PE-11 Emergency Power

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Moderate, High	Organization	2 (1 in a baseline)

Related controls: AT-3, CP-2, CP-7

Control statement

Provide an uninterruptible power supply to facilitate [Selection: an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss.

NIST discussion

An uninterruptible power supply (UPS) is an electrical system or mechanism that provides emergency power when there is a failure of the main power source. A UPS is typically used to protect computers, data centers, telecommunication equipment, or other electrical equipment where an unexpected power disruption could cause injuries, fatalities, serious mission or business disruption, or loss of data or information. A UPS differs from an emergency power system or backup generator in that the UPS provides near-instantaneous protection from unanticipated power interruptions from the main power source by providing energy stored in batteries, supercapacitors, or flywheels. The battery duration of a UPS is relatively short but provides sufficient time to start a standby power source, such as a backup generator, or properly shut down the system.

Control enhancements

PE-11(1) Alternate Power Supply — Minimal Operational Capability

Baselines: High

Provide an alternate power supply for the system that is activated [Selection: manually; automatically] and that can maintain minimally required operational capability in the event of an extended loss of the primary power source.

Discussion and assessment objectives for PE-11(1)

Provision of an alternate power supply with minimal operating capability can be satisfied by accessing a secondary commercial power supply or other external power supply.

Determine if:

• PE-11(01)[01] an alternate power supply provided for the system is activated [Selection: manually; automatically];
• PE-11(01)[02] the alternate power supply provided for the system can maintain minimally required operational capability in the event of an extended loss of the primary power source.

Examine: Physical and environmental protection policy; procedures addressing emergency power; alternate power supply; alternate power supply documentation; alternate power supply test records; system security plan; other relevant documents or records.

Interview: Organizational personnel with the responsibility for emergency power and/or planning; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing an alternate power supply; the alternate power supply.

PE-11(2) Alternate Power Supply — Self-contained

Baselines: Not in a baseline

Provide an alternate power supply for the system that is activated [Selection: manually; automatically] and that is:

• (a) Self-contained;
• (b) Not reliant on external power generation; and
• (c) Capable of maintaining [Selection: minimally required operational capability; full operational capability] in the event of an extended loss of the primary power source.

Discussion and assessment objectives for PE-11(2)

The provision of a long-term, self-contained power supply can be satisfied by using one or more generators with sufficient capacity to meet the needs of the organization.

Determine if an alternate power supply provided for the system is activated [Selection: manually; automatically];

• PE-11(02)(a) the alternate power supply provided for the system is self-contained;
• PE-11(02)(b) the alternate power supply provided for the system is not reliant on external power generation;
• PE-11(02)(c) the alternate power supply provided for the system is capable of maintaining [Selection: minimally required operational capability; full operational capability] in the event of an extended loss of the primary power source.

Examine: Physical and environmental protection policy; procedures addressing emergency power; alternate power supply; alternate power supply documentation; alternate power supply test records; system security plan; other relevant documents or records.

Interview: Organizational personnel with the responsibility for emergency power and/or planning; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing an alternate power supply; the alternate power supply.

Assessment objectives (SP 800-53A)

Objectives and methods for PE-11

Determine if an uninterruptible power supply is provided to facilitate [Selection: an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss.

Examine: Physical and environmental protection policy; procedures addressing emergency power; uninterruptible power supply; uninterruptible power supply documentation; uninterruptible power supply test records; system security plan; other relevant documents or records.

Interview: Organizational personnel with the responsibility for emergency power and/or planning; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing an uninterruptible power supply; the uninterruptable power supply.

Policy statement

• The Facilities manager shall provide an uninterruptible power supply to facilitate Select one: an orderly shutdown of the system; transition of the system to long-term alternate power Typical: an orderly shutdown of the system in the event of a primary power source loss. (PE-11)
• Where the contingency plan’s recovery time objective cannot be met by restarting the system after primary power returns, the Facilities manager shall also provide long-term alternate power, such as a generator, to which the uninterruptible power supply transitions the system. (PE-11)
• The System owner shall configure the system’s components to shut down in order, automatically where they support it, before the uninterruptible power supply’s batteries are exhausted. (PE-11)
• The Facilities manager shall test the uninterruptible power supply and any generator at least annually, replace batteries as the manufacturer specifies, and confirm the runtime still covers the load. (PE-11)

