+PE Physical and Environmental Protection
---+PE-01 Policy and Procedures
---+PE-02 Physical Access Authorizations
------+PE-02(01) Access by Position or Role
------+PE-02(02) Two Forms of Identification
------+PE-02(03) Restrict Unescorted Access
---+PE-03 Physical Access Control
------+PE-03(01) System Access
------+PE-03(02) Facility and Systems
------+PE-03(03) Continuous Guards
------+PE-03(04) Lockable Casings
------+PE-03(05) Tamper Protection
------+PE-03(07) Physical Barriers
------+PE-03(08) Access Control Vestibules
---+PE-04 Access Control for Transmission
---+PE-05 Access Control for Output Devices
------+PE-05(02) Link to Individual Identity
---+PE-06 Monitoring Physical Access
------+PE-06(01) Intrusion Alarms and Surveillance Equipment
------+PE-06(02) Automated Intrusion Recognition and Responses
------+PE-06(03) Video Surveillance
------+PE-06(04) Monitoring Physical Access to Systems
---+PE-07 Visitor Control
---+PE-08 Visitor Access Records
------+PE-08(01) Automated Records Maintenance and Review
------+PE-08(03) Limit Personally Identifiable Information Elements
---+PE-09 Power Equipment and Cabling
------+PE-09(01) Redundant Cabling
------+PE-09(02) Automatic Voltage Controls
---+PE-10 Emergency Shutoff
---+PE-11 Emergency Power
------+PE-11(01) Alternate Power Supply — Minimal Operational Capability
------+PE-11(02) Alternate Power Supply — Self-contained
---+PE-12 Emergency Lighting
------+PE-12(01) Essential Mission and Business Functions
---+PE-13 Fire Protection
------+PE-13(01) Detection Systems — Automatic Activation and Notification
------+PE-13(02) Suppression Systems — Automatic Activation and Notification
------+PE-13(04) Inspections
---+PE-14 Environmental Controls
------+PE-14(01) Automatic Controls
------+PE-14(02) Monitoring with Alarms and Notifications
---+PE-15 Water Damage Protection
------+PE-15(01) Automation Support
---+PE-16 Delivery and Removal
---+PE-17 Alternate Work Site
---+PE-18 Location of System Components
---+PE-19 Information Leakage
------+PE-19(01) National Emissions Policies and Procedures
---+PE-20 Asset Monitoring and Tracking
---+PE-21 Electromagnetic Pulse Protection
---+PE-22 Component Marking
---+PE-23 Facility Location

PE Physical and Environmental Protection

Physical and Environmental Protection

1. Přehled

PE-01 Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] physical and environmental protection policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the physical and environmental protection policy and the associated physical and environmental protection controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures; and
  3. Review and update the current physical and environmental protection:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Physical and environmental protection policy and procedures address the controls in the PE family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of physical and environmental protection policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to physical and environmental protection policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a physical and environmental protection policy is developed and documented;
    2. the physical and environmental protection policy is disseminated to [Assignement: personnel or roles];
    3. physical and environmental protection procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls are developed and documented;
    4. the physical and environmental protection procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] physical and environmental protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures;
      1. the current physical and environmental protection policy is reviewed and updated [Assignement: frequency];
      2. the current physical and environmental protection policy is reviewed and updated following [Assignement: events];
      1. the current physical and environmental protection procedures are reviewed and updated [Assignement: frequency];
      2. the current physical and environmental protection procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Physical and environmental protection policy and procedures system security plan privacy plan organizational risk management strategy other relevant documents or records

Interview

Organizational personnel with physical and environmental protection responsibilities organizational personnel with information security and privacy responsibilities
PE-02 Physical Access Authorizations

Control

  1. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides;
  2. Issue authorization credentials for facility access;
  3. Review the access list detailing authorized facility access by individuals [Assignement: frequency] ; and
  4. Remove individuals from the facility access list when access is no longer required.

