PE-13 Fire Protection

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	3 (2 in a baseline)

Related controls: AT-3

Control statement

Employ and maintain fire detection and suppression systems that are supported by an independent energy source.

NIST discussion

The provision of fire detection and suppression systems applies primarily to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Fire detection and suppression systems that may require an independent energy source include sprinkler systems and smoke detectors. An independent energy source is an energy source, such as a microgrid, that is separate, or can be separated, from the energy sources providing power for the other parts of the facility.

Control enhancements

PE-13(1) Detection Systems — Automatic Activation and Notification

Baselines: Moderate, High

Employ fire detection systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders] in the event of a fire.

Discussion and assessment objectives for PE-13(1)

Organizations can identify personnel, roles, and emergency responders if individuals on the notification list need to have access authorizations or clearances (e.g., to enter to facilities where access is restricted due to the classification or impact level of information within the facility). Notification mechanisms may require independent energy sources to ensure that the notification capability is not adversely affected by the fire.

Determine if:

• PE-13(01)[01] fire detection systems that activate automatically are employed in the event of a fire;
• PE-13(01)[02] fire detection systems that notify [Assignment: organization-defined personnel or roles] automatically are employed in the event of a fire;
• PE-13(01)[03] fire detection systems that notify [Assignment: organization-defined emergency responders] automatically are employed in the event of a fire.

Examine: Physical and environmental protection policy; procedures addressing fire protection; facility housing the information system; alarm service-level agreements; test records of fire suppression and detection devices/systems; fire suppression and detection devices/systems documentation; alerts/notifications of fire events; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for fire detection and suppression devices/systems; organizational personnel with responsibilities for notifying appropriate personnel, roles, and emergency responders of fires; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing fire detection devices/systems; activation of fire detection devices/systems (simulated); automated notifications.

PE-13(2) Suppression Systems — Automatic Activation and Notification

Baselines: High

• (a) Employ fire suppression systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders] ; and
• (b) Employ an automatic fire suppression capability when the facility is not staffed on a continuous basis.

Discussion and assessment objectives for PE-13(2)

Organizations can identify specific personnel, roles, and emergency responders if individuals on the notification list need to have appropriate access authorizations and/or clearances (e.g., to enter to facilities where access is restricted due to the impact level or classification of information within the facility). Notification mechanisms may require independent energy sources to ensure that the notification capability is not adversely affected by the fire.

Determine if:

• PE-13(02)(a)
  • PE-13(02)(a)[01] fire suppression systems that activate automatically are employed;
  • PE-13(02)(a)[02] fire suppression systems that notify [Assignment: organization-defined personnel or roles] automatically are employed;
  • PE-13(02)(a)[03] fire suppression systems that notify [Assignment: organization-defined emergency responders] automatically are employed;
• PE-13(02)(b) an automatic fire suppression capability is employed when the facility is not staffed on a continuous basis.

Examine: Physical and environmental protection policy; procedures addressing fire protection; fire suppression and detection devices/systems documentation; facility housing the system; alarm service-level agreements; test records of fire suppression and detection devices/systems; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for fire detection and suppression devices/systems; organizational personnel with responsibilities for providing automatic notifications of any activation of fire suppression devices/systems to appropriate personnel, roles, and emergency responders; organizational personnel with information security responsibilities.

Test: Automated mechanisms supporting and/or implementing fire suppression devices/systems; activation of fire suppression devices/systems (simulated); automated notifications.

PE-13(4) Inspections

Baselines: Not in a baseline

Ensure that the facility undergoes [Assignment: organization-defined frequency] fire protection inspections by authorized and qualified inspectors and identified deficiencies are resolved within [Assignment: organization-defined time period].

Discussion and assessment objectives for PE-13(4)

Authorized and qualified personnel within the jurisdiction of the organization include state, county, and city fire inspectors and fire marshals. Organizations provide escorts during inspections in situations where the systems that reside within the facilities contain sensitive information.

Determine if:

• PE-13(04)[01] the facility undergoes fire protection inspections [Assignment: organization-defined frequency] by authorized and qualified inspectors;
• PE-13(04)[02] the identified deficiencies from fire protection inspections are resolved within [Assignment: organization-defined time period].

Examine: Physical and environmental protection policy; procedures addressing fire protection; facility housing the system; inspection plans; inspection results; inspect reports; test records of fire suppression and detection devices/systems; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for planning, approving, and executing fire inspections; organizational personnel with information security responsibilities.

Withdrawn enhancements: PE-13(3).

Assessment objectives (SP 800-53A)

Objectives and methods for PE-13

Determine if:

• PE-13[01] fire detection systems are employed;
• PE-13[02] employed fire detection systems are supported by an independent energy source;
• PE-13[03] employed fire detection systems are maintained;
• PE-13[04] fire suppression systems are employed;
• PE-13[05] employed fire suppression systems are supported by an independent energy source;
• PE-13[06] employed fire suppression systems are maintained.

Examine: Physical and environmental protection policy; procedures addressing fire protection; fire suppression and detection devices/systems; fire suppression and detection devices/systems documentation; test records of fire suppression and detection devices/systems; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for fire detection and suppression devices/systems; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing fire suppression/detection devices/systems.

