PE-5 Access control for output devices: requirements and evidence

What PE-5 access control for output devices requires

PE-5 requires that physical access to output from defined output devices be controlled so that unauthorized individuals cannot obtain that output. In SP 800-53B, PE-5 is allocated to the moderate and high baselines only, not to the low baseline and not to the privacy baseline. If your system is categorized as moderate or high, expect an assessor to ask where printed pages, copies and screen contents go, who can stand in front of them, and what your organization has decided to do about it. The first step is to define which output devices are in scope for your system: the printers, copiers, multifunction devices, monitors and similar displays that receive or render system information. The control only works once that list exists and the organization has written it down.

The control is narrow and procedural. It does not ask for a specific technology, and it does not require a locked room for every device. What it asks is that the organization can show it has thought about the risk and enforces a decision: for example, placing high-sensitivity printers in secured areas, using secure print release so jobs wait at the device until an authorized user badges in, positioning monitors away from windows and public walkways, or requiring screen privacy filters where screens cannot be moved. In shared offices and open floor plans, this is often hard because devices sit in common corridors, and the people who pick up output are not always the people who requested it. Clear placement rules, print release settings and a short list of exceptions are usually easier to defend than an informal habit of collecting pages.

SP 800-53 Release 5.2.0 defines one active enhancement for PE-5, but none of its enhancements is allocated to an SP 800-53B baseline, so an organization at moderate or high does not inherit additional enhancement requirements from the baseline itself. Your tailoring decisions still matter, because the assessment procedure asks for the procedures addressing access control for display media, the facility layout showing where components and displays sit, and the actual displays. Confirm with your authorizing official or compliance lead whether any enhancement is required by your own agreements or overlays before you conclude the control is complete. Print release and placement records, along with the written output device inventory, are the artifacts most likely to be examined.

Which output devices and locations fall under PE-5

PE-5 applies only to the output devices the organization defines, so scope starts with a decision, not a product list. The cards below cover the device types, locations and working arrangements that usually decide whether a printer, copier or display needs controlled physical access.

Defining the device types

Start by naming which output devices count: multifunction printers, copiers, scanners with print paths, large-format plotters, and monitors or displays that show system output. PE-5 is a control the organization scopes for itself, so the definition should be written down and approved, not left to whoever installs the device. Check whether a device holds stored print jobs or cached images, since those features change what an unauthorized person could retrieve.

Mapping the facilities and shared areas

List every room, floor and building where in-scope devices sit, including shared print rooms, corridors, mailrooms and open-plan areas next to the system's users. Output that lands in a public area is the common failure point. Confirm which areas are inside the physical boundary of the system where the outputs are produced, and which are outside it, because the answer decides where access controls must apply.

Deciding on remote and home-office displays

Decide whether staff working from home or other alternate sites are in scope for output devices they use with the system. PE-5 sits in the physical and environmental family, and related controls such as PE-17 address alternate work sites, so the choice should be made with that control in view. Document whether personal monitors, home printers and screens in shared rooms are excluded, allowed under defined conditions, or prohibited for system output.

Setting placement and visibility rules

Once the locations are known, decide what the control requires there: a secured room, a locked output tray, badge-controlled release, or screens positioned away from windows and walkways. Each choice changes who can see or collect output. Note that the chosen placement must be explained in the security plan so an assessor can compare the actual room layout with the stated design.

Handling scope changes over time

Scope drifts when devices are moved, replaced, leased or added to a new floor. Set a rule that any new or relocated output device triggers a scope review before it handles system output. Keep an inventory that records the device, its location and its owner, and link it to the change process so the list an assessor examines matches what is installed.

Confirming scope with the assessor

Ask the assessor or authorizing official to confirm the device definition, the location list and the remote-work position before evidence is collected. Scope disputes found late are costly, because they can force new controls or re-collection of records. Ask for the written scope decision and the criteria used to reach it, since that document is the reference every later test will use.

How an assessor tests PE-5

This table breaks down the single determination statement for PE-5 and the examine, interview and test methods SP 800-53A suggests for it. Read each row as a question the assessor will ask, the people or artifacts they will look at, and the evidence that usually answers it.