Discussion

Physical access authorizations apply to employees and visitors. Individuals with permanent physical access authorization credentials are not considered visitors. Authorization credentials include ID badges, identification cards, and smart cards. Organizations determine the strength of authorization credentials needed consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Physical access authorizations may not be necessary to access certain areas within facilities that are designated as publicly accessible.

Assessment Objective

    1. a list of individuals with authorized access to the facility where the system resides has been developed;
    2. the list of individuals with authorized access to the facility where the system resides has been approved;
    3. the list of individuals with authorized access to the facility where the system resides has been maintained;
  2. authorization credentials are issued for facility access;
  3. the access list detailing authorized facility access by individuals is reviewed [Assignement: frequency];
  4. individuals are removed from the facility access list when access is no longer required.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing physical access authorizations authorized personnel access list authorization credentials physical access list reviews physical access termination records and associated documentation system security plan other relevant documents or records

Interview

Organizational personnel with physical access authorization responsibilities organizational personnel with physical access to system facility organizational personnel with information security responsibilities
PE-03 Physical Access Control

Control

  1. Enforce physical access authorizations at [Assignement: entry and exit points] by:
    1. Verifying individual access authorizations before granting access to the facility; and
    2. Controlling ingress and egress to the facility using [Selection(one-or-more): {{ insert: param, pe-03_odp.03 }} ; guards];
  2. Maintain physical access audit logs for [Assignement: entry or exit points];
  3. Control access to areas within the facility designated as publicly accessible by implementing the following controls: [Assignement: physical access controls];
  4. Escort visitors and control visitor activity [Assignement: circumstances];
  5. Secure keys, combinations, and other physical access devices;
  6. Inventory [Assignement: physical access devices] every [Assignement: frequency] ; and
  7. Change combinations and keys [Assignement: organization-defined frequency] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

Discussion

Physical access control applies to employees and visitors. Individuals with permanent physical access authorizations are not considered visitors. Physical access controls for publicly accessible areas may include physical access control logs/records, guards, or physical access devices and barriers to prevent movement from publicly accessible areas to non-public areas. Organizations determine the types of guards needed, including professional security staff, system users, or administrative staff. Physical access devices include keys, locks, combinations, biometric readers, and card readers. Physical access control systems comply with applicable laws, executive orders, directives, policies, regulations, standards, and guidelines. Organizations have flexibility in the types of audit logs employed. Audit logs can be procedural, automated, or some combination thereof. Physical access points can include facility access points, interior access points to systems that require supplemental access controls, or both. Components of systems may be in areas designated as publicly accessible with organizations controlling access to the components.

Assessment Objective

    1. physical access authorizations are enforced at [Assignement: entry and exit points] by verifying individual access authorizations before granting access to the facility;
    2. physical access authorizations are enforced at [Assignement: entry and exit points] by controlling ingress and egress to the facility using [Selection(one-or-more): {{ insert: param, pe-03_odp.03 }} ; guards];
  2. physical access audit logs are maintained for [Assignement: entry or exit points];
  3. access to areas within the facility designated as publicly accessible are maintained by implementing [Assignement: physical access controls];
    1. visitors are escorted;
    2. visitor activity is controlled [Assignement: circumstances];
    1. keys are secured;
    2. combinations are secured;
    3. other physical access devices are secured;
  6. [Assignement: physical access devices] are inventoried [Assignement: frequency];
    1. combinations are changed [Assignement: frequency] , when combinations are compromised, or when individuals possessing the combinations are transferred or terminated;
    2. keys are changed [Assignement: frequency] , when keys are lost, or when individuals possessing the keys are transferred or terminated.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing physical access control physical access control logs or records inventory records of physical access control devices system entry and exit points records of key and lock combination changes storage locations for physical access control devices physical access control devices list of security safeguards controlling access to designated publicly accessible areas within facility system security plan other relevant documents or records

Interview

Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities
PE-04 Access Control for Transmission

Control

Control physical access to [Assignement: system distribution and transmission lines] within organizational facilities using [Assignement: security controls].