Policy statement

• The Facilities manager shall employ and maintain fire detection and suppression systems, supported by an independent energy source, that cover each area containing system components. (PE-13)
• Fire detection and suppression systems shall be inspected, tested and maintained as the applicable fire code and the manufacturer require, and the records kept. (PE-13)
• Where the suppression system could itself damage equipment, such as water sprinklers in a server room, the Facilities manager shall record the choice and the reason, with the system owner’s agreement. (PE-13)

PE-13(1) Detection systems — automatic activation and notification

• The Facilities manager shall employ fire detection systems that activate automatically and notify Fill in: personnel or roles to be notified in the event of a fire Typical: the facilities manager and the operations staff on duty for the facility and Fill in: emergency responders to be notified in the event of a fire Typical: the local fire department, through a monitored fire alarm service in the event of a fire. (PE-13(1))
• The notification path shall have power independent of the facility’s main supply, and shall be tested with the fire detection system. (PE-13(1))

PE-13(2) Suppression systems — automatic activation and notification

• The Facilities manager shall employ fire suppression systems that activate automatically and notify Fill in: personnel or roles to be notified in the event of a fire Typical: the facilities manager and the operations staff on duty for the facility and Fill in: emergency responders to be notified in the event of a fire Typical: the local fire department, through a monitored fire alarm service. (PE-13(2)(a))
• The Facilities manager shall employ an automatic fire suppression capability when the facility is not staffed on a continuous basis. (PE-13(2)(b))

From the Physical and Environmental Protection Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PE-13 asks for fire detection and suppression systems, supported by an independent energy source, that are maintained. NIST’s PE-13 discussion says it applies mainly to facilities with concentrations of system resources, such as data centers, server rooms and mainframe computer rooms. It names sprinkler systems and smoke detectors as systems that may need an independent energy source, and defines that as a source, such as a microgrid, that is separate, or can be separated, from the sources powering the rest of the facility. PE-13 is in the Low, Moderate and High baselines; Moderate adds automatic notification (PE-13(1)).

Common implementations. Smoke detectors cover each room that holds system components, wired to the building’s fire alarm panel, which runs on battery backup and reports to a monitored alarm service. Suppression is usually the building’s sprinklers. Data centers often use pre-action sprinklers, which fill with water only after a detector trips, or a clean-agent gas system, to limit damage to equipment. Building and fire codes and the local fire authority set most of the details, and the fire system contractor’s inspections produce the records.

Organization-defined parameters. PE-13 has none. The Physical and Environmental Protection policy has the facilities manager employ and maintain fire detection and suppression systems, supported by an independent energy source, that cover each area containing system components. They are inspected, tested and maintained as the fire code and the manufacturer require, and the records kept. Where the suppression system could itself damage equipment, such as water sprinklers in a server room, the facilities manager records the choice and the reason, with the system owner’s agreement.

For PE-13(1), typical values from the same policy, which your organization may set differently:

Parameter	Typical value
Personnel or roles notified of a fire (PE-13(1))	The facilities manager and the operations staff on duty for the facility
Emergency responders notified of a fire (PE-13(1))	The local fire department, through a monitored fire alarm service

Evidence assessors ask for.

• Observation of detectors and suppression heads or nozzles in each room that holds system components
• The fire alarm panel’s backup power, and how it reports to the monitoring service
• Inspection, test and maintenance records from the last year, and the correction of any deficiencies
• The recorded choice of suppression for each equipment room, where it could damage equipment
• For PE-13(1), the notification list, the monitoring contract, and a test record showing the alarm reached the people and the service named

Inheritance. For a system hosted in a cloud service or colocation data center, the provider supplies fire protection for its facility, and the system security plan records PE-13 and PE-13(1) as inherited for it, backed by the provider’s authorization or audit report. In a leased building, the landlord usually runs the fire alarm and sprinklers; record what the lease says and obtain the inspection records. The organization meets PE-13 for its own server rooms as a common control run by the facilities manager.

Common findings.

• A server room built later inside an office floor, with no detector of its own.
• Inspection records held by the landlord or contractor and never obtained.
• Deficiencies noted at inspection and not corrected.
• Fire alarms that notify the fire department but no one in the organization, so the system owner hears of a fire from the news or the outage.
• Storage of cardboard and spare equipment packaging in the server room.

Enhancements in the Moderate baseline. PE-13(1) detection systems with automatic activation and notification. High adds PE-13(2) suppression systems with automatic activation and notification. PE-13(4) inspections is in no baseline, and PE-13(3) is withdrawn.

• PE-13(1) has fire detection activate automatically and notify the personnel and emergency responders you name (typical values in the table above). NIST’s discussion says organizations can name personnel, roles and emergency responders when people on the notification list need access authorizations or clearances to enter restricted facilities, and that notification mechanisms may need independent energy sources so a fire does not disable them. The policy gives the notification path power independent of the facility’s main supply and tests it with the fire detection system.
• PE-13(2) (High) has suppression systems activate automatically and notify the people and responders you name (a), and requires automatic suppression when the facility is not staffed continuously (b). NIST’s discussion matches PE-13(1)‘s. Typical values: the facilities manager and the operations staff on duty for the facility, and the local fire department, through a monitored fire alarm service, the same list as PE-13(1).
• PE-13(4) has qualified inspectors, such as state, county and city fire inspectors and fire marshals, inspect the facility at a frequency you set, with deficiencies resolved within a set time. NIST’s discussion adds escorts during inspections where systems contain sensitive information. Most organizations are inspected under local fire code anyway; keep the reports.

Artifacts

• Physical and Environmental Protection Decision Worksheet
• Physical and Environmental Protection Policy