Assessment element	What the assessor does	Evidence that usually satisfies it
Determination statement	Confirms the organization has defined which output devices are in scope and that physical access to their output is controlled so unauthorized people cannot obtain it.	A defined list of output devices in scope, plus a written access control approach for each device type or location.
Examine: access control procedures	Reads the documented procedures that address access control for display media, checking they name the devices, the controls and who enforces them.	Current physical security or output handling procedures, with version history and approval records.
Examine: facility layout	Reviews floor plans or site diagrams to see where printers, copiers, monitors and similar devices sit relative to public or visitor areas.	Annotated floor plans or room inventories showing secured areas for output devices and any open-access locations.
Examine: actual displays	Looks at the devices themselves during a walkthrough, checking screen angles, tray locations, secure print settings and whether output is left unattended.	Photographs or walkthrough notes, device configuration exports for secure print release, and observed placement.
Interview: physical access personnel	Asks facility, security and office managers how they control access to output, who may collect printed material and how exceptions are handled.	Named responsible roles, a responsibility matrix, and consistent answers that match the written procedures.
Test: output access processes	Tests whether the process works in practice, for example by checking whether unclaimed print jobs are held, released only after authentication, or purged on schedule.	Test records or logs showing held jobs, release events tied to authenticated users, and handling of unclaimed output.
Common finding: unsecured placement	Output devices in shared corridors or open floor areas with no authentication or collection control.	Remediation record moving devices or enabling authenticated release, with updated layout and test results.
Common finding: undocumented scope	The organization cannot show which devices or display media are covered, so the determination cannot be met.	A current inventory of output devices and their assigned controls, reconciled with the layout review.

Implementing PE-5 step by step

This sequence turns the PE-5 requirement into a documented, assigned and tested set of output controls, so that an assessor can see which devices were in scope, where their output goes and who is responsible for protecting it.

Define the output devices in scope
Start by listing every device that produces physical output from system information: printers, copiers, multifunction devices, plotters, and monitors or displays that show sensitive data in open areas. Record the make, model, location, network connection and the information classes each device may handle. The organization owns this inventory, and the system owner signs off on it. The step is complete when the list is approved and every device has a named owner and a defined scope, so the PE-5 parameter for "defined output devices" is filled in with specific assets rather than a general category. Confirm with your assessor how they expect the parameter to be written.
Map device locations against the facility layout
Obtain current floor plans and mark where each in-scope device sits, who can walk past it, and where visitors and contractors are escorted. Note which devices sit in public corridors, shared open-plan areas or reception, and which are inside restricted zones. Facilities or physical security staff usually own the floor plans, while the platform team supplies the device inventory. The output is an annotated facility layout that shows each device's exposure, which an assessor can compare against the layout they examine under the PE-5 assessment procedure. Keep the map current when devices move.
Place devices in controlled areas or secure release
For each device, choose a control. Preferred options are relocating the device into an area where physical access is already controlled, such as a badge-controlled office or a restricted room. Where a device must stay in a shared space, use controls that keep unauthorized people from collecting output, such as secure print release that requires the user to authenticate at the device, and position monitors so that screens are not visible to passersby. Document each choice and the reason for it. The step is complete when every in-scope device has either a controlled location or a documented release or screen control, and the configuration is recorded in the system security and privacy plan or its equivalent.
Document the output control procedures
Write the procedures that operate the controls: how users release print jobs, who may move or reconfigure a device, how uncollected output is handled and destroyed, and how screen placement is checked. Tie each procedure to a device or location from the earlier steps. The output is a dated, versioned procedure that the responsible owner has approved. Assessors examine these procedures directly, so they should name roles and systems rather than generic practices. Where the system is built on self-hosted print or document services, record the configuration settings that enforce release, since those settings are part of the evidence.
Assign responsibility for each control
Name one accountable owner for each output device and each procedure, and a backup for each. Typical owners are the facilities team for physical placement, the IT or platform team for print release and device configuration, and the security team for periodic checks. Record the assignments in a responsibility matrix that matches the physical and environmental protection policy. The step is complete when each in-scope device and procedure has an owner who has accepted the role in writing, which gives an interviewing assessor a clear person to speak to.
Train staff on output handling
Brief the people who use, administer and secure the devices on the procedures, including how to collect output promptly, how to report unattended sensitive output, and how to avoid leaving screens exposed. Schedule the briefing for new starters and repeat it when procedures change. Keep attendance records and the training materials. Because the PE-5 assessment includes interviewing personnel with physical access control responsibilities, the records show that the people named in the responsibility matrix understand their role.
Test the controls and collect evidence
Test the controls as an assessor would: confirm that a print job cannot be released without authentication, check that device placement matches the approved layout, and observe whether screens in open areas can be read from public spaces. Record the test date, the tester, the result and any corrective action. Store the evidence with the procedures, the layout map, the responsibility matrix and the training records. An independent assessor, not the implementation partner, decides whether the evidence satisfies PE-5. Confirm the evidence format and the sample the assessor will request before testing begins.