Discussion

Security controls applied to system distribution and transmission lines prevent accidental damage, disruption, and physical tampering. Such controls may also be necessary to prevent eavesdropping or modification of unencrypted transmissions. Security controls used to control physical access to system distribution and transmission lines include disconnected or locked spare jacks, locked wiring closets, protection of cabling by conduit or cable trays, and wiretapping sensors.

Assessment Objective

physical access to [Assignement: system distribution and transmission lines] within organizational facilities is controlled using [Assignement: security controls].

Assessment Method

Examine

Physical and environmental protection policy procedures addressing access control for transmission mediums system design documentation facility communications and wiring diagrams list of physical security safeguards applied to system distribution and transmission lines system security plan other relevant documents or records

Interview

Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities
PE-05 Access Control for Output Devices

Control

Control physical access to output from [Assignement: output devices] to prevent unauthorized individuals from obtaining the output.

Discussion

Controlling physical access to output devices includes placing output devices in locked rooms or other secured areas with keypad or card reader access controls and allowing access to authorized individuals only, placing output devices in locations that can be monitored by personnel, installing monitor or screen filters, and using headphones. Examples of output devices include monitors, printers, scanners, audio devices, facsimile machines, and copiers.

Assessment Objective

physical access to output from [Assignement: output devices] is controlled to prevent unauthorized individuals from obtaining the output.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing access control for display medium facility layout of system components actual displays from system components list of output devices and associated outputs requiring physical access controls physical access control logs or records for areas containing output devices and related outputs system security plan other relevant documents or records

Interview

Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities
PE-06 Monitoring Physical Access

Control

  1. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents;
  2. Review physical access logs [Assignement: frequency] and upon occurrence of [Assignement: events] ; and
  3. Coordinate results of reviews and investigations with the organizational incident response capability.

Discussion

Physical access monitoring includes publicly accessible areas within organizational facilities. Examples of physical access monitoring include the employment of guards, video surveillance equipment (i.e., cameras), and sensor devices. Reviewing physical access logs can help identify suspicious activity, anomalous events, or potential threats. The reviews can be supported by audit logging controls, such as [AU-2](#au-2) , if the access logs are part of an automated system. Organizational incident response capabilities include investigations of physical security incidents and responses to the incidents. Incidents include security violations or suspicious physical access activities. Suspicious physical access activities include accesses outside of normal work hours, repeated accesses to areas not normally accessed, accesses for unusual lengths of time, and out-of-sequence accesses.

Assessment Objective

  1. physical access to the facility where the system resides is monitored to detect and respond to physical security incidents;
    1. physical access logs are reviewed [Assignement: frequency];
    2. physical access logs are reviewed upon occurrence of [Assignement: events];
    1. results of reviews are coordinated with organizational incident response capabilities;
    2. results of investigations are coordinated with organizational incident response capabilities.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing physical access monitoring physical access logs or records physical access monitoring records physical access log reviews system security plan other relevant documents or records

Interview

Organizational personnel with physical access monitoring responsibilities organizational personnel with incident response responsibilities organizational personnel with information security responsibilities
PE-07 Visitor Control

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview
PE-08 Visitor Access Records

Control

  1. Maintain visitor access records to the facility where the system resides for [Assignement: time period];
  2. Review visitor access records [Assignement: frequency] ; and
  3. Report anomalies in visitor access records to [Assignement: personnel].

Discussion

Visitor access records include the names and organizations of individuals visiting, visitor signatures, forms of identification, dates of access, entry and departure times, purpose of visits, and the names and organizations of individuals visited. Access record reviews determine if access authorizations are current and are still required to support organizational mission and business functions. Access records are not required for publicly accessible areas.

Assessment Objective

  1. visitor access records for the facility where the system resides are maintained for [Assignement: time period];
  2. visitor access records are reviewed [Assignement: frequency];
  3. visitor access records anomalies are reported to [Assignement: personnel].

