Physical and Environmental Protection Decision Worksheet

Physical and Environmental Protection Decision Worksheet template: Every decision the Physical and Environmental Protection family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Physical and Environmental Protection family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every PE control in the baseline, with a typical value where the Physical and Environmental Protection Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV
Privacy	CSV

Decisions (Moderate baseline)

45 decisions.

Decision	Control	Typical value	Who decides
Which facilities house each system’s components, and does the organization or a provider run them?	PE-2, PE-3, PE-6, PE-14	Each system security plan lists the facilities that hold its components. For components in a cloud service or a colocation data center, the provider’s facility controls are inherited and recorded as such in the plan’s control implementation, backed by the provider’s authorization or audit report; the organization’s own offices, wiring closets and any server rooms stay in scope.	System owner
Who authorizes physical access, and how is the access list reviewed?	PE-2, PE-3, PE-3(1)	The supervisor requests access and the facilities manager approves it, with the system owner also approving access to areas that contain system components; the facilities manager keeps the physical access list, reviews it each quarter for those areas and each year for the rest of the facility, and removes access within the termination and transfer times of the Personnel Security Policy.	Facilities manager
How are visitors recorded and escorted?	PE-3, PE-8, PE-8(1), PE-8(3)	Every visitor to a non-public area signs in at reception, shows identification and receives a visitor badge that looks different from employee badges; an employee with access to the area escorts them at all times; the visitor log records only the elements the privacy risk assessment allows and is reviewed each month.	Facilities manager
Which environmental protections does the facility or the provider supply?	PE-9, PE-10, PE-11, PE-12, PE-13, PE-14, PE-15	For an organization’s own server room or data center, an uninterruptible power supply sized for an orderly shutdown (and a generator where the contingency plan’s recovery time objective requires it), emergency lighting, fire detection and suppression monitored by an alarm service, temperature and humidity monitoring with alerts, and known, labeled water shutoff valves; for a provider’s facility, the provider’s attested controls, inherited.	Facilities manager
Which alternate work sites are allowed, and what controls apply there?	PE-17	Employees’ homes, under an approved telework agreement, and other organization facilities; work only on organization-issued devices, or personally owned devices the organization approves and manages, connected through the approved remote access methods, in a workspace where screens and conversations are not overseen or overheard, with the Rules of Behavior covering the rest.	Chief Information Security Officer
Personnel or roles to whom the physical and environmental protection policy is to be disseminated	PE-1	Everyone within its scope, through the policy library	Facilities manager
Personnel or roles to whom the physical and environmental protection procedures are to be disseminated	PE-1	The people who carry them out, and the system owners	Facilities manager
Select one or more: organization-level; mission/business process-level; system-level	PE-1	Organization-level	Facilities manager
An official to manage the physical and environmental protection policy and procedures	PE-1	Facilities manager	Facilities manager
The frequency at which the current physical and environmental protection policy is reviewed and updated	PE-1	Annually	Facilities manager
Events that would require the current physical and environmental protection policy to be reviewed and updated	PE-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Facilities manager
The frequency at which the current physical and environmental protection procedures are reviewed and updated	PE-1	Annually	Facilities manager
Events that would require the physical and environmental protection procedures to be reviewed and updated	PE-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Facilities manager
Frequency at which to review the access list detailing authorized facility access by individuals	PE-2	At least quarterly for areas that contain system components, such as data centers, server rooms, wiring closets and media storage areas, and at least annually for the rest of the facility	Facilities manager
Entry and exit points to the facility in which the system resides	PE-3	Every entry and exit point of the facility, and of each area within it that contains system components	Facilities manager
Select one or more: organization-defined systems or devices (see its row below); guards	PE-3	An electronic physical access control system with badge readers at each controlled entry point, and guards or staffed reception at the main entrance during business hours	Facilities manager
Physical access control systems or devices used to control ingress and egress to the facility	PE-3	See the selection above	Facilities manager
Entry or exit points for which physical access logs are maintained	PE-3	Every controlled entry point to the facility and to each area that contains system components	Facilities manager
