine, interview and test methods. The assessor, not your team or any partner, decides whether the control is satisfied and issues the findings. In a federal context, Inspectors General or an authorizing official may play this role, as described in NIST's risk management guidance. In other contexts, the assessor is whoever your contract, regulator or framework names.
- Examine: Procedures for access control to transmission mediums, wiring diagrams and the list of physical safeguards.
- Interview: Staff who hold physical access control responsibilities for the closets and spaces in scope.
- Test: Whether access processes to distribution and transmission lines work in practice, such as sampling access records.
- Findings and reports: The assessor documents results; your organization decides how to respond to them.
- Independence: The assessor should not design or prepare the controls it tests.
Confirm the assessor's qualifications and independence with the party requiring the assessment before fieldwork is scheduled.
Where PE-4 programs usually fall short
PE-4 failures rarely come from missing policy. They come from cabling records that no longer match the building, live ports nobody owns, and sensors that report to nobody. The cards below cover the gaps assessors most often find and the concrete step that closes each one.
Cabling diagrams that predate renovations
Wiring diagrams are the first document an assessor examines for PE-4, and they are often years out of date after a floor is reconfigured or a closet is moved. A diagram that omits a riser or a patch panel makes it impossible to show which transmission lines are protected. Check diagrams against a physical walkthrough, record the date of each revision, and assign one owner who updates them after every change request that touches cabling.
Spare jacks left live
Unused wall jacks and open ports in occupied rooms let anyone with a laptop reach the network. PE-4 expects spare jacks to be disconnected or physically locked, so the gap is usually a port that was patched out of a switch but never removed from the wall. Walk the floor plan, compare live jacks against the switch port inventory, and disable or lock every jack with no active owner.
Closets shared with unmanaged contractors
Wiring closets often sit in common corridors or share a room with building services, and contractors may hold keys that nobody in IT has ever reviewed. Access to a closet is access to the transmission medium, so the access list has to be controlled like any other physical access list. Ask who holds keys or badges to each closet, when the list was last reviewed, and whether contractor visits are logged and escorted.
Sensors installed but not monitored
Wiretapping and tamper sensors on conduit or fiber runs are sometimes installed during a project and then left alerting to a mailbox or an unstaffed console. A sensor that nobody reviews gives the organization no evidence that tampering was detected or addressed. Confirm where each sensor alerts, who acknowledges alerts, how alerts feed incident response, and keep records of test activations that show the path works.
No owner for cabling outside the data hall
Data hall cabling usually has an owner, but runs through office floors, ceilings, risers and building-managed spaces often belong to facilities teams, landlords or the telecom provider. When nobody owns those segments, they are the ones left unprotected and undocumented. Assign a named owner for every transmission path that leaves the data hall, write that ownership into the PE-4 procedure, and include building-managed spaces in the inventory an assessor will sample.
Questions buyers ask about PE-4
How much does meeting PE-4 cost?
No supplied figure gives a price for PE-4, and NIST does not estimate compliance costs, so any number you see should be treated with caution. The cost is driven by what the organization must physically change: how many wiring closets, cable runs, conduit sections and spare jacks sit inside the defined scope, and whether the controls are added to existing rooms or to new builds. Recurring costs include access logs, inspections of locks and sensors, and periodic review of cabling changes. Ask any quote to itemize facilities work, locks and sensors, monitoring integration, documentation, and assessment support separately, and to state which items are one-time and which recur.
How long does PE-4 preparation take?
Duration depends on the size of the facility footprint in scope, how well the transmission paths are already documented, and how much physical work is needed before evidence can be produced. Organizations with accurate wiring diagrams and existing locked closets usually need less time than those that must first trace undocumented cabling. Procurement lead times for locks, conduit and sensors, and the scheduling of facilities crews, often matter as much as the technical work. Ask any implementation partner to set out the dependencies in writing and confirm the timeline against your own facilities and telecom schedules before work starts.
What does PE-4 need from facilities and telecom teams?
