PE-9 Power equipment and cabling: requirements and evidence

What PE-9 asks for and why power loss is a security problem

PE-9 requires the organization to protect power equipment and power cabling for the system from damage and destruction. If your system is categorized at the moderate or high baseline, your assessor will expect to see this control in the audit, because SP 800-53B does not include it at the low baseline. The control is narrow in wording but broad in practice: it covers the uninterruptible power supplies, generators, power distribution units, switchgear and the cabling that feeds your racks, wherever that equipment sits and whoever maintains it. Power failure is usually treated as an availability problem, and it is one, but it is also an integrity problem. A sudden loss of power can corrupt data in flight, leave storage arrays partially written, or force systems into unclean shutdowns that break transactions and logs. Damaged or poorly routed cabling can cause intermittent faults that look like application errors, and a fault in a power path can spread to several systems at once. An incident caused by a failed circuit may therefore show up first as a database or audit log problem, which is why the root cause often gets missed.

The work is hard to assign because it sits between teams. Facilities or electrical engineers usually own the switchgear, generators and building feeds. The IT or platform team owns the servers and the power supplies inside them. If your systems run in a colocation facility or a cloud provider's data center, the operator may own most of the power path, and your evidence depends on contract terms you may not control. Before the assessment, confirm in writing who maintains each power component, who inspects the cabling, and which of those duties your provider's independent reports cover. Then decide who will produce the evidence that the protection is working.

Which power equipment and cabling PE-9 covers in scope

PE-9 applies only where the system sits in a moderate or high baseline, so the first scoping decision is the impact level. The cards below cover the other decisions that determine which power equipment the organization must protect and document.

Impact level sets whether PE-9 applies

PE-9 is allocated to the moderate and high baselines only, not to the low baseline, and it is not part of the privacy baseline. Confirm the system's security categorization before scoping power work. A low-impact system may still be bound by a contract or agency requirement that imposes PE-9 anyway, so check the governing agreement as well as the baseline selection recorded in the system security plan.

Facilities housing the system

List every facility where system components draw power, including primary data centers, disaster recovery sites and network closets. PE-9 protects power equipment and cabling for the system, so a site that holds only a component of the system can still fall in scope. Record the boundary of each facility and state which power distribution belongs to the system and which belongs to the building.

Shared and colocated power

When the system shares a power feed, panel or generator with other tenants, or sits in a colocation cage, the organization must decide whether those shared components are in scope and how their protection is inherited. Ask the colocation provider for its power equipment documentation and for the contractual terms covering maintenance, access and cabling changes. Gaps in this inheritance are a common source of open findings.

Third-party owned power equipment

Equipment owned or operated by a landlord, cloud provider or utility may still protect the system. Decide whether the organization will rely on the provider's controls, and document that reliance with the provider's assurance evidence and the contract clauses that cover power protection. The organization still owns the decision about what evidence it can produce.

Uninterruptible supplies and PDUs

Uninterruptible power supplies and power distribution units are often the first components an assessor asks about, because they sit between the utility feed and the equipment. List each unit by location, rack and the systems it feeds. Confirm which units are maintained by the organization and which by a service vendor, and keep the asset inventory aligned with the power diagram.

Switchgear, generators and power cabling

Switchgear, generators, transfer switches and the cabling that carries power to the racks each need an explicit decision. Record whether each is in scope, who protects it and how its physical location is controlled. Power cabling is the component most often left out of scope, so document feeder routes, redundant paths and any cabling that crosses a boundary into an unmanaged area.

How an assessor tests PE-9 under SP 800-53A

This table compares the examine, interview and test methods SP 800-53A uses for PE-9, with the assessment objects and evidence each one draws on. Read each row as one step an assessor takes, then check whether your own records would answer it without a long search.

Assessment step	Evidence requested	Common finding
Examine: policy and procedures	Physical and environmental protection policy and procedures that address protecting power equipment and power cabling	Policy exists but does not name power equipment or cabling, or procedures are not reviewed on a defined cycle
Examine: facilities housing power equipment	Documents describing the facilities that house power equipment and cabling for the system, such as site records and facility layouts	Facility records omit switchgear, UPS rooms or cable pathways that support the system
Interview: responsible personnel	Named staff who own protection of power equipment and cabling, and their description of duties and escalation paths	Responsibility is assumed by facilities staff who are not aware of the system's dependency on specific feeds
Test: implementing mechanisms	Observed or documented mechanisms such as locked electrical rooms, cable routing records, and access logs for power areas	Mechanisms are described in policy but cannot be shown working during the assessment
Test: cabling and equipment protection	Records showing how power cabling is routed, labeled and protected from damage, and maintenance or inspection history	Cabling is undocumented or routed through unprotected spaces, and inspection records are missing
Scope check before testing	Confirm with your assessor which facilities, power paths and system components are in scope for the assessment	Scope is set by the system boundary, so omitted facilities or shared power panels surface late in the assessment

