# Physical and Environmental Protection Policy

**Template version:** 1.0.0 · **Baseline:** High · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/pe/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet PE-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the PE-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Physical and Environmental Protection, and who is accountable for meeting those requirements. (PE-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (PE-1a.1(a))

## Roles and responsibilities

- The [Facilities manager] is accountable for this policy and shall approve exceptions to it. (PE-1a.1(a))
- The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall manage the development, documentation and dissemination of this policy and its procedures. (PE-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (PE-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Facilities manager]. (PE-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (PE-1a.1(a))

## Coordination

The [Facilities manager] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (PE-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (PE-1a.1(b))
- The [Facilities manager] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (PE-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Facilities manager], time-limited and recorded with its compensating measures. (PE-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (PE-1a.1(a))

## Procedures

The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall ensure that documented procedures exist to implement this policy and its associated controls. (PE-1a.2)

## Dissemination

- The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall disseminate this policy to [Fill in: personnel or roles to whom the physical and environmental protection policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (PE-1a)
- The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the physical and environmental protection procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (PE-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Physical access authorizations (PE-2)

> **Guidance:** PE-2 covers who may enter the facility where the system resides; PE-3 enforces it at the doors. NIST's PE-2 discussion says physical access authorizations apply to employees and visitors, that people with permanent credentials are not visitors, and that credentials include ID badges, identification cards and smart cards, with their strength set by applicable laws and policies. Areas designated as publicly accessible may not need an authorization. The [physical access list](https://kston83.github.io/nist-guide/templates/forms/physical-access-list/) holds the list, the credential issued, the approval and each review. Where the system runs entirely in a cloud service or a provider's data center, the provider meets PE-2 for its facility and the system security plan records it as inherited; the organization still applies PE-2 to its own offices and any rooms that hold its equipment. Assessors compare the list with recent departures and transfers, so tie removals to the [onboarding, transfer and termination checklist](https://kston83.github.io/nist-guide/templates/forms/onboarding-transfer-and-termination-checklist/).

- The [Facilities manager] shall develop, approve and maintain a list of individuals with authorized access to each facility where the system resides, showing for each person the areas they may enter. (PE-2a)
- Physical access shall be granted only on a request from the individual's supervisor, approved by the [Facilities manager] and, for areas that contain system components, also by the [System owner]. (PE-2a)
- The [Facilities manager] shall issue an authorization credential, such as an identification badge or access card, to each individual on the list, and record the credential against their entry. (PE-2b)
- The [Facilities manager] shall review the access list detailing authorized facility access by individuals [Fill in: frequency at which to review the access list detailing authorized facility access by individuals. Typical: at least quarterly for areas that contain system components, such as data centers, server rooms, wiring closets and media storage areas, and at least annually for the rest of the facility], with the supervisors or area owners confirming that each person still needs the access. (PE-2c)
- The [Facilities manager] shall remove individuals from the facility access list, and disable their credentials, when access is no longer required, and for a termination within the time the Personnel Security Policy sets for disabling system access (PS-4). (PE-2d)
- When an individual transfers, the [Facilities manager] shall remove physical access the new position does not need as part of the transfer actions (PS-5). (PE-2d)

#### Federal systems

[FIPS 201-3](https://csrc.nist.gov/pubs/fips/201-3/final) (January 2022) defines the Personal Identity Verification (PIV) Card as the common identity credential for federal employees and contractors for access to federally controlled facilities and information systems (section 1.2), and requires the PIV Card to be terminated when, among other circumstances, a federal employee separates from federal service or a contractor no longer needs access to federal buildings or systems (section 2.9.4). As of October 2026.

- For federal employees and contractors who hold a PIV Card, the authorization credential for access to a federally controlled facility shall be that PIV Card, registered in the physical access control system; anyone else receives a temporary or visitor credential that cannot be mistaken for a PIV Card. (PE-2b)
- When a PIV Card is terminated under FIPS 201-3 section 2.9.4, the [Facilities manager] shall remove its registration from the physical access control system. (PE-2d)

### Physical access control (PE-3)

> **Guidance:** PE-3 enforces the authorizations PE-2 grants. NIST's PE-3 discussion says physical access control applies to employees and visitors; that controls for publicly accessible areas may include logs, guards, or devices and barriers that stop movement from public to non-public areas; that physical access devices include keys, locks, combinations, biometric readers and card readers; and that audit logs can be procedural, automated or both. Access points can be the facility's doors, interior doors to areas that need extra control, or both. Escorts here match the maintenance escorts in the Maintenance Policy (MA-5), and the [visitor log](https://kston83.github.io/nist-guide/templates/forms/visitor-log/) records who escorted each visitor. The [physical access list](https://kston83.github.io/nist-guide/templates/forms/physical-access-list/) holds the inventory of keys, combinations and badges. For a system hosted in a cloud service or colocation data center, the provider's controls are inherited for its facility, and the system security plan says so; PE-3 still applies to the organization's own offices and equipment rooms.