How secured placement and release controls satisfy the requirement

PE-5 is satisfied by controlling who can reach output, and the organization chooses the mechanisms that do this. For printers, copiers, monitors and similar devices, the practical options fall into a few groups. The first is placement: locating devices in a secured or monitored area, such as a room that requires the same badge access as the workspace around it, so that people without authorization cannot walk up to an output tray. The second is release control: badge-gated print release or pull printing, where a job is held in a queue until the owner authenticates at the device. Neither mechanism works on its own for every output type, so the organization should map each device class to the mechanism it relies on and record that mapping.

Other mechanisms address displays and paper handling. Screen orientation, privacy filters and positioning of monitors keep on-screen information from being read by passersby, and clearing output trays at set intervals or after sensitive jobs reduces the chance that finished pages are left behind. Each of these needs a written rule. For example, an illustrative policy might say that devices printing restricted records must sit in a monitored room, that jobs from those devices require badge release, and that trays are checked at the close of each business day. The assessment procedure looks for the procedures that address this access, the facility layout that shows where devices sit, and the actual displays, so the rule should match what the floor plan and the device setup show.

Before relying on any of these mechanisms, confirm in your own environment that each one does what your documentation says. Ask the device and print management vendors which release methods their products support, how holding and authentication actually behave when a user is absent or the network drops, and what logs they keep. Walk the floor, test a release from an unauthorized account, and record the result. Vendor documentation describes intended behavior, so your test results and configuration exports are the evidence an assessor will need to see.

Evidence that passes a PE-5 assessment

An assessor testing PE-5 looks for proof that output devices are identified, placed where unauthorized people cannot reach their output, and governed by written procedures. The cards below cover the artifacts that prove each part, and how to keep them accurate between assessments.

Defined output device inventory

Start with a list of every printer, copier, multifunction device and display that the organization has defined as in scope for PE-5. The inventory should record make, model, asset tag, physical location, the data classification each device may handle, and the owner responsible for it. Assessors use this list to pick devices for sampling, so a device missing from the inventory is a finding even if it is well protected. Check the list against asset discovery output and procurement records at least as often as you review it.

Facility layout diagrams

Floor plans or room diagrams should show where each in-scope output device sits relative to doors, public corridors, open workspaces and staff areas. Mark the controlled areas and the access points that protect them. Assessors compare these drawings with what they see on a walkthrough, so an out-of-date diagram after a desk move will weaken the rest of your evidence. Keep the diagrams under change control alongside the device inventory.

Output access control procedures

Written procedures should state how output from each device type is protected, for example by placing devices in secured areas, requiring badge or PIN release at the device, or limiting who can collect jobs. The procedure should name who owns the control and how exceptions are approved. Assessors examine this document first, so align its wording with the device inventory and the configured behavior. Confirm that the procedure is reviewed on the schedule your policy sets.

Print release and badge configuration exports

Where release-on-badge or secure print queues protect output, export the configuration from the print management platform and the device settings that enforce it. Retain the export with a date, the device identifiers, and the policy that assigns users to release rules. This shows that the control is set up as written, not just described. For self-hosted print servers, record the version and the configuration files that define the release behavior so the export can be reproduced.

Sampled observations and interview records

Assessors test PE-5 by observing devices in person and interviewing personnel who manage physical access and output. Keep a record of each observation with the device, the time, the people present, and what was seen, such as whether unattended output sat in a shared tray. Record interviews with the role, the date, and the answers that confirm the procedure is understood. Retain these records as dated evidence, because a single old walkthrough will not show the control works now.