What the two PE-9 enhancements add beyond the base control

The base PE-9 requirement asks the organization to protect power equipment and power cabling for the system from damage and destruction. Release 5.2.0 of SP 800-53 adds two active enhancements on top of that base: one covering redundant power cabling and one covering automatic voltage controls. Redundant cabling addresses the case where a single feed or cable run is the point of failure, so the organization decides whether a second, separately routed path is needed for the system. Automatic voltage controls address the case where unstable or out-of-tolerance power could damage equipment even when the cabling itself is intact. The exact wording of each enhancement is in the NIST catalog, so confirm the text there rather than relying on a summary.

Neither enhancement is allocated to an SP 800-53B baseline. The moderate and high baselines include PE-9 itself, but they do not select either enhancement, so there is no baseline default to fall back on. The organization must decide whether each enhancement applies through its own risk assessment and tailoring of the baseline. An assessor will not accept "not selected" as an answer by itself. Expect questions about what risk the organization considered, who approved the decision, which facilities and components the decision covers, and where the record of the decision is kept. A short, dated tailoring rationale for each enhancement, tied to the system's power dependencies, is usually the document that answers those questions.

Before finalizing the tailoring decision, check the neighboring control PE-4, which covers access control for transmission. Power cabling and communications cabling often share conduit, cable trays and wiring closets, so the physical protections chosen for one can affect the other. Review both controls together during scoping, and confirm with the facility owner which cable runs are shared. This is a scoping check, not a claimed mapping between the two controls. Also confirm which enhancements your authorizing official or contract expects you to address, since an agency or contract may require specific choices even where the baseline does not.

Implementing PE-9 in order, from inventory to evidence

This sequence takes an organization from knowing exactly which power equipment and cabling supports the system to a dated record showing that the protections were chosen, configured, tested and reviewed. Each step produces an artifact an assessor can examine.

Inventory power equipment and cabling in scope
Facilities and electrical staff list every component that delivers or conditions power to the system boundary: utility feeds, transfer switches, uninterruptible power supplies, power distribution units, generators, panels, breakers and the power cabling between them. Record the location, owner, capacity and the systems each feed serves. The output is a power equipment and cabling inventory tied to the system boundary in the system security and privacy plan. You know the step is done when a reviewer can trace every powered component back to a named system and a named facility owner.
Select protections with the risk assessment
Using the organization's risk assessment, decide which threats to power equipment and cabling matter for this system, such as cable cuts, equipment failure, surges and accidental damage during maintenance. Decide whether the baseline control alone is enough or whether enhancements, such as redundant cabling or automatic voltage controls, are warranted. Confirm with the control owner and your SP 800-53B baseline selection that PE-9 applies to the impact level of the system, since it is not part of the low baseline. The output is a short decision record, signed by the authorizing official or delegate, that explains each selected measure and each one rejected.
Document the protection program and responsibilities
Write or update the physical and environmental protection procedures so they cover how power equipment and cabling are protected, and name who is responsible for each part: facilities for the building feeds, the platform team for rack-level distribution, and any colocation or cloud provider for the parts it operates. Where a provider controls the facility, record the inherited responsibility and obtain the provider's current evidence of its own protections. The output is a power protection procedure and a responsibility matrix that match the inventory. Confirm the review cycle with the policy owner so the document stays aligned with the procedure.
Configure and verify electrical protections
Implement the selected measures in the facility: lock or enclose power panels and cable routes, label feeds, confirm that redundant cabling paths are physically separated where that enhancement was chosen, and verify that voltage regulation or conditioning is installed and set to the documented thresholds. Have a qualified electrician or the facility team complete the work under change control, with photographs or as-built drawings taken before the change is closed. The output is a set of configuration records and as-built diagrams that show each protection in its installed state.
Test protections and record the results
Test the mechanisms that protect power equipment and cabling. Examples include confirming that a transfer switch operates, that voltage regulation responds to a controlled test within the documented limits, and that access to panels is restricted as documented. Interview the people responsible for these protections to confirm they know their duties. Record each test with the date, tester, expected result, actual result and any defect. The output is a test record that an assessor can compare against the two determination statements in SP 800-53A. Open defects go into the plan of action and milestones with an owner.
Set up periodic review and change triggers
Schedule a recurring review of the inventory, the procedure and the test results, and define events that force an earlier review, such as a new feed, a change in the facility, a failed test or a significant system change. Assign the reviewer and the record location in advance. Keep the review outputs with the earlier artifacts so the evidence history shows the protections were maintained, not only installed once. Confirm the review interval with the policy owner and with any provider contract that sets its own requirements. The output is a review schedule and a dated log of completed reviews.