PE-4 work sits at the boundary between IT, facilities and telecommunications, so each group has a defined role. Facilities teams typically control room access, install locks, conduit and cable trays, and any tamper-detection hardware. Telecom or network teams identify which distribution and transmission lines carry system traffic and where spare jacks and patch panels are located. Security teams decide what is in scope and what evidence the assessor will need. The organization owns the controls; a partner can prepare diagrams, procedures and evidence, but cannot physically secure a building on its own.
Can an in-house team implement PE-4 without outside help?
Often yes, provided the team has facilities authority, current cabling documentation and clear scope. The main risks for an internal team are incomplete inventories of spare jacks and undocumented runs, unclear ownership between IT and facilities, and the time needed to produce evidence that an assessor can examine and test. An internal team should first confirm the defined transmission lines, the controls already in place, and the gaps. Outside help is most useful when the scope is large, when documentation is thin, or when staff need an independent check before an assessment. Confirm the approach against your own environment and your assessor's expectations.
Can an implementation partner prepare the PE-4 evidence?
An implementation partner can prepare the systems, documentation and evidence that an assessment examines, including procedures for access control to transmission mediums, wiring diagrams, inventories of physical safeguards on distribution lines, and records of access processes. DeployOpen prepares systems and evidence for compliance assessments but does not issue audit reports, attestations or certifications; only an independent assessor or certification body does that. Ask a prospective partner to define the deliverables in a written, fixed scope, to show which evidence will be produced, and to state who on your side must sign off on each item.
How does PE-4 relate to other physical controls in the scope?
PE-4 is listed alongside related controls including PE-2, PE-3, PE-5, PE-9, MP-2, MP-4, SC-7 and SC-8, so the evidence for transmission protection often overlaps with physical access authorization, entry control, power cabling and encryption records. Assessors commonly look for consistency across these, for example that the people authorized to enter wiring closets match the access list. Map these overlaps early so one set of diagrams and access records can serve several controls. Confirm the exact allocation and assessment procedures against the current SP 800-53B baseline and SP 800-53A text in your environment.
Does PE-4 apply if our system is only in a low baseline?
No. SP 800-53B allocates PE-4 to the moderate and high baselines only, so a system categorized at the low impact level does not need it under that baseline. Confirm your system's categorization and any tailoring decisions with your authorizing official or compliance lead, because an organization may still choose to apply the control for risk reasons or because a contract requires it.
How DeployOpen scopes PE-4 and prepares evidence
DeployOpen works as an implementation partner for PE-4. Before any work starts, the scope is agreed in writing: which facilities and transmission paths are in scope, which distribution and transmission lines carry the system's traffic, which safeguards are already in place, and which deliverables are expected. Because most engagements are fixed-scope, the written scope also fixes what counts as finished. For PE-4, that usually means agreeing the boundary first, for example the wiring closets, floor distribution panels, conduit runs and spare jacks between the system and the building entry points, since a boundary drawn too loosely leaves gaps an assessor will find.
Within that scope, DeployOpen prepares the systems, documentation and evidence in the client's own facilities and infrastructure. In practice this can include reviewing wiring diagrams and the list of physical safeguards applied to transmission lines, documenting how wiring closets are locked and who holds keys, verifying that unused jacks are disconnected or locked, recording where conduit and cable trays are used, and configuring or documenting any wiretapping sensors the client has chosen. The organization still owns its controls. DeployOpen's job is to make the current state visible and reproducible so the client's staff can operate it after the engagement.
DeployOpen does not issue audit reports, attestations or certifications. Evidence prepared under the engagement is handed to the client's independent assessor, who tests it against the assessment procedure in SP 800-53A and decides whether the control is met. Ask any implementation partner to confirm this division in writing. Ongoing support, periodic verification of physical safeguards and updates to diagrams after changes can be arranged as a retainer, which is a separate agreement from the fixed-scope work. Confirm with your assessor which evidence format and level of detail they expect before work begins.