- The [Facilities manager] shall enforce physical access authorizations at [Fill in: entry and exit points to the facility in which the system resides. Typical: every entry and exit point of the facility, and of each area within it that contains system components] by verifying each individual's access authorization before granting access to the facility. (PE-3a.1)
- The [Facilities manager] shall control ingress and egress to the facility using [Select one or more: [Assignment: organization-defined systems or devices]; guards. Typical: an electronic physical access control system with badge readers at each controlled entry point, and guards or staffed reception at the main entrance during business hours]. (PE-3a.2)
- Each person shall badge in individually at controlled entry points and shall not hold a controlled door open for others; tailgating shall be reported to the [Facilities manager]. (PE-3a.2)
- The [Facilities manager] shall maintain physical access audit logs for [Fill in: entry or exit points for which physical access logs are maintained. Typical: every controlled entry point to the facility and to each area that contains system components], and protect them from alteration and unauthorized access (AU-9). (PE-3b)
- The [Facilities manager] shall control access to areas within the facility designated as publicly accessible by implementing [Fill in: physical access controls to control access to areas within the facility designated as publicly accessible. Typical: a staffed reception or guard post, locked or badge-controlled doors between public and non-public areas, and no unattended system components or live network jacks in public areas]. (PE-3c)
- Visitors shall be escorted, and their activity controlled, [Fill in: circumstances requiring visitor escorts and control of visitor activity. Typical: at all times in non-public areas, for every visitor and for anyone without a physical access authorization for the area, including maintenance personnel who are not on the authorized maintenance list]; the escort shall stay with the visitor until they leave the non-public area. (PE-3d)
- Visitor and temporary badges shall look different from permanent badges, shall be valid only for the day or the approved period, and shall be returned on departure. (PE-3d)
- The [Facilities manager] shall secure keys, combinations and other physical access devices, keeping unissued devices locked away and limiting knowledge of combinations to the people authorized to use them. (PE-3e)
- The [Facilities manager] shall inventory [Fill in: physical access devices to be inventoried. Typical: keys, lock combinations, and badges and access cards, including unissued, temporary and visitor badges] [Fill in: frequency at which to inventory physical access devices. Typical: at least annually], and investigate any device that cannot be accounted for. (PE-3f)
- The [Facilities manager] shall change combinations [Fill in: frequency at which to change combinations. Typical: at least annually], change keys [Fill in: frequency at which to change keys. Typical: at least every five years, and sooner when an inventory cannot account for an issued key], and change both when keys are lost, combinations are compromised, or individuals possessing the keys or combinations are transferred or terminated. (PE-3g)
- A lost or stolen badge or key shall be reported to the [Facilities manager] at once, and the badge disabled the same day. (PE-3g)

#### Federal systems

[FIPS 201-3](https://csrc.nist.gov/pubs/fips/201-3/final) (January 2022), section 6.3.1, lists the PIV authentication mechanisms for physical access and the assurance each provides, marks visual inspection (VIS) and SYM-CAK as deprecated, and states that "The selection of authentication assurance levels SHALL be made in accordance with the applicable policies for a facility's security level", pointing to the Interagency Security Committee's standard and to SP 800-116. [NIST SP 800-116 Rev. 1](https://csrc.nist.gov/pubs/sp/800/116/r1/final) (June 2018), section 4.3, recommends a risk-based selection organized by Controlled, Limited and Exclusion areas, with a minimum of one, two and three authentication factors respectively (Table 4-3). The Interagency Security Committee's [The Risk Management Process: An Interagency Security Committee Standard](https://www.cisa.gov/publication/risk-management-process), 2024 Edition, states that it applies to federally owned or leased facilities regularly occupied by executive branch employees or contract workers for nonmilitary activities, and has the tenant make the final Facility Security Level (FSL) determination, from Level I to Level V (section 8.1.1). As of October 2026.