Evidence that passes PE-9 and how to keep it current

An assessor testing PE-9 looks for a small set of documents and records that show power equipment and cabling are protected, that people responsible for them know their role, and that the evidence is reviewed on a schedule. Each artifact below supports one of the SP 800-53A determination statements, and each needs an owner, a review date and a signature that matches the organization's own approval process.

Physical and environmental protection policy and procedures

The policy and procedures are the first documents an assessor examines for PE-9. They should name power equipment and power cabling explicitly, state who owns protection of that equipment in each facility that houses the system, and describe how protection is implemented. Check that the document covers the facilities hosting the system, including any colocation or cloud data center where the organization relies on a provider. Signature should come from the designated senior official, with the facilities owner named as the procedure owner. Confirm the review cycle your own policy sets and log each revision date.

Power equipment and cabling inventory

An inventory lists each uninterruptible power supply, power distribution unit, generator transfer switch, breaker panel and the power cabling that feeds the system, with location, owner and last inspection date. Assessors use it to confirm that the protection controls cover what the system actually depends on. Tie each entry to the asset register used for configuration management so changes such as a new PDU or rerouted feed show up in both places. Keep the inventory under version control and record who approved each change.

Facility drawings and single-line diagrams

Single-line diagrams and facility floor plans show how power enters the building, how it reaches the racks and which paths are redundant. They let an assessor check whether cabling is routed away from hazards and whether a single fault could remove power to the system. Update the drawings after any electrical work and store dated revisions. Where a third party operates the facility, request its current drawings and confirm that they cover the segments serving your system. The licensed engineer or facilities manager who approves the drawing should sign the revision.

Records of protection mechanisms and their testing

Maintenance tickets, load tests, breaker inspections, thermographic scans and failover test reports show that the protection mechanisms work as designed. SP 800-53A asks assessors to test the mechanisms, so records should show the test method, the date, the result and any corrective action. Schedule these tests on a calendar that matches the vendor's recommended intervals and your own risk decisions, and keep the reports with the inventory entry they cover. The facilities engineer who performed or witnessed the test signs the record, and a manager countersigns corrective actions.

Role descriptions for facilities staff

Assessors interview personnel who protect power equipment and cabling, so the role descriptions must match what those people actually do. Each description should name responsibilities for power equipment, escalation paths for alarms and the authority to isolate a fault. Review the descriptions when staff change or when a provider takes over operations, and confirm that interviewees can explain the procedure without reading it aloud. HR or the facilities manager should approve the descriptions, and each employee or contractor should acknowledge the version they received.

Dated review log

A review log records each time the policy, inventory, diagrams and test records were checked, who checked them and what changed. It shows the assessor that PE-9 evidence is maintained between audits rather than rebuilt before one. Set a recurring review on the calendar, assign an owner for each artifact and keep the log in the same system as the documents it tracks. The facilities owner signs each review entry, and the senior official reviews the log at least once a year.

What meeting PE-9 costs in money and effort

This table breaks down the cost and effort of meeting PE-9 by component, showing who is paid, whether each cost is one-time or recurring, what drives it, and how to keep it down. NIST does not estimate compliance costs, so use the table to shape your quote requests rather than as a budget.