Change records when devices move

Each time a device is relocated, replaced or reconfigured, a change record should update the inventory, the layout diagram and the release settings together. Include who approved the move, the old and new locations, and the date the access controls were verified in the new position. Ask your team to confirm that moves made by facilities or vendors also trigger this record, since those moves are a common source of gaps. Review these records between assessments to catch devices that moved without a change ticket.

Who owns PE-5 and what an implementation partner handles

The organization owns PE-5 and remains accountable for it. Its leadership decides which output devices are in scope, such as printers, copiers, monitors and similar equipment that can produce or display system information, and where those devices may be placed. Facilities and security staff then translate those decisions into rules that people follow every day. The organization also decides whether any output requires a stricter approach than the default placement, based on what the system processes.

Device definition: Maintain a list of the output devices that fall under PE-5, with location and the kind of information each can produce.
Placement decisions: Decide which devices sit in secured areas, which can stay in shared spaces, and who may collect printed or displayed output.
Procedures: Write and approve the procedures that govern output handling, including how staff retrieve print jobs and how unclaimed output is disposed of.
Facilities coordination: Give facilities staff the authority and instructions to enforce placement and to report changes to the layout.
Ongoing ownership: Review the device list and procedures when office layouts, equipment or system classifications change.

Confirm that the device list, procedures and placement decisions are approved by a named owner and that facilities staff can produce them on request.

Where PE-5 implementations usually fail

PE-5 fails less often on the technology than on the boundaries around it: which devices count, where they sit, who can reach their output, and whether anyone can show the control works. Each card below names one gap an assessor is likely to probe, with the action that closes it.

Output devices never defined

The control asks for physical access to output from defined output devices to be controlled, so an undefined list leaves the control with nothing to test. Printers, copiers, multifunction devices, large-format displays and shared monitors often get added over time without anyone updating the scope. Close the gap by naming each device class and each device in the system security plan, with its location and the output it can produce. Confirm the list against the asset inventory, not memory.

Devices in open corridors

A printer beside a lift lobby or a monitor visible from a public walkway lets anyone who passes take what is printed or displayed. Assessors look at the facility layout and the actual device positions, and they expect the layout to reflect where sensitive output is produced. Walk the floors where the system's output is handled and note every device that can be reached without passing an access point. Move devices into secured areas or add controls such as locked output trays and screen privacy measures where relocation is not possible.

Home-office displays left out of scope

Staff who work from home often print or view system output on personal equipment, and that output can leave the controlled facility entirely. The control covers output devices defined for the system, so an organization that excludes remote work from its boundary must still show how it decides that. If remote output is allowed, the alternate work site rules and PE-17 controls need to say which devices are permitted. Ask whether remote staff can print or view system data, and document the answer either way.

No evidence of operating procedures

Assessors examine the procedures that address access control for display media and test whether staff follow them. A device that is properly placed but has no written procedure, or a procedure no one has read, gives an assessor little to accept. Interviews with the people who manage printing and facility access often reveal the gap quickly. Write the procedure, assign an owner, record its approval, and keep dated examples such as signed-off device relocations or screen-lock settings that show it in use.

Print release configured but untested

Secure print release holds jobs until the user authenticates at a device, which can satisfy output control when it is set up correctly. Settings drift, however, and a queue that releases jobs to the wrong device or lets a job wait without a PIN may pass unnoticed for months. Assessors test the process, not the intent, so ask for a test that sends a job from an authorized user, confirms it is held, and confirms that a second person cannot release it. Repeat the test after firmware updates and print server changes, and keep the results.

Output ownership split across teams

Facilities teams control rooms, IT controls printers, and business units often buy departmental multifunction devices without telling either team. When no single owner holds the device list, the control can look satisfied in one area while a forgotten copier in another area still produces sensitive output. Assign one accountable owner for the output device inventory and require that new device purchases and moves go through that owner. Reconcile the inventory against procurement records and network discovery at a set interval.

PE-5 questions buyers ask before hiring help

Does PE-5 apply to low impact systems?

No. SP 800-53B allocates PE-5 to the moderate and high baselines only, so a system categorized as low impact does not need PE-5 in its baseline. It is also not part of the privacy baseline. Before you rely on that, confirm the impact categorization of the system in its security plan, because a moderate or high categorization brings PE-5 into scope even if the system feels small. Your organization may still choose to protect printed output for other reasons, but that is a risk decision, not a baseline requirement.

