PE-16 Delivery and Removal

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	None

Related controls: CM-3, CM-8, MA-2, MA-3, MP-5, PE-20, SR-2, SR-3, SR-4, SR-6

Control statement

• a. Authorize and control [Assignment: organization-defined types of system components] entering and exiting the facility; and
• b. Maintain records of the system components.

NIST discussion

Enforcing authorizations for entry and exit of system components may require restricting access to delivery areas and isolating the areas from the system and media libraries.

Assessment objectives (SP 800-53A)

Objectives and methods for PE-16

Determine if:

• PE-16a.
  • PE-16a.[01] [Assignment: organization-defined types of system components] are authorized when entering the facility;
  • PE-16a.[02] [Assignment: organization-defined types of system components] are controlled when entering the facility;
  • PE-16a.[03] [Assignment: organization-defined types of system components] are authorized when exiting the facility;
  • PE-16a.[04] [Assignment: organization-defined types of system components] are controlled when exiting the facility;
• PE-16b. records of the system components are maintained.

Examine: Physical and environmental protection policy; procedures addressing the delivery and removal of system components from the facility; facility housing the system; records of items entering and exiting the facility; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for controlling system components entering and exiting the facility; organizational personnel with information security responsibilities.

Test: Organizational process for authorizing, monitoring, and controlling system-related items entering and exiting the facility; mechanisms supporting and/or implementing, authorizing, monitoring, and controlling system-related items entering and exiting the facility.

Policy statement

• The Facilities manager shall authorize and control Fill in: types of system components to be authorized and controlled when entering the facility Typical: all system components, including servers, network devices, storage devices and media, and end-user devices such as laptops entering the facility, receiving them only in a delivery area that is separated from areas that contain system components and media libraries. (PE-16a)
• Arriving components shall be checked against the purchase order or shipping record and for signs of tampering before they are moved out of the delivery area, and reported under the incident response plan if they show any. (PE-16a)
• The Facilities manager shall authorize and control Fill in: types of system components to be authorized and controlled when exiting the facility Typical: all system components, including servers, network devices, storage devices and media, and end-user devices such as laptops exiting the facility, letting a component leave only with the System owner’s approval and, for a component with storage, a record that its media were sanitized or removed (MA-2, MP-6). (PE-16a)
• The Facilities manager shall maintain records of the system components entering and exiting the facility: the item and serial number, the date, who delivered or carried it, who authorized it, and where it went. (PE-16b)
• Laptops and other devices issued to individuals may leave and return with their assigned user without a record of each trip, as long as they are recorded in the component inventory against that user. (PE-16a)

From the Physical and Environmental Protection Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PE-16 asks you to authorize and control the types of system components you name as they enter and leave the facility (a), and to keep records of them (b). NIST’s PE-16 discussion says enforcing these authorizations may require restricting access to delivery areas and isolating them from the system and media libraries. PE-16 is in the Low, Moderate and High baselines.

PE-16 is where other families’ rules meet the door. A component leaving for repair needs the system owner’s approval and sanitized media under the Maintenance Policy (MA-2) and the Media Protection Policy (MP-6). Media leaving a controlled area travel under MP-5. Arriving components are checked and recorded in the component inventory (CM-8) before they are connected.

Common implementations. Deliveries come to a loading dock or mail room that is separate from the equipment rooms and media storage. Receiving staff check each package against the purchase order and for signs of tampering, then log it and hand it to IT, who record it in the component inventory before it is installed. Equipment leaves only with a signed property pass or an approved ticket, which the guard or reception checks against the item. Components leaving for maintenance are recorded in the maintenance log, with the sanitization recorded in the media sanitization record. Laptops issued to individuals come and go with their users.

Organization-defined parameters. Typical values, from the Physical and Environmental Protection policy, which your organization may set differently:

Parameter	Typical value
Types of components controlled when entering (a)	All system components, including servers, network devices, storage devices and media, and end-user devices such as laptops
Types of components controlled when exiting (a)	All system components, including servers, network devices, storage devices and media, and end-user devices such as laptops

The policy receives components only in a delivery area separated from areas that contain system components and media libraries. Arriving components are checked against the purchase order or shipping record and for signs of tampering, and anything that shows signs is reported under the incident response plan. A component leaves only with the system owner’s approval and, if it has storage, a record that its media were sanitized or removed. The records hold the item and serial number, the date, who delivered or carried it, who authorized it, and where it went. Laptops and other devices issued to individuals may leave and return with their assigned user without a record of each trip, as long as the component inventory records them against that user.

Evidence assessors ask for.

• The delivery area, and how it is separated from equipment rooms and media storage
• The delivery and removal records for a recent period
• A recent delivery followed from receipt to the component inventory, and a recent removal followed from approval to its sanitization record
• The property pass or approval process, and who checks it at the exit
• The component inventory entries for issued laptops, showing the assigned user

Inheritance. For a system hosted in a cloud service or colocation data center, the provider controls components entering and leaving its facility, and the system security plan records PE-16 as inherited for it, backed by the provider’s authorization or audit report. For colocation, the organization usually still approves its own equipment’s shipments and removals through the provider’s process; record which part is whose. The organization meets PE-16 for its own facilities, usually as a common control run by the facilities manager.

Common findings.

• Deliveries left in the server room or an open hallway, with no check before installation.
• Equipment leaving for repair or disposal with no approval, or with its drive still in it.
• Delivery and removal records with no serial numbers, so they cannot be matched to the inventory.
• Retired equipment stacked by a door with no record of where it went.

Enhancements in the Moderate baseline. None. PE-16 has no enhancements.

Artifacts

• Component Inventory
• Physical and Environmental Protection Decision Worksheet
• Physical and Environmental Protection Policy