Cost component	One-time or recurring	What drives it	How to keep it down
Facilities and electrical engineering review	One-time, then periodic	Size and age of the power distribution, number of feeds, and whether the facility owner or a colocation provider controls the electrical plant	Confirm which party owns the power path and reuse the provider's existing single-line diagrams and maintenance records
Redundant power cabling and feeds	One-time capital, plus recurring feed charges where colocated	Number of independent feeds required, distance to separate utility or UPS paths, and cable routing constraints	Scope redundancy to the components the system depends on and document the reasoning in the system security plan
Automatic voltage control equipment	One-time purchase or lease, recurring maintenance	Whether existing power conditioning is adequate, and the sensitivity of hardware to voltage variation	Check whether the facility already provides regulated power before buying duplicate equipment
Protection of the organization's own power equipment	One-time installation, recurring inspection	Physical separation, enclosures, access controls over breaker panels and switchgear, and fire or water exposure	Use existing locked electrical rooms and include power equipment in the physical access and monitoring program
Colocation or provider fees for power protection	Recurring	Contracted power capacity, redundancy tier, and whether the provider documents its power protection to you	Ask the provider for its power protection documentation and request the fee breakdown in writing from the facility owner or provider
Testing and maintenance of power mechanisms	Recurring	Frequency of transfer tests, generator and UPS servicing, and the number of components in scope	Schedule tests with the provider's existing maintenance cycle and record results once for all tenants where shared
Evidence upkeep	Recurring	Number of documents an assessor samples, such as inspection logs, maintenance tickets and change records	Keep one evidence register for power equipment with named owners and review dates
Internal and external review	Recurring, often per assessment cycle	Scope of the assessment, whether an independent assessor tests the mechanisms, and how many findings need remediation	Run a readiness check before the assessor arrives and fix gaps found in your own review first
Assessor sampling time	Per assessment cycle	Number of facilities and power paths in scope and how many interviews and tests the assessor plans	Prepare a clear scope statement and request a written assessment plan with the sample sizes before work begins

Who owns PE-9 and what a partner can prepare

The organization owns PE-9. Facilities, IT operations and compliance each hold part of the control, and no outside party can accept that accountability on the organization's behalf. Facilities usually owns the power plant itself: utility feeds, transfer switches, generators, uninterruptible power supplies, distribution panels and the cabling between them. IT operations owns the rack-level dependencies and the systems that must stay up when power changes. Compliance owns the policy, the assessment schedule and the evidence the assessor will request.

Facilities: maintains the power equipment and cabling, schedules inspections and records repairs.
IT operations: maps which systems depend on which power paths and keeps that map current.
Compliance: owns the protection policy, tracks open findings and approves the evidence pack.
Management: accepts residual risk where cabling or equipment cannot be fully protected.
Facility contractors: perform maintenance under the organization's direction and keep their own service records.

Before engaging any partner, confirm who signs the protection procedures and who answers an assessor's interview questions about power equipment. Those names should appear in the control documentation.

Where PE-9 findings usually come from

Assessors rarely fail PE-9 because power equipment is unprotected. They find gaps in records, responsibilities and change history that show the protection cannot be demonstrated. The cards below cover the gaps that appear most often, each with the action that closes it.

Inventory omits PDUs and cabling

The asset inventory lists servers and network devices but leaves out power distribution units, uninterruptible supplies, transfer switches and the power cabling that feeds the system. An assessor who examines the inventory against the facility walkthrough finds equipment that no one has documented as protected. Reconcile the inventory with a physical walkthrough, and record each power component with its location and the system it serves.

Policy does not name who protects power

The physical and environmental protection policy and procedures may describe power protection in general terms without assigning an owner. Assessors interview the people responsible, and gaps show when staff disagree about who maintains power equipment. Name the accountable role in the policy and the procedures, then confirm that the people in those roles can describe their duties.

Facility duties split without a written agreement

In colocation and shared facilities, the provider often runs the power plant while the customer runs the racks and cabling. Without a written agreement that assigns power protection duties, neither party can show the protection is covered. Ask the provider for the documented power protection responsibilities, record which duties sit with your team, and keep the agreement with the system security documentation.

No record of testing protections

Teams may protect power equipment with redundant feeds and voltage controls but keep no record that those protections work. Under SP 800-53A, assessors test the mechanisms that implement power protection, so a verbal assurance is not enough. Schedule and document tests of transfer, failover and voltage control, and keep the results with the date, the tester and any remediation.

Enhancements chosen without rationale

Redundant cabling and automatic voltage controls are enhancements that the organization selects based on its impact level and risk. When the selection is undocumented, an assessor cannot tell whether a gap was accepted or overlooked. Record each enhancement decision in the system security plan with the risk reasoning and the owner who approved it, and revisit the decision when the risk assessment changes.

