PE-18 Location of System Components
Guidance: nonePolicy clause: draftWhat these mean
pe18ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| High | Organization | None |
Related controls: CP-2, PE-5, PE-19, PE-20, RA-3
Control statement
Section titled “Control statement”Position system components within the facility to minimize potential damage from [Assignment: organization-defined physical and environmental hazards] and to minimize the opportunity for unauthorized access.
NIST discussion
Physical and environmental hazards include floods, fires, tornadoes, earthquakes, hurricanes, terrorism, vandalism, an electromagnetic pulse, electrical interference, and other forms of incoming electromagnetic radiation. Organizations consider the location of entry points where unauthorized individuals, while not being granted access, might nonetheless be near systems. Such proximity can increase the risk of unauthorized access to organizational communications using wireless packet sniffers or microphones, or unauthorized disclosure of information.
Withdrawn enhancements: PE-18(1).
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for PE-18
Determine if system components are positioned within the facility to minimize potential damage from [Assignment: organization-defined physical and environmental hazards] and to minimize the opportunity for unauthorized access.
Examine: Physical and environmental protection policy; procedures addressing the positioning of system components; documentation providing the location and position of system components within the facility; locations housing system components within the facility; list of physical and environmental hazards with the potential to damage system components within the facility; system security plan; other relevant documents or records.
Interview: Organizational personnel with responsibilities for positioning system components; organizational personnel with information security responsibilities.
Test: Organizational processes for positioning system components.
Policy statement
- The Facilities manager and the System owner shall position system components within the facility to minimize potential damage from Fill in: physical and environmental hazards that could result in potential damage to system components within the facility Typical: flooding, fire, water leaks from pipes and cooling, power disturbances and electrical interference, and the other hazards the risk assessment identifies for the site and to minimize the opportunity for unauthorized access. (PE-18)
- Areas that contain system components shall not adjoin public areas, delivery areas or exterior walls at ground level where an alternative exists, and the reasons for any exception shall be recorded with the risk assessment (RA-3). (PE-18)
From the Physical and Environmental Protection Policy template (draft). Highlighted fields are values your organization sets.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.