- The [Facilities manager] shall designate each area of a federally controlled facility as Controlled, Limited or Exclusion, consistent with the facility's FSL determination, and record the designation in the physical access list. (PE-3a)
- The physical access control system shall authenticate PIV Cards electronically, using mechanisms that provide at least one authentication factor for Controlled areas, two for Limited areas and three for Exclusion areas, as SP 800-116 Rev. 1 Table 4-3 recommends, and shall not rely on visual inspection of the card alone. (PE-3a.1)

### System access (PE-3(1))

> **Guidance:** PE-3(1) is in the High baseline. NIST's discussion of this enhancement says controlling physical access to the system adds protection for areas within facilities where system components are concentrated. In practice it is a second, separately authorized door: a badge that opens the building does not open the server room. Record those areas and who may enter them in the [physical access list](https://kston83.github.io/nist-guide/templates/forms/physical-access-list/).

- The [Facilities manager] shall enforce physical access authorizations to the system, in addition to the physical access controls for the facility, at [Fill in: physical spaces containing one or more components of the system. Typical: data centers, server rooms, wiring closets and media storage areas that contain components of the system]. (PE-3(1))
- Access to those spaces shall be authorized separately from facility access, approved by the [System owner], and limited to individuals whose duties require it. (PE-3(1))

### Access control for transmission (PE-4)

> **Guidance:** PE-4 is in the Moderate and High baselines. NIST's PE-4 discussion says these controls prevent accidental damage, disruption and physical tampering, and may also be needed to prevent eavesdropping on or modification of unencrypted transmissions; it lists disconnected or locked spare jacks, locked wiring closets, cabling in conduit or cable trays, and wiretapping sensors. Encryption in transit (SC-8) reduces the eavesdropping risk but not damage or disruption, so PE-4 still applies. In shared buildings, the landlord's riser and telecommunications rooms are often outside the organization's control; record who controls them and what the lease or agreement requires.

- The [Facilities manager] shall control physical access to [Fill in: system distribution and transmission lines requiring physical access controls. Typical: the network and telephone cabling, fiber, patch panels and wireless access points that carry the system's communications, and the wiring closets and cable runs that hold them] within organizational facilities using [Fill in: security controls to be implemented to control physical access to system distribution and transmission lines within the organizational facility. Typical: locked wiring closets and telecommunications rooms with access limited to authorized staff, cabling in conduit or enclosed cable trays where it passes through public or shared areas, and unused network jacks disconnected at the patch panel or disabled on the switch]. (PE-4)
- The [System owner] shall identify, in the system security plan, the distribution and transmission lines that serve the system and who controls the spaces they pass through, including spaces controlled by a landlord or provider. (PE-4)
- Wiring closets and telecommunications rooms shall be included in the physical access list, and entry to them recorded in the physical access logs. (PE-4)

### Access control for output devices (PE-5)

> **Guidance:** PE-5 is in the Moderate and High baselines. NIST's PE-5 discussion lists the ways to control output: output devices in locked rooms or secured areas with keypad or card reader access, devices placed where personnel can monitor them, monitor or screen filters, and headphones. Its examples of output devices are monitors, printers, scanners, audio devices, fax machines and copiers. Secure print release, where a job prints only after the user authenticates at the device, is the usual way to meet PE-5 for shared printers. The storage inside multifunction printers and copiers is media, sanitized under the Media Protection Policy before the device leaves (MP-6).

- The [System owner] and the [Facilities manager] shall control physical access to output from [Fill in: output devices that require physical access control to output. Typical: printers, copiers, scanners and fax machines in shared areas, and monitors that display information not approved for public release in areas visitors can see] to prevent unauthorized individuals from obtaining the output. (PE-5)
- Shared printers and copiers that output information not approved for public release shall release a job only after the user authenticates at the device, or shall be placed in a room limited to authorized individuals. (PE-5)
- Monitors in reception and other areas visitors can see shall be positioned away from them or fitted with privacy filters. (PE-5)
- Users shall collect output promptly; uncollected output shall be removed and destroyed at least daily. (PE-5)

### Monitoring physical access (PE-6)

> **Guidance:** NIST's PE-6 discussion says monitoring includes publicly accessible areas, and gives guards, video surveillance and sensors as examples. It lists suspicious physical access activity: accesses outside normal work hours, repeated accesses to areas not normally accessed, accesses for unusual lengths of time, and out-of-sequence accesses. Where the physical access control system logs electronically, its logs can feed the security operations team's monitoring (AU-2, AU-6). The investigation of a physical security incident is handled under the [incident response plan](https://kston83.github.io/nist-guide/templates/plans/incident-response-plan/). For a system hosted by a provider, its monitoring of its facility is inherited and recorded in the system security plan.

