PE-14 Environmental Controls

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	2 (0 in a baseline)

Related controls: AT-3, CP-2

Control statement

• a. Maintain [Selection (one or more): temperature; humidity; pressure; radiation; [Assignment: organization-defined environmental control] ] levels within the facility where the system resides at [Assignment: organization-defined acceptable levels] ; and
• b. Monitor environmental control levels [Assignment: organization-defined frequency].

NIST discussion

The provision of environmental controls applies primarily to organizational facilities that contain concentrations of system resources (e.g., data centers, mainframe computer rooms, and server rooms). Insufficient environmental controls, especially in very harsh environments, can have a significant adverse impact on the availability of systems and system components that are needed to support organizational mission and business functions.

Control enhancements

PE-14(1) Automatic Controls

Baselines: Not in a baseline

Employ the following automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system: [Assignment: organization-defined automatic environmental controls].

Discussion and assessment objectives for PE-14(1)

The implementation of automatic environmental controls provides an immediate response to environmental conditions that can damage, degrade, or destroy organizational systems or systems components.

Determine if [Assignment: organization-defined automatic environmental controls] are employed in the facility to prevent fluctuations that are potentially harmful to the system.

Examine: Physical and environmental protection policy; procedures addressing temperature and humidity controls; facility housing the system; automated mechanisms for temperature and humidity; temperature and humidity controls; temperature and humidity documentation; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for system environmental controls; organizational personnel with information security responsibilities.

Test: Automated mechanisms supporting and/or implementing temperature and humidity levels.

PE-14(2) Monitoring with Alarms and Notifications

Baselines: Not in a baseline

Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to [Assignment: organization-defined personnel or roles].

Discussion and assessment objectives for PE-14(2)

The alarm or notification may be an audible alarm or a visual message in real time to personnel or roles defined by the organization. Such alarms and notifications can help minimize harm to individuals and damage to organizational assets by facilitating a timely incident response.

Determine if:

• PE-14(02)[01] environmental control monitoring is employed;
• PE-14(02)[02] the environmental control monitoring capability provides an alarm or notification to [Assignment: organization-defined personnel or roles] when changes are potentially harmful to personnel or equipment.

Examine: Physical and environmental protection policy; procedures addressing temperature and humidity monitoring; facility housing the system; logs or records of temperature and humidity monitoring; records of changes to temperature and humidity levels that generate alarms or notifications; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for system environmental controls; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing temperature and humidity monitoring.

Assessment objectives (SP 800-53A)

Objectives and methods for PE-14

Determine if:

• PE-14a. [Selection (one or more): temperature; humidity; pressure; radiation; [Assignment: organization-defined environmental control] ] levels are maintained at [Assignment: organization-defined acceptable levels] within the facility where the system resides;
• PE-14b. environmental control levels are monitored [Assignment: organization-defined frequency].

Examine: Physical and environmental protection policy; procedures addressing temperature and humidity control; temperature and humidity controls; facility housing the system; temperature and humidity controls documentation; temperature and humidity records; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for system environmental controls; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing the maintenance and monitoring of temperature and humidity levels.

Policy statement

• The Facilities manager shall maintain Select one or more: temperature; humidity; pressure; radiation; [Assignment: organization-defined environmental control] Typical: temperature and humidity levels within the facility where the system resides at Fill in: acceptable levels for environmental controls Typical: the operating ranges the equipment manufacturers specify, recorded in the system security plan. (PE-14a)
• The Facilities manager shall monitor environmental control levels Fill in: frequency at which to monitor environmental control levels Typical: continuously, with automated alerts when a level leaves its range. (PE-14b)
• Alerts shall go to staff who can respond at any hour, and an alert that is not resolved within the time the contingency plan allows shall start the contingency plan’s notification procedures (CP-2). (PE-14b)
• Cooling for areas that contain system components shall run independently of the building’s office schedule, with enough capacity or redundancy that the loss of one unit does not take the room out of range. (PE-14a)

From the Physical and Environmental Protection Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PE-14 asks you to keep the environmental conditions you choose, such as temperature and humidity, within acceptable levels where the system resides (a), and to monitor those levels at a set frequency (b). NIST’s PE-14 discussion says environmental controls apply mainly to facilities with concentrations of system resources, such as data centers, mainframe computer rooms and server rooms, and that insufficient controls, especially in very harsh environments, can significantly harm the availability of systems that support mission and business functions. PE-14 is in the Low, Moderate and High baselines.

Common implementations. A server room has dedicated cooling, often two units so one can fail or be serviced, that runs around the clock regardless of the office’s heating and cooling schedule. Temperature and humidity sensors in the room, at the equipment’s air intakes, report to the building management system or an environmental monitoring service. Alerts go by text or call to whoever is on call, not only to an email box. The acceptable ranges come from the equipment manufacturers’ specifications, and the system security plan records them.

Organization-defined parameters. Typical values, from the Physical and Environmental Protection policy, which your organization may set differently:

Parameter	Typical value
Environmental controls maintained (a)	Temperature and humidity
Acceptable levels (a)	The operating ranges the equipment manufacturers specify, recorded in the system security plan
Monitoring frequency (b)	Continuously, with automated alerts when a level leaves its range

The selection’s other choices, pressure and radiation, matter only in special environments, and its own assignment lets you add another control, such as dust, where the site needs it. The policy sends alerts to staff who can respond at any hour, and has an alert not resolved within the time the contingency plan allows start the plan’s notification procedures (CP-2). It has cooling for areas with system components run independently of the building’s office schedule, with enough capacity or redundancy that losing one unit does not take the room out of range.

Evidence assessors ask for.

• The acceptable ranges in the system security plan, and the manufacturers’ specifications they come from
• The monitoring system’s readings for a recent period, showing levels stayed in range
• The alert configuration: thresholds, who is notified and how, and a recent test or real alert
• The cooling arrangement for each equipment room: dedicated units, hours of operation and redundancy
• Maintenance records for the cooling units

Inheritance. For a system hosted in a cloud service or colocation data center, the provider controls and monitors the environment of its facility, and the system security plan records PE-14 as inherited for it, backed by the provider’s authorization or audit report. The organization meets PE-14 for its own server rooms and wiring closets, usually as a common control run by the facilities manager.

Common findings.

• A server room cooled by the building’s office air conditioning, which shuts off at night and on weekends.
• Sensors that log readings but send no alerts, or alerts that go to a mailbox no one watches after hours.
• No documented acceptable range, so no one can say when a reading is a problem.
• A single cooling unit with no plan for its failure, and no link from a long excursion to the contingency plan.
• Wiring closets with network equipment in unventilated spaces.

Enhancements in the Moderate baseline. None. PE-14(1) automatic controls and PE-14(2) monitoring with alarms and notifications are in no baseline. NIST’s discussions describe automatic environmental controls as an immediate response to conditions that can damage, degrade or destroy systems, and alarms or notifications as audible alarms or real-time visual messages to named personnel that help minimize harm by facilitating a timely incident response. The typical PE-14 values above already meet much of PE-14(2) in practice.

Artifacts

• Physical and Environmental Protection Decision Worksheet
• Physical and Environmental Protection Policy