Physical access controls to control access to areas within the facility designated as publicly accessible	PE-3	A staffed reception or guard post, locked or badge-controlled doors between public and non-public areas, and no unattended system components or live network jacks in public areas	Facilities manager
Circumstances requiring visitor escorts and control of visitor activity	PE-3	At all times in non-public areas, for every visitor and for anyone without a physical access authorization for the area, including maintenance personnel who are not on the authorized maintenance list	Facilities manager
Physical access devices to be inventoried	PE-3	Keys, lock combinations, and badges and access cards, including unissued, temporary and visitor badges	Facilities manager
Frequency at which to inventory physical access devices	PE-3	At least annually	Facilities manager
Frequency at which to change combinations	PE-3	At least annually	Facilities manager
Frequency at which to change keys	PE-3	At least every five years, and sooner when an inventory cannot account for an issued key	Facilities manager
System distribution and transmission lines requiring physical access controls	PE-4	The network and telephone cabling, fiber, patch panels and wireless access points that carry the system’s communications, and the wiring closets and cable runs that hold them	Facilities manager
Security controls to be implemented to control physical access to system distribution and transmission lines within the organizational facility	PE-4	Locked wiring closets and telecommunications rooms with access limited to authorized staff, cabling in conduit or enclosed cable trays where it passes through public or shared areas, and unused network jacks disconnected at the patch panel or disabled on the switch	Facilities manager
Output devices that require physical access control to output	PE-5	Printers, copiers, scanners and fax machines in shared areas, and monitors that display information not approved for public release in areas visitors can see	Facilities manager
The frequency at which to review physical access logs	PE-6	At least monthly	Facilities manager
Events or potential indication of events requiring physical access logs to be reviewed	PE-6	A physical security incident or alarm, a lost or stolen badge or key, reported tailgating, access attempts outside normal working hours, and a request from the incident response team	Facilities manager
Time period for which to maintain visitor access records for the facility where the system resides	PE-8	2 years, or longer where the organization’s records retention schedule requires	Facilities manager
The frequency at which to review visitor access records	PE-8	At least monthly	Facilities manager
Personnel to whom visitor access records anomalies are reported to	PE-8	The facilities manager and the security operations team	Facilities manager
System or individual system components that require the capability to shut off power in emergency situations	PE-10	The equipment in each data center and server room, including servers, storage, network equipment and their cooling	Facilities manager
Location of emergency shutoff switches or devices by system or system component	PE-10	Beside the main exit of each data center and server room, clearly labeled	Facilities manager
Select one: an orderly shutdown of the system; transition of the system to long-term alternate power	PE-11	An orderly shutdown of the system	Facilities manager
Personnel or roles to be notified in the event of a fire	PE-13(1)	The facilities manager and the operations staff on duty for the facility	Facilities manager
Emergency responders to be notified in the event of a fire	PE-13(1)	The local fire department, through a monitored fire alarm service	Facilities manager
Select one or more: temperature; humidity; pressure; radiation; organization-defined environmental control (see its row below)	PE-14	Temperature and humidity	Facilities manager
Environmental control(s) for which to maintain a specified level in the facility where the system resides	PE-14	See the selection above	Facilities manager
Acceptable levels for environmental controls	PE-14	The operating ranges the equipment manufacturers specify, recorded in the system security plan	Facilities manager
Frequency at which to monitor environmental control levels	PE-14	Continuously, with automated alerts when a level leaves its range	Facilities manager
Types of system components to be authorized and controlled when entering the facility	PE-16	All system components, including servers, network devices, storage devices and media, and end-user devices such as laptops	Facilities manager
Types of system components to be authorized and controlled when exiting the facility	PE-16	All system components, including servers, network devices, storage devices and media, and end-user devices such as laptops	Facilities manager
Alternate work sites allowed for use by employees	PE-17	Employees’ homes, under an approved telework agreement, and other organization facilities	Facilities manager
Controls to be employed at alternate work sites	PE-17	Organization-issued devices, or personally owned devices the organization has approved and manages under its external system terms (AC-19, AC-20), connected through the approved remote access methods (AC-17), with full-disk encryption and screen lock (AC-11); a workspace where screens and conversations are not overseen or overheard; paper and media kept secured and not left unattended; and no printing of information not approved for public release on personal printers	Facilities manager