- The [Facilities manager] shall monitor physical access to the facility where the system resides, including publicly accessible areas, to detect and respond to physical security incidents. (PE-6a)
- The [Facilities manager] shall review physical access logs [Fill in: the frequency at which to review physical access logs. Typical: at least monthly] and upon occurrence of [Fill in: events or potential indication of events requiring physical access logs to be reviewed. Typical: a physical security incident or alarm, a lost or stolen badge or key, reported tailgating, access attempts outside normal working hours, and a request from the incident response team], looking for accesses outside normal working hours, repeated accesses to areas not normally accessed, accesses of unusual length and out-of-sequence accesses. (PE-6b)
- Each review shall be recorded with its date, the reviewer, the period covered and the anomalies found. (PE-6b)
- The [Facilities manager] shall coordinate the results of reviews and investigations with the [Incident response team], and report suspected physical security incidents under the incident response plan (IR-6). (PE-6c)

### Intrusion alarms and surveillance equipment (PE-6(1))

> **Guidance:** PE-6(1) is in the Moderate and High baselines. NIST's discussion of this enhancement says intrusion alarms alert security personnel when unauthorized access is attempted, working with barriers, access control systems and guards by triggering a response when they are breached; sensors include motion, contact and glass-break sensors, and surveillance equipment includes cameras at strategic locations. Keep video only as long as the records schedule allows, and treat recordings as personally identifiable information.

- The [Facilities manager] shall monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment. (PE-6(1))
- Intrusion alarms shall cover the facility's entry points and each area that contains system components when it is unoccupied, and shall alert guards, a monitoring service or designated staff who respond. (PE-6(1))
- Surveillance cameras shall cover the entry points to the facility and to each area that contains system components, and recordings shall be kept for the period the records schedule sets, with access limited to authorized staff. (PE-6(1))
- The [Facilities manager] shall test the alarms and check the cameras at least annually, and repair faults promptly. (PE-6(1))

### Monitoring physical access to systems (PE-6(4))

> **Guidance:** PE-6(4) is in the High baseline. NIST's discussion of this enhancement says it adds monitoring for areas where system components are concentrated, such as server rooms, media storage areas and communications centers, and that physical access monitoring can be coordinated with intrusion detection and system monitoring. Use the same spaces as PE-3(1), so every area with its own access control also has its own monitoring.

- The [Facilities manager] shall monitor physical access to the system, in addition to the physical access monitoring of the facility, at [Fill in: physical spaces containing one or more components of the system. Typical: data centers, server rooms, wiring closets and media storage areas that contain components of the system]. (PE-6(4))
- Physical access events for those spaces shall be sent to the [Security operations team] and correlated with system monitoring. (PE-6(4))

### Visitor access records (PE-8)

> **Guidance:** NIST's PE-8 discussion lists what visitor access records include: names and organizations of visitors, visitor signatures, forms of identification, dates of access, entry and departure times, purpose of visits, and names and organizations of the individuals visited. It says reviews determine whether access authorizations are current and still required, and that records are not required for publicly accessible areas. Where the organization adopts the Privacy baseline, PE-8(3) limits these elements to those the privacy risk assessment identifies. The [visitor log](https://kston83.github.io/nist-guide/templates/forms/visitor-log/) holds the fields, the reviews and the anomalies reported. Assessors pick a few dates and ask for that day's records, then for the last review.

- The [Facilities manager] shall maintain visitor access records to the facility where the system resides for [Fill in: time period for which to maintain visitor access records for the facility where the system resides. Typical: 2 years, or longer where the organization's records retention schedule requires]. (PE-8a)
- Each visitor record shall include the visitor's name and organization, the form of identification checked, the date, entry and departure times, the purpose of the visit, the name of the person visited, the badge issued and the escort, subject to the limits PE-8(3) sets where it applies. (PE-8a)
- The [Facilities manager] shall review visitor access records [Fill in: the frequency at which to review visitor access records. Typical: at least monthly], checking for visitors with no departure time, badges not returned, visits outside normal hours, repeated visits that suggest the person needs a PE-2 authorization instead, and visits without an escort. (PE-8b)
- The [Facilities manager] shall report anomalies in visitor access records to [Fill in: personnel to whom visitor access records anomalies are reported to. Typical: the facilities manager and the security operations team], and the security operations team shall handle any that suggest an incident under the incident response plan (IR-6). (PE-8c)

#### Federal systems

The National Archives and Records Administration's [General Records Schedule 5.6](https://www.archives.gov/files/records-mgmt/grs/grs05-6.pdf), Security Management Records (GRS Transmittal 35, May 2024), covers visitor processing records, such as registers or logs of visitors, contractors and service personnel. Item 110, for areas requiring the highest level of security awareness, including areas the Interagency Security Committee designates as Facility Security Level V, says destroy when 5 years old; item 111, for all other facility security areas, including Facility Security Levels I to IV, says destroy when 2 years old. Both allow longer retention if required for business use. As of October 2026.

