PE-10 Emergency Shutoff

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Moderate, High	Organization	None

Related controls: PE-15

Control statement

• a. Provide the capability of shutting off power to [Assignment: organization-defined system or individual system components] in emergency situations;
• b. Place emergency shutoff switches or devices in [Assignment: organization-defined location] to facilitate access for authorized personnel; and
• c. Protect emergency power shutoff capability from unauthorized activation.

NIST discussion

Emergency power shutoff primarily applies to organizational facilities that contain concentrations of system resources, including data centers, mainframe computer rooms, server rooms, and areas with computer-controlled machinery.

Withdrawn enhancements: PE-10(1).

Assessment objectives (SP 800-53A)

Objectives and methods for PE-10

Determine if:

• PE-10a. the capability to shut off power to [Assignment: organization-defined system or individual system components] in emergency situations is provided;
• PE-10b. emergency shutoff switches or devices are placed in [Assignment: organization-defined location] to facilitate access for authorized personnel;
• PE-10c. the emergency power shutoff capability is protected from unauthorized activation.

Examine: Physical and environmental protection policy; procedures addressing power source emergency shutoff; emergency shutoff controls or switches; locations housing emergency shutoff switches and devices; security safeguards protecting the emergency power shutoff capability from unauthorized activation; system security plan; other relevant documents or records.

Interview: Organizational personnel with the responsibility for the emergency power shutoff capability (both implementing and using the capability); organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing emergency power shutoff.

Policy statement

• The Facilities manager shall provide the capability of shutting off power to Fill in: system or individual system components that require the capability to shut off power in emergency situations Typical: the equipment in each data center and server room, including servers, storage, network equipment and their cooling in emergency situations. (PE-10a)
• The Facilities manager shall place emergency shutoff switches or devices Fill in: location of emergency shutoff switches or devices by system or system component Typical: beside the main exit of each data center and server room, clearly labeled to facilitate access for authorized personnel. (PE-10b)
• The Facilities manager shall protect the emergency power shutoff capability from unauthorized activation, with protective covers on the switches, placement inside the access-controlled area, and an alarm or camera that records activation. (PE-10c)
• Staff who work in those areas shall be shown the shutoff locations and told when to use them. (PE-10b)

From the Physical and Environmental Protection Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PE-10 asks you to be able to cut power to set components in an emergency (a), to put the shutoff switches where authorized personnel can reach them (b), and to protect the shutoff from unauthorized activation (c). NIST’s PE-10 discussion says emergency power shutoff applies mainly to facilities with concentrations of system resources: data centers, mainframe computer rooms, server rooms, and areas with computer-controlled machinery. PE-10 is in the Moderate and High baselines, not Low.

Common implementations. A data center or server room has an emergency power off button beside its main exit, under a hinged or lift-up cover, with a sign that says what it does. It is wired to cut the room’s power distribution, including the output of the room’s uninterruptible power supply and the cooling, so pressing it actually stops the equipment. The building’s electrical engineer and the local fire authority set most of the wiring details. Staff who work in the room are shown the button during their facility orientation and told when to use it: a fire, an electrical hazard to a person, or flooding near live equipment.

Organization-defined parameters. Typical values, from the Physical and Environmental Protection policy, which your organization may set differently:

Parameter	Typical value
Components that need an emergency shutoff (a)	The equipment in each data center and server room, including servers, storage, network equipment and their cooling
Location of the shutoff switches or devices (b)	Beside the main exit of each data center and server room, clearly labeled

For PE-10c, the policy has the facilities manager protect the shutoff with protective covers on the switches, placement inside the access-controlled area, and an alarm or camera that records activation. It also has staff who work in those areas shown the shutoff locations and told when to use them.

Evidence assessors ask for.

• Observation of each shutoff switch: its location, label and cover
• What each switch cuts, from the electrical drawings or the record of its last test
• How unauthorized activation is prevented and detected: the access-controlled room on the physical access list, and the alarm or camera
• Interviews with staff who work in the room: where the switch is and when to use it
• Records of any activation, accidental or real, and what followed

Inheritance. For a system hosted in a cloud service or colocation data center, the provider supplies the emergency shutoff for its facility, and the system security plan records PE-10 as inherited for it, backed by the provider’s authorization or audit report. The organization meets PE-10 for any server room of its own, usually as a common control run by the facilities manager. An office with no server room usually has nothing to which PE-10 applies beyond the building’s own electrical controls; say so in the system security plan rather than leaving it blank.

Common findings.

• An uncovered button beside the door that someone mistakes for a door release, causing an outage.
• A switch with no label, or one that staff in the room cannot find.
• A switch that cuts building power but not the uninterruptible power supply’s output, so the equipment keeps running.
• A switch outside the access-controlled area, where anyone passing can reach it.

Enhancements in the Moderate baseline. None. PE-10 has no enhancements in force; PE-10(1) is withdrawn.

Artifacts

• Physical and Environmental Protection Decision Worksheet
• Physical and Environmental Protection Policy