Assessment Method

Examine

Physical and environmental protection policy procedures addressing visitor access records visitor access control logs or records visitor access record or log reviews system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel with visitor access record responsibilities organizational personnel with information security and privacy responsibilities
PE-09 Power Equipment and Cabling

Control

Protect power equipment and power cabling for the system from damage and destruction.

Discussion

Organizations determine the types of protection necessary for the power equipment and cabling employed at different locations that are both internal and external to organizational facilities and environments of operation. Types of power equipment and cabling include internal cabling and uninterruptable power sources in offices or data centers, generators and power cabling outside of buildings, and power sources for self-contained components such as satellites, vehicles, and other deployable systems.

Assessment Objective

  1. power equipment for the system is protected from damage and destruction;
  2. power cabling for the system is protected from damage and destruction.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing power equipment/cabling protection facilities housing power equipment/cabling system security plan other relevant documents or records

Interview

Organizational personnel with the responsibility to protect power equipment/cabling organizational personnel with information security responsibilities
PE-10 Emergency Shutoff

Control

  1. Provide the capability of shutting off power to [Assignement: system or individual system components] in emergency situations;
  2. Place emergency shutoff switches or devices in [Assignement: location] to facilitate access for authorized personnel; and
  3. Protect emergency power shutoff capability from unauthorized activation.

Discussion

Emergency power shutoff primarily applies to organizational facilities that contain concentrations of system resources, including data centers, mainframe computer rooms, server rooms, and areas with computer-controlled machinery.

Assessment Objective

  1. the capability to shut off power to [Assignement: system or individual system components] in emergency situations is provided;
  2. emergency shutoff switches or devices are placed in [Assignement: location] to facilitate access for authorized personnel;
  3. the emergency power shutoff capability is protected from unauthorized activation.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing power source emergency shutoff emergency shutoff controls or switches locations housing emergency shutoff switches and devices security safeguards protecting the emergency power shutoff capability from unauthorized activation system security plan other relevant documents or records

Interview

Organizational personnel with the responsibility for the emergency power shutoff capability (both implementing and using the capability) organizational personnel with information security responsibilities
PE-11 Emergency Power

Control

Provide an uninterruptible power supply to facilitate [Selection: an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss.

Discussion

An uninterruptible power supply (UPS) is an electrical system or mechanism that provides emergency power when there is a failure of the main power source. A UPS is typically used to protect computers, data centers, telecommunication equipment, or other electrical equipment where an unexpected power disruption could cause injuries, fatalities, serious mission or business disruption, or loss of data or information. A UPS differs from an emergency power system or backup generator in that the UPS provides near-instantaneous protection from unanticipated power interruptions from the main power source by providing energy stored in batteries, supercapacitors, or flywheels. The battery duration of a UPS is relatively short but provides sufficient time to start a standby power source, such as a backup generator, or properly shut down the system.

Assessment Objective

an uninterruptible power supply is provided to facilitate [Selection: an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing emergency power uninterruptible power supply uninterruptible power supply documentation uninterruptible power supply test records system security plan other relevant documents or records

Interview

Organizational personnel with the responsibility for emergency power and/or planning organizational personnel with information security responsibilities
PE-12 Emergency Lighting

Control

Employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.

Discussion

The provision of emergency lighting applies primarily to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Emergency lighting provisions for the system are described in the contingency plan for the organization. If emergency lighting for the system fails or cannot be provided, organizations consider alternate processing sites for power-related contingencies.

Assessment Objective

  1. automatic emergency lighting that activates in the event of a power outage or disruption is employed for the system;
  2. automatic emergency lighting that activates in the event of a power outage or disruption is maintained for the system;
  3. automatic emergency lighting for the system covers emergency exits within the facility;
  4. automatic emergency lighting for the system covers evacuation routes within the facility.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing emergency lighting emergency lighting documentation emergency lighting test records emergency exits and evacuation routes system security plan other relevant documents or records

Interview

Organizational personnel with the responsibility for emergency lighting and/or planning organizational personnel with information security responsibilities
PE-13 Fire Protection

Control

Employ and maintain fire detection and suppression systems that are supported by an independent energy source.

Discussion

The provision of fire detection and suppression systems applies primarily to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Fire detection and suppression systems that may require an independent energy source include sprinkler systems and smoke detectors. An independent energy source is an energy source, such as a microgrid, that is separate, or can be separated, from the energy sources providing power for the other parts of the facility.

Assessment Objective

  1. fire detection systems are employed;
  2. employed fire detection systems are supported by an independent energy source;
  3. employed fire detection systems are maintained;
  4. fire suppression systems are employed;
  5. employed fire suppression systems are supported by an independent energy source;
  6. employed fire suppression systems are maintained.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing fire protection fire suppression and detection devices/systems fire suppression and detection devices/systems documentation test records of fire suppression and detection devices/systems system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for fire detection and suppression devices/systems organizational personnel with information security responsibilities
PE-14 Environmental Controls

Control

  1. Maintain [Selection(one-or-more): temperature; humidity; pressure; radiation; {{ insert: param, pe-14_odp.02 }} ] levels within the facility where the system resides at [Assignement: acceptable levels] ; and
  2. Monitor environmental control levels [Assignement: frequency].

Discussion

The provision of environmental controls applies primarily to organizational facilities that contain concentrations of system resources (e.g., data centers, mainframe computer rooms, and server rooms). Insufficient environmental controls, especially in very harsh environments, can have a significant adverse impact on the availability of systems and system components that are needed to support organizational mission and business functions.

Assessment Objective

  1. [Selection(one-or-more): temperature; humidity; pressure; radiation; {{ insert: param, pe-14_odp.02 }} ] levels are maintained at [Assignement: acceptable levels] within the facility where the system resides;
  2. environmental control levels are monitored [Assignement: frequency].

Assessment Method

Examine

Physical and environmental protection policy procedures addressing temperature and humidity control temperature and humidity controls facility housing the system temperature and humidity controls documentation temperature and humidity records system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for system environmental controls organizational personnel with information security responsibilities
PE-15 Water Damage Protection

Control

Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.

Discussion

The provision of water damage protection primarily applies to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Isolation valves can be employed in addition to or in lieu of master shutoff valves to shut off water supplies in specific areas of concern without affecting entire organizations.

Assessment Objective

  1. the system is protected from damage resulting from water leakage by providing master shutoff or isolation valves;
  2. the master shutoff or isolation valves are accessible;
  3. the master shutoff or isolation valves are working properly;
  4. the master shutoff or isolation valves are known to key personnel.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing water damage protection facility housing the system master shutoff valves list of key personnel with knowledge of location and activation procedures for master shutoff valves for the plumbing system master shutoff valve documentation system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for system environmental controls organizational personnel with information security responsibilities
PE-16 Delivery and Removal

Control

  1. Authorize and control [Assignement: organization-defined types of system components] entering and exiting the facility; and
  2. Maintain records of the system components.

Discussion

Enforcing authorizations for entry and exit of system components may require restricting access to delivery areas and isolating the areas from the system and media libraries.

Assessment Objective

    1. [Assignement: types of system components] are authorized when entering the facility;
    2. [Assignement: types of system components] are controlled when entering the facility;
    3. [Assignement: types of system components] are authorized when exiting the facility;
    4. [Assignement: types of system components] are controlled when exiting the facility;
  2. records of the system components are maintained.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing the delivery and removal of system components from the facility facility housing the system records of items entering and exiting the facility system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for controlling system components entering and exiting the facility organizational personnel with information security responsibilities
PE-17 Alternate Work Site

Control

  1. Determine and document the [Assignement: alternate work sites] allowed for use by employees;
  2. Employ the following controls at alternate work sites: [Assignement: controls];
  3. Assess the effectiveness of controls at alternate work sites; and
  4. Provide a means for employees to communicate with information security and privacy personnel in case of incidents.

Discussion

Alternate work sites include government facilities or the private residences of employees. While distinct from alternative processing sites, alternate work sites can provide readