PE-15 Water Damage Protection

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	1 (1 in a baseline)

Related controls: AT-3, PE-10

Control statement

Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.

NIST discussion

The provision of water damage protection primarily applies to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Isolation valves can be employed in addition to or in lieu of master shutoff valves to shut off water supplies in specific areas of concern without affecting entire organizations.

Control enhancements

PE-15(1) Automation Support

Baselines: High

Detect the presence of water near the system and alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms].

Discussion and assessment objectives for PE-15(1)

Automated mechanisms include notification systems, water detection sensors, and alarms.

Determine if:

• PE-15(01)[01] the presence of water near the system can be detected automatically;
• PE-15(01)[02] [Assignment: organization-defined personnel or roles] is/are alerted using [Assignment: organization-defined automated mechanisms].

Examine: Physical and environmental protection policy; procedures addressing water damage protection; facility housing the system; automated mechanisms for water shutoff valves; automated mechanisms for detecting the presence of water in the vicinity of the system; alerts/notifications of water detection in system facility; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for system environmental controls; organizational personnel with information security responsibilities.

Test: Automated mechanisms supporting and/or implementing water detection capabilities and alerts for the system.

Assessment objectives (SP 800-53A)

Objectives and methods for PE-15

Determine if:

• PE-15[01] the system is protected from damage resulting from water leakage by providing master shutoff or isolation valves;
• PE-15[02] the master shutoff or isolation valves are accessible;
• PE-15[03] the master shutoff or isolation valves are working properly;
• PE-15[04] the master shutoff or isolation valves are known to key personnel.

Examine: Physical and environmental protection policy; procedures addressing water damage protection; facility housing the system; master shutoff valves; list of key personnel with knowledge of location and activation procedures for master shutoff valves for the plumbing system; master shutoff valve documentation; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for system environmental controls; organizational personnel with information security responsibilities.

Test: Master water-shutoff valves; organizational process for activating master water shutoff.

Policy statement

• The Facilities manager shall protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel. (PE-15)
• The valves shall be labeled, shown on a facility plan kept with the contingency plan, kept clear of obstructions, and exercised at least annually. (PE-15)
• Key personnel, including the staff who work in areas that contain system components, shall be shown the valve locations and how to operate them. (PE-15)
• Water pipes shall not run above system components where it can be avoided; where they do, the Facilities manager shall record the risk and the protection used, such as drip trays or leak detection. (PE-15)

PE-15(1) Automation support

• The Facilities manager shall detect the presence of water near the system and alert Fill in: personnel or roles to be alerted when the presence of water is detected near the system Typical: the facilities manager and the operations staff on duty for the facility using Fill in: automated mechanisms used to detect the presence of water near the system Typical: water detection sensors under raised floors, near cooling units and below any pipes in areas that contain system components, connected to the building management or environmental monitoring system. (PE-15(1))
• The water detection sensors and their alerts shall be tested at least annually. (PE-15(1))

From the Physical and Environmental Protection Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PE-15 asks you to protect the system from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel. NIST’s PE-15 discussion says it applies mainly to facilities with concentrations of system resources, such as data centers, server rooms and mainframe computer rooms, and that isolation valves can be used in addition to, or instead of, master shutoff valves to shut off water in specific areas without affecting the whole organization. PE-15 is in the Low, Moderate and High baselines.

Common implementations. The facilities manager identifies the valves that control water to and above each equipment room: the building’s master shutoff, and isolation valves for any pipes, cooling units or restrooms near the room. Each valve is tagged, shown on a floor plan kept with the contingency plan, and exercised once a year so it does not seize. New staff who work in equipment rooms are shown the valves during facility orientation. Where pipes cannot be kept away from equipment, drip trays or leak detection protect it.

Organization-defined parameters. PE-15 has none. The Physical and Environmental Protection policy has the facilities manager provide master shutoff or isolation valves that are accessible, working properly and known to key personnel. The valves are labeled, shown on a facility plan kept with the contingency plan, kept clear of obstructions, and exercised at least annually. Key personnel, including the staff who work in areas that contain system components, are shown the valve locations and how to operate them. Water pipes do not run above system components where it can be avoided; where they do, the facilities manager records the risk and the protection used, such as drip trays or leak detection.

Evidence assessors ask for.

• The facility plan showing the valves for each equipment room
• Observation of the valves: labeled, reachable and not blocked
• Interviews with key personnel: where the valve is and how to close it
• The record of the last annual exercise of each valve
• Any pipes above equipment, with the recorded risk and protection

Inheritance. For a system hosted in a cloud service or colocation data center, the provider protects its facility from water damage, and the system security plan records PE-15 as inherited for it, backed by the provider’s authorization or audit report. In a leased building, the landlord often controls the master shutoff; record who holds access to it and how staff reach them after hours. The organization meets PE-15 for its own server rooms as a common control run by the facilities manager.

Common findings.

• Staff in the server room who do not know where the shutoff valve is.
• A valve behind stored equipment, in a locked room only the landlord can open, or seized from never being turned.
• Sprinkler or condensate pipes directly above racks, with no protection or recorded risk.
• A server room under a restroom or kitchen, with no leak detection.

Enhancements in the Moderate baseline. None. High adds PE-15(1) automation support.

• PE-15(1) (High) detects water near the system and alerts the people you name, using automated mechanisms you name. NIST’s discussion lists notification systems, water detection sensors and alarms. Typical values: alert the facilities manager and the operations staff on duty for the facility, using water detection sensors under raised floors, near cooling units and below any pipes in areas that contain system components, connected to the building management or environmental monitoring system. The policy tests the sensors and their alerts at least annually. Alert the same people as the PE-14 environmental monitoring, so one on-call path covers both.

Artifacts

• Physical and Environmental Protection Decision Worksheet
• Physical and Environmental Protection Policy