# Physical and Environmental Protection Policy

**Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/pe/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet PE-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the PE-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Physical and Environmental Protection, and who is accountable for meeting those requirements. (PE-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (PE-1a.1(a))

## Roles and responsibilities

- The [Facilities manager] is accountable for this policy and shall approve exceptions to it. (PE-1a.1(a))
- The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall manage the development, documentation and dissemination of this policy and its procedures. (PE-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (PE-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Facilities manager]. (PE-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (PE-1a.1(a))

## Coordination

The [Facilities manager] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (PE-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (PE-1a.1(b))
- The [Facilities manager] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (PE-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Facilities manager], time-limited and recorded with its compensating measures. (PE-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (PE-1a.1(a))

## Procedures

The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall ensure that documented procedures exist to implement this policy and its associated controls. (PE-1a.2)

## Dissemination

- The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall disseminate this policy to [Fill in: personnel or roles to whom the physical and environmental protection policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (PE-1a)
- The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the physical and environmental protection procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (PE-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Limit personally identifiable information elements (PE-8(3))

> **Guidance:** PE-8(3) is in the Privacy baseline only. NIST's discussion of this enhancement says organizations may have requirements that specify the contents of visitor access records, and that limiting personally identifiable information in them when it is not needed for operational purposes reduces privacy risk. Decide the elements in the system's or facility's [privacy impact assessment](https://kston83.github.io/nist-guide/templates/reports/privacy-impact-assessment/) and record them in the minimization entry, then configure the [visitor log](https://kston83.github.io/nist-guide/templates/forms/visitor-log/) or visitor management system to collect only those. Common excess elements are identity document numbers, photocopies or scans of identification, home addresses, dates of birth and vehicle details where no parking control needs them.

- The [Facilities manager] shall limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: [Fill in: elements identified in the privacy risk assessment to limit personally identifiable information contained in visitor access logs. Typical: the visitor's name and organization, the person visited, the purpose of the visit, the date and times of entry and departure, the badge issued and the escort; the type of identification checked, but not its number or a copy of it unless a law or regulation requires one]. (PE-8(3))
- The [Senior privacy official] shall review the elements before a visitor log, form or visitor management system is introduced or changed, and the [Facilities manager] shall remove any field that collects other elements. (PE-8(3))
- Visitor sign-in sheets shall be designed so that visitors cannot read earlier entries. (PE-8(3))

#### Federal systems

Under the Privacy Act, a system of records is a group of records under an agency's control from which information is retrieved by the name of the individual or by an identifying number, symbol or other identifying particular ([5 U.S.C. § 552a(a)(5)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)), and an agency must inform each individual it asks to supply information for one of the authority for asking and whether disclosure is mandatory or voluntary, the principal purposes, the routine uses, and the effects of not providing it ([§ 552a(e)(3)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). Text checked in the United States Code, 2024 edition, as of October 2026.

- Where visitor access records are retrieved by a visitor's name or other identifier, the [Senior privacy official] shall confirm they are covered by a published system of records notice, and the visitor log or visitor management system shall present the Privacy Act statement that 5 U.S.C. § 552a(e)(3) requires. (PE-8(3))

## Review and update

- The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall review and update this policy [Fill in: the frequency at which the current physical and environmental protection policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current physical and environmental protection policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (PE-1c.1)
- The [Fill in: an official to manage the physical and environmental protection policy and procedures. Typical: facilities manager] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current physical and environmental protection procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the physical and environmental protection procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (PE-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (PE-1a.1(b))