What does PE-5 work cost, and what drives the price?

No fact supplied for this topic gives a price or budget for PE-5 work, and DeployOpen does not publish a price list. The main cost drivers are the number of output devices in scope, whether devices must move into secured rooms or get locked output trays and badge release, how many floors and rooms the facility has, and how much evidence the assessor will expect. Work that is largely procedural costs less than physical changes. Ask for a written, fixed scope that lists each device, each change to be made, the evidence to be produced and what the organization must provide itself, such as facilities staff and access badges.

How long does PE-5 take to put in place?

Duration depends on device count, facility layout and whether physical changes are needed. Moving or securing a handful of printers on one floor is a different job from re-planning output paths across a multi-building campus. No researched timeline is available for this control. Ask any partner to break the schedule into inventory, design, physical changes, procedure updates and evidence collection, and to name which steps depend on facilities, building management or vendors. Ask what happens if a device arrives late or a room needs construction.

Can our own staff implement PE-5 without outside help?

Often yes, for small environments. A capable facilities and security team can inventory output devices, decide which must be placed in controlled areas, adjust print release settings, and write the procedure. The harder parts are usually consistency and proof: a control must be demonstrated for the whole assessment period, not just on the day it was set up. Consider outside help if devices are spread across many sites, if facilities and IT do not share ownership, or if the assessor will test the processes closely. Be clear internally about who owns the control, because the organization owns its controls even when a partner prepares the evidence.

What does the team need to supply for PE-5?

The work needs a current inventory of output devices, floor plans showing where each device sits relative to the people who can reach it, the list of defined output devices in the system documentation, and a named owner in facilities and security. It also needs access to the people who handle print and display output, so procedures match real practice. Expect to supply existing physical security procedures, the PE-2 and PE-3 access lists if they are relevant, and records of past output incidents. Confirm these inputs in writing before work starts.

Can a partner issue the PE-5 assessment or certify our compliance?

No. DeployOpen prepares systems, controls and evidence for assessment, but it does not issue audit reports, attestations or certifications. Under a NIST-based program, the assessment is performed by the assessor your authorizing or contracting body accepts, and an authorization decision belongs to the official the organization designates. The assessor examines procedures and facility layouts, interviews people with physical access control duties, and tests output-control processes against the SP 800-53A procedure for PE-5. Confirm with the contracting body which assessor it accepts before you engage anyone.

What evidence should we expect an assessor to ask for?

An assessor working from SP 800-53A examines procedures that address access control for output devices, the facility layout of system components, and the actual displays and output devices in place. They interview personnel with physical access control responsibilities and test the processes that govern output access. Prepare a device inventory with locations, the written procedure, configuration records for secure print release or locked output trays if used, photographs or floor plans, and records showing the procedure was followed. Ask your assessor to confirm the exact evidence they will accept.

How DeployOpen scopes and prepares PE-5 evidence

DeployOpen approaches PE-5 as a bounded piece of physical security work inside the client's own facilities. We prepare the controls, records and evidence an independent assessor would examine, while the organization keeps ownership of its controls and the assessor issues any conclusion.

How we scope

Confirm which output devices are in scope, such as shared printers, copiers, scanners and monitors in areas that process system data.
Record the facilities and rooms where those devices sit, and whether the system's impact level brings PE-5 into the moderate or high baseline.
Agree in writing which PE-5 evidence we will prepare, which sites are covered and what the organization still has to produce itself.

How we build

Review device placement against the facility layout and recommend moving or enclosing output devices in areas where unauthorized people could reach them.
Configure secure print release or badge-based pickup where the chosen platform supports it, and confirm that capability with the vendor before committing.
Test that output cannot be collected by people without authorization, and record the test steps and results for the assessor.

How we hand over

Deliver documentation of the procedures for controlling access to output devices, mapped to the PE-5 determination statement and its assessment objects.
Provide a facility layout and device inventory showing where each in-scope output device is located and who can physically reach it.
Transfer configuration records, test results and open items to the client's compliance owner, who decides what goes to the independent assessor.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, for example when new printers or monitors are added to secured areas.
Re-check output device placement after office moves, equipment refreshes or changes to the PE-2 and PE-3 access processes that govern the same rooms.
Confirm with the client's assessor which evidence format they expect before each assessment cycle, since assessors decide what they accept.