Evidence predates a facility change

A new power feed, a moved rack row or a replaced UPS changes what must be protected, yet the inventory, diagrams and test results may still describe the old layout. Assessors compare evidence dates with change records and flag documents that no longer match the facility. After any power or facility change, update the inventory, diagrams and test records, and link each update to the change ticket that triggered it.

PE-9 questions buyers ask before hiring help

Does PE-9 apply to our system if we only run it in a low baseline?

No. SP 800-53B allocates PE-9 to the moderate and high baselines only, so a system categorized as low does not need it under that baseline. Confirm the impact level and baseline selection with your authorizing official or compliance lead before scoping, because the categorization drives which controls apply. If the system moves up to moderate or high, PE-9 becomes part of the scope, and the power work should be planned into the quote from the start. Ask the implementation partner to confirm which baseline the written scope assumes.

What does a PE-9 assessment actually look for?

An assessor works from the SP 800-53A procedure, which has two determination statements covering protection of power equipment and power cabling. The assessor examines the physical and environmental protection policy, the procedures and the facilities that house power equipment, interviews the people responsible for protecting it, and tests the mechanisms that implement the protection. Evidence therefore includes documented procedures, facility records, maintenance and inspection logs, and a walkthrough of the physical protections. Ask your partner for a mapping of each piece of evidence to these methods before work starts.

Can a colocation provider satisfy PE-9 for us?

Partly, and only as far as the provider's contract and controls reach. A colocation facility may already protect its power equipment and cabling, but the organization still owns its control implementation and must show that the protection covers the components that host its system. Request the provider's relevant audit reports and facility documentation, then confirm in writing which PE-9 responsibilities the provider carries and which remain with you. Gaps in that split are where assessments usually find findings.

What does the work need from facilities staff?

Facilities staff usually supply the facts that cannot be learned from the system side: how power reaches the rack, where distribution panels and cabling run, who can physically reach them, and what maintenance already happens. They also provide access for walkthroughs and help confirm that protective measures such as cable routing and equipment placement are in place. Plan for their time during discovery and evidence collection, and ask the partner to list those requests in the written scope so facilities can schedule them.

Can our own team handle PE-9 without outside help?

Often yes, if the team already owns the facility relationship and the documentation. Internal teams are usually strongest on the existing procedures and maintenance history, while outside help tends to add value in writing the control narrative, organizing evidence to match the assessment methods, and checking gaps before an independent assessor arrives. Be realistic about capacity: the people who run the facility may be the same people who must produce the evidence. Decide which parts you will do internally and which you will buy.

What drives the cost of PE-9 work?

Cost depends mainly on how much power infrastructure is in scope, whether it is owned, colocated or shared, how well current procedures are documented, and how much physical verification the assessor will expect. One-time work includes discovery, documentation and evidence organization. Recurring work includes periodic review of procedures and maintenance records. NIST does not estimate compliance or certification costs, so no official figure applies here. Ask any provider for a fixed-scope quote that lists the facilities, the deliverables and the responsibilities of each party.

Who sets the timeline, and how long does preparation take?

Preparation length depends on the size of the power environment and how much documentation already exists, and no researched duration applies here. NIST leaves federal implementation timelines to OMB Circular A-130, and the assessor, not the implementation partner, decides the assessment schedule. Ask the partner for a written schedule that separates discovery, documentation, evidence collection and remediation, and check it against your authorization or audit date.

How DeployOpen scopes and prepares PE-9 evidence

DeployOpen works on PE-9 as part of a self-hosted open-source platform deployment inside the client's own facilities or cloud accounts. We prepare the systems, documentation and evidence that an independent assessor would examine, while the organization keeps ownership of its power and facility controls.

How we scope

Confirm which systems fall under the moderate or high baseline before PE-9 work is included in scope
Identify the facilities and power paths that house system components and power cabling
Agree in writing which evidence artifacts and facility records are in the fixed-scope deliverables

How we build

Document the power equipment and cabling inventory for in-scope facilities and racks
Record the protection measures for power equipment and cabling in the facility configuration
Test that monitoring and alerting mechanisms for power protection are configured and operating

How we hand over

Deliver the PE-9 control narrative with the mechanisms, owners and locations it describes
Provide evidence packages that map to the examine, interview and test steps in SP 800-53A
Give the organization a list of facility and personnel interviews the assessor is likely to request

How we support

Offer ongoing support as a retainer to refresh PE-9 documentation after facility or power changes
Review evidence again when the organization's system boundary or facility layout changes
Leave the independent assessor to test controls and issue any report or determination