- Visitor access records shall be kept for at least 5 years for areas at Facility Security Level V and at least 2 years for other areas, as GRS 5.6 items 110 and 111 set, unless the agency's own approved records schedule sets a different period. (PE-8a)

### Automated records maintenance and review (PE-8(1))

> **Guidance:** PE-8(1) is in the High baseline. NIST's discussion of this enhancement says visitor access records may be kept in a database accessible to organizational personnel, and that automated access makes regular reviews easier. An electronic visitor management system that prints the visitor badge and records the escort meets the maintenance half; the review half needs reports, such as open visits and badges not returned, that someone reads on the PE-8 schedule.

- The [Facilities manager] shall maintain visitor access records using [Fill in: automated mechanisms used to maintain visitor access records. Typical: an electronic visitor management system]. (PE-8(1))
- The [Facilities manager] shall review visitor access records using [Fill in: automated mechanisms used to review visitor access records. Typical: the visitor management system's reports, compared with the physical access control system's logs]. (PE-8(1))

### Power equipment and cabling (PE-9)

> **Guidance:** PE-9 is in the Moderate and High baselines. NIST's PE-9 discussion has organizations decide the protection needed for power equipment and cabling inside and outside their facilities, such as internal cabling and uninterruptible power supplies in offices or data centers, and generators and power cabling outside buildings. For a system hosted by a provider, PE-9 is inherited for the provider's facility.

- The [Facilities manager] shall protect power equipment and power cabling for the system from damage and destruction. (PE-9)
- Power distribution units, uninterruptible power supplies, transfer switches and generators that serve the system shall be in locked rooms or enclosures with access limited to authorized staff, and outdoor equipment shall be fenced or otherwise protected from vehicles and tampering. (PE-9)
- Power cabling shall be routed and labeled so that it is protected from accidental damage, kept separate from data cabling where practical, and not run across walkways. (PE-9)
- Power equipment shall be maintained as the manufacturer specifies, and the maintenance recorded. (PE-9)

### Emergency shutoff (PE-10)

> **Guidance:** PE-10 is in the Moderate and High baselines. NIST's PE-10 discussion says emergency power shutoff applies mainly to facilities with concentrations of system resources, such as data centers, mainframe rooms, server rooms and areas with computer-controlled machinery. An office with no server room usually has nothing to which PE-10 applies beyond the building's own electrical controls; say so in the system security plan rather than leaving it blank. Accidental activation is the common finding: an unguarded button beside a door that someone mistakes for a door release.

- The [Facilities manager] shall provide the capability of shutting off power to [Fill in: system or individual system components that require the capability to shut off power in emergency situations. Typical: the equipment in each data center and server room, including servers, storage, network equipment and their cooling] in emergency situations. (PE-10a)
- The [Facilities manager] shall place emergency shutoff switches or devices [Fill in: location of emergency shutoff switches or devices by system or system component. Typical: beside the main exit of each data center and server room, clearly labeled] to facilitate access for authorized personnel. (PE-10b)
- The [Facilities manager] shall protect the emergency power shutoff capability from unauthorized activation, with protective covers on the switches, placement inside the access-controlled area, and an alarm or camera that records activation. (PE-10c)
- Staff who work in those areas shall be shown the shutoff locations and told when to use them. (PE-10b)

### Emergency power (PE-11)

> **Guidance:** PE-11 is in the Moderate and High baselines. NIST's PE-11 discussion describes an uninterruptible power supply (UPS) as near-instantaneous protection from power interruptions, from batteries, supercapacitors or flywheels, with a short duration that gives time to start a standby source such as a generator or to shut the system down properly. Choose the selection from the [business impact analysis](https://kston83.github.io/nist-guide/templates/reports/business-impact-analysis/): if the system's recovery time objective tolerates waiting for power to return, an orderly shutdown is enough; if not, the UPS must carry the load until long-term alternate power takes over, and the [contingency plan](https://kston83.github.io/nist-guide/templates/plans/contingency-plan/) should say how. High systems add PE-11(1). For a system hosted by a provider, PE-11 is inherited.

- The [Facilities manager] shall provide an uninterruptible power supply to facilitate [Select one: an orderly shutdown of the system; transition of the system to long-term alternate power. Typical: an orderly shutdown of the system] in the event of a primary power source loss. (PE-11)
- Where the contingency plan's recovery time objective cannot be met by restarting the system after primary power returns, the [Facilities manager] shall also provide long-term alternate power, such as a generator, to which the uninterruptible power supply transitions the system. (PE-11)
- The [System owner] shall configure the system's components to shut down in order, automatically where they support it, before the uninterruptible power supply's batteries are exhausted. (PE-11)
- The [Facilities manager] shall test the uninterruptible power supply and any generator at least annually, replace batteries as the manufacturer specifies, and confirm the runtime still covers the load. (PE-11)

### Alternate power supply — minimal operational capability (PE-11(1))

> **Guidance:** PE-11(1) is in the High baseline. NIST's discussion of this enhancement says it can be met by a secondary commercial power supply or another external power supply. A generator with an automatic transfer switch is the usual way; size it and its fuel for the minimally required operational capability the contingency plan defines.

- The [Facilities manager] shall provide an alternate power supply for the system that is activated [Select one: manually; automatically. Typical: automatically] and that can maintain minimally required operational capability in the event of an extended loss of the primary power source. (PE-11(1))
- The [System owner] shall define the minimally required operational capability in the contingency plan, and the [Facilities manager] shall keep fuel or supply contracts sufficient to sustain it for the outage duration the plan assumes. (PE-11(1))

### Emergency lighting (PE-12)

> **Guidance:** NIST's PE-12 discussion says emergency lighting applies mainly to facilities with concentrations of system resources, such as data centers, server rooms and mainframe rooms; that emergency lighting provisions are described in the organization's contingency plan; and that if emergency lighting fails or cannot be provided, organizations consider alternate processing sites for power-related contingencies. Building and fire codes usually require emergency lighting already; PE-12 asks that it cover the rooms that hold the system and be maintained.

- The [Facilities manager] shall employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility. (PE-12)
- The [Facilities manager] shall test emergency lighting at least annually, and repair failures promptly. (PE-12)
- The [System owner] shall describe the emergency lighting provisions for the system in the contingency plan (CP-2). (PE-12)

### Fire protection (PE-13)

> **Guidance:** NIST's PE-13 discussion says fire detection and suppression applies mainly to facilities with concentrations of system resources, such as data centers, server rooms and mainframe rooms; that systems that may need an independent energy source include sprinkler systems and smoke detectors; and that an independent energy source, such as a microgrid, is one separate, or separable, from the sources powering the rest of the facility. Building and fire codes and the local fire authority set most of the details; the policy makes sure the rooms that hold the system are covered and the systems are maintained. For a system hosted by a provider, PE-13 is inherited.

- The [Facilities manager] shall employ and maintain fire detection and suppression systems, supported by an independent energy source, that cover each area containing system components. (PE-13)
- Fire detection and suppression systems shall be inspected, tested and maintained as the applicable fire code and the manufacturer require, and the records kept. (PE-13)
- Where the suppression system could itself damage equipment, such as water sprinklers in a server room, the [Facilities manager] shall record the choice and the reason, with the system owner's agreement. (PE-13)

### Detection systems — automatic activation and notification (PE-13(1))

> **Guidance:** PE-13(1) is in the Moderate and High baselines. NIST's discussion of this enhancement says organizations can name personnel, roles and emergency responders when people on the notification list need access authorizations or clearances to enter restricted facilities, and that notification mechanisms may need independent energy sources so a fire does not disable them. Check the notification path in the annual fire system test.

- The [Facilities manager] shall employ fire detection systems that activate automatically and notify [Fill in: personnel or roles to be notified in the event of a fire. Typical: the facilities manager and the operations staff on duty for the facility] and [Fill in: emergency responders to be notified in the event of a fire. Typical: the local fire department, through a monitored fire alarm service] in the event of a fire. (PE-13(1))
- The notification path shall have power independent of the facility's main supply, and shall be tested with the fire detection system. (PE-13(1))

### Suppression systems — automatic activation and notification (PE-13(2))

> **Guidance:** PE-13(2) is in the High baseline. NIST's discussion of this enhancement matches PE-13(1)'s: name personnel and responders where access authorizations are needed to enter, and give the notification mechanism an independent energy source. Use the same notification list as PE-13(1).

- The [Facilities manager] shall employ fire suppression systems that activate automatically and notify [Fill in: personnel or roles to be notified in the event of a fire. Typical: the facilities manager and the operations staff on duty for the facility] and [Fill in: emergency responders to be notified in the event of a fire. Typical: the local fire department, through a monitored fire alarm service]. (PE-13(2)(a))
- The [Facilities manager] shall employ an automatic fire suppression capability when the facility is not staffed on a continuous basis. (PE-13(2)(b))

### Environmental controls (PE-14)

> **Guidance:** NIST's PE-14 discussion says environmental controls apply mainly to facilities with concentrations of system resources, such as data centers, mainframe rooms and server rooms, and that insufficient controls, especially in harsh environments, can significantly affect the availability of systems that support mission and business functions. Pressure and radiation matter only in special environments; add them, or another control such as dust, where the site needs it. A server room cooled by the building's office air conditioning, which shuts off at night or on weekends, is a common finding. For a system hosted by a provider, PE-14 is inherited.

- The [Facilities manager] shall maintain [Select one or more: temperature; humidity; pressure; radiation; [Assignment: organization-defined environmental control]. Typical: temperature and humidity] levels within the facility where the system resides at [Fill in: acceptable levels for environmental controls. Typical: the operating ranges the equipment manufacturers specify, recorded in the system security plan]. (PE-14a)
- The [Facilities manager] shall monitor environmental control levels [Fill in: frequency at which to monitor environmental control levels. Typical: continuously, with automated alerts when a level leaves its range]. (PE-14b)
- Alerts shall go to staff who can respond at any hour, and an alert that is not resolved within the time the contingency plan allows shall start the contingency plan's notification procedures (CP-2). (PE-14b)
- Cooling for areas that contain system components shall run independently of the building's office schedule, with enough capacity or redundancy that the loss of one unit does not take the room out of range. (PE-14a)

### Water damage protection (PE-15)

> **Guidance:** NIST's PE-15 discussion says water damage protection applies mainly to facilities with concentrations of system resources, such as data centers, server rooms and mainframe rooms, and that isolation valves can be used in addition to, or instead of, master shutoff valves to shut off water in specific areas without affecting the whole organization. Assessors ask staff where the valve is and check that it is labeled and reachable. For a system hosted by a provider, PE-15 is inherited.

- The [Facilities manager] shall protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel. (PE-15)
- The valves shall be labeled, shown on a facility plan kept with the contingency plan, kept clear of obstructions, and exercised at least annually. (PE-15)
- Key personnel, including the staff who work in areas that contain system components, shall be shown the valve locations and how to operate them. (PE-15)
- Water pipes shall not run above system components where it can be avoided; where they do, the [Facilities manager] shall record the risk and the protection used, such as drip trays or leak detection. (PE-15)

### Automation support (PE-15(1))

> **Guidance:** PE-15(1) is in the High baseline. NIST's discussion of this enhancement lists notification systems, water detection sensors and alarms as automated mechanisms. Alert the same people as the environmental monitoring in PE-14, so one on-call path covers both.

- The [Facilities manager] shall detect the presence of water near the system and alert [Fill in: personnel or roles to be alerted when the presence of water is detected near the system. Typical: the facilities manager and the operations staff on duty for the facility] using [Fill in: automated mechanisms used to detect the presence of water near the system. Typical: water detection sensors under raised floors, near cooling units and below any pipes in areas that contain system components, connected to the building management or environmental monitoring system]. (PE-15(1))
- The water detection sensors and their alerts shall be tested at least annually. (PE-15(1))

### Delivery and removal (PE-16)

> **Guidance:** NIST's PE-16 discussion says enforcing authorizations for components entering and leaving the facility may require restricting access to delivery areas and isolating them from the system and media libraries. PE-16 is where the other families' removal rules meet the door: a component leaving for repair needs the system owner's approval and sanitized media under the Maintenance Policy (MA-2), media leaving a controlled area travel under the Media Protection Policy (MP-5), and arriving components are checked against the order and recorded in the component inventory (CM-8) before they are connected. Assessors pick a recent delivery and a recent removal and follow each through the records.

- The [Facilities manager] shall authorize and control [Fill in: types of system components to be authorized and controlled when entering the facility. Typical: all system components, including servers, network devices, storage devices and media, and end-user devices such as laptops] entering the facility, receiving them only in a delivery area that is separated from areas that contain system components and media libraries. (PE-16a)
- Arriving components shall be checked against the purchase order or shipping record and for signs of tampering before they are moved out of the delivery area, and reported under the incident response plan if they show any. (PE-16a)
- The [Facilities manager] shall authorize and control [Fill in: types of system components to be authorized and controlled when exiting the facility. Typical: all system components, including servers, network devices, storage devices and media, and end-user devices such as laptops] exiting the facility, letting a component leave only with the [System owner]'s approval and, for a component with storage, a record that its media were sanitized or removed (MA-2, MP-6). (PE-16a)
- The [Facilities manager] shall maintain records of the system components entering and exiting the facility: the item and serial number, the date, who delivered or carried it, who authorized it, and where it went. (PE-16b)
- Laptops and other devices issued to individuals may leave and return with their assigned user without a record of each trip, as long as they are recorded in the component inventory against that user. (PE-16a)

### Alternate work site (PE-17)

> **Guidance:** PE-17 is in the Moderate and High baselines. NIST's PE-17 discussion says alternate work sites include government facilities and employees' private residences; that they are distinct from alternate processing sites but can serve as alternate locations during contingency operations; and that organizations can set different controls for different types of site. The controls here should match the [Rules of Behavior](https://kston83.github.io/nist-guide/templates/forms/rules-of-behavior/), which every user signs, and the remote access requirements of the Access Control Policy (AC-17). [NIST SP 800-46 Rev. 2](https://csrc.nist.gov/pubs/sp/800/46/r2/final) (July 2016), Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security, covers securing telework and remote access; Rev. 2 is the final version; a Rev. 3 pre-draft call for comments closed in October 2020, and csrc.nist.gov lists no later draft as of October 2026. Assessing effectiveness at homes is usually done through a self-assessment checklist and the endpoint management data for the devices used there, not site visits.

- The [Chief Information Security Officer] shall determine and document [Fill in: alternate work sites allowed for use by employees. Typical: employees' homes, under an approved telework agreement, and other organization facilities] as the alternate work sites allowed for use by employees, and the [Supervisor] shall approve each employee's use of them. (PE-17a)
- The following controls shall be employed at alternate work sites: [Fill in: controls to be employed at alternate work sites. Typical: organization-issued devices, or personally owned devices the organization has approved and manages under its external system terms (AC-19, AC-20), connected through the approved remote access methods (AC-17), with full-disk encryption and screen lock (AC-11); a workspace where screens and conversations are not overseen or overheard; paper and media kept secured and not left unattended; and no printing of information not approved for public release on personal printers]. (PE-17b)
- The [Chief Information Security Officer] shall assess the effectiveness of controls at alternate work sites at least annually, through an employee self-assessment and the device compliance data from endpoint management, and act on the gaps found. (PE-17c)
- The [Chief Information Security Officer] shall provide a means for employees at alternate work sites to communicate with information security and privacy personnel in case of incidents, available at all hours, and employees shall report incidents through it as the Rules of Behavior require (IR-6). (PE-17d)

#### Federal systems

Under [5 U.S.C. § 6502](https://www.govinfo.gov/link/uscode/5/6502?link-type=html), each executive agency's telework policy must require a written agreement between an agency manager and each employee authorized to telework, outlining the specific work arrangement, which is mandatory for any employee to telework (subsection (b)(2)); must be part of the agency's continuity of operations plans (subsection (b)(5)); and must enumerate when employees may temporarily work from approved overseas locations (subsection (b)(6)). Text checked in the United States Code, 2024 edition, as of October 2026.

- No employee shall telework without the written telework agreement 5 U.S.C. § 6502(b)(2) requires, and the agreement shall reference the alternate work site controls in this policy. (PE-17a)
- Work from an overseas location shall be allowed only in the circumstances the agency's telework policy enumerates under 5 U.S.C. § 6502(b)(6). (PE-17a)

### Location of system components (PE-18)

> **Guidance:** PE-18 is in the High baseline. NIST's PE-18 discussion lists physical and environmental hazards, including floods, fires, tornadoes, earthquakes, hurricanes, terrorism, vandalism, an electromagnetic pulse and electrical interference, and asks organizations to consider entry points where unauthorized individuals, though not granted access, might be near systems, which can increase the risk of interception with wireless sniffers or microphones. Server rooms on a basement level below a water source, or beside a public corridor or loading dock, are the usual examples.

- The [Facilities manager] and the [System owner] shall position system components within the facility to minimize potential damage from [Fill in: physical and environmental hazards that could result in potential damage to system components within the facility. Typical: flooding, fire, water leaks from pipes and cooling, power disturbances and electrical interference, and the other hazards the risk assessment identifies for the site] and to minimize the opportunity for unauthorized access. (PE-18)
- Areas that contain system components shall not adjoin public areas, delivery areas or exterior walls at ground level where an alternative exists, and the reasons for any exception shall be recorded with the risk assessment (RA-3). (PE-18)

## Review and update

- The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall review and update this policy [Fill in: the frequency at which the current physical and environmental protection policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current physical and environmental protection policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (PE-1c.1)
- The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current physical and environmental protection procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the physical and environmental protection procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (PE-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (PE-1a.1(b))