PE-11(1) Alternate power supply — minimal operational capability

• The Facilities manager shall provide an alternate power supply for the system that is activated Select one: manually; automatically Typical: automatically and that can maintain minimally required operational capability in the event of an extended loss of the primary power source. (PE-11(1))
• The System owner shall define the minimally required operational capability in the contingency plan, and the Facilities manager shall keep fuel or supply contracts sufficient to sustain it for the outage duration the plan assumes. (PE-11(1))

From the Physical and Environmental Protection Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PE-11 asks for an uninterruptible power supply (UPS) that carries the system through a loss of primary power long enough either to shut it down in order or to move it to long-term alternate power. NIST’s PE-11 discussion describes a UPS as near-instantaneous protection, from energy stored in batteries, supercapacitors or flywheels, and says its relatively short duration gives time to start a standby source such as a generator or to shut the system down properly. PE-11 is in the Moderate and High baselines, not Low.

Make the choice from the business impact analysis. If the system’s recovery time objective tolerates waiting for power to return and restarting, an orderly shutdown is enough. If it does not, the UPS must carry the load until a generator or other long-term source takes over, and the contingency plan says how (CP-2).

Common implementations. A room or rack UPS feeds the servers, storage and the network equipment they depend on. Its management card signals the hosts and hypervisors to shut down in order when the remaining runtime falls to a set point, and the shutdown is tested. Where the recovery time objective needs it, a generator with an automatic transfer switch takes the load, and the UPS only bridges the gap while it starts. Wiring closets in offices get a small UPS for their switches, so a short outage does not drop the network.

Organization-defined parameters. Typical value, from the Physical and Environmental Protection policy, which your organization may set differently:

Parameter	Typical value
What the uninterruptible power supply facilitates	An orderly shutdown of the system

The policy adds long-term alternate power, such as a generator, where the contingency plan’s recovery time objective cannot be met by restarting the system after primary power returns. It has the system owner configure the system’s components to shut down in order, automatically where they support it, before the batteries are exhausted. It has the facilities manager test the UPS and any generator at least annually, replace batteries as the manufacturer specifies, and confirm the runtime still covers the load.

Evidence assessors ask for.

• The UPS units that serve the system, their rated runtime and their current load
• The business impact analysis’s recovery time objective, and the contingency plan’s statement of how power loss is handled
• The shutdown configuration, and the record of a test in which the system shut down in order
• UPS and generator test records, and battery replacement dates against the manufacturer’s schedule
• For a generator, its transfer switch tests and fuel arrangements

Inheritance. For a system hosted in a cloud service or colocation data center, the provider supplies the UPS and generators for its facility, and the system security plan records PE-11 as inherited for it, backed by the provider’s authorization or audit report. The organization still meets PE-11 for its own server rooms and for network equipment the system needs, usually as a common control run by the facilities manager, with the system owner responsible for the shutdown configuration.

Common findings.

• Runtime calculated when the UPS was installed and never rechecked as equipment was added.
• Batteries past their replacement date, found only when the UPS fails a test or an outage.
• Shutdown software installed but not configured on every host, or never tested.
• Servers on the UPS but the switch or firewall they depend on not, so the system is unreachable during the outage anyway.
• An orderly shutdown chosen for a system whose recovery time objective is shorter than a likely power outage.

Enhancements in the Moderate baseline. None. High adds PE-11(1) alternate power supply with minimal operational capability. PE-11(2) self-contained alternate power supply is in no baseline.

• PE-11(1) (High) provides an alternate power supply that maintains minimally required operational capability during an extended loss of primary power. NIST’s discussion says a secondary commercial power supply or another external power supply can satisfy it. Typical value: activated automatically. The policy has the system owner define the minimally required operational capability in the contingency plan, and the facilities manager keep fuel or supply contracts sufficient to sustain it for the outage duration the plan assumes. A generator with an automatic transfer switch is the usual way.
• PE-11(2) requires an alternate supply that is self-contained and not reliant on external power generation. NIST’s discussion says one or more generators with sufficient capacity can satisfy it.

Artifacts

• Physical and Environmental Protection Decision Worksheet
• Physical and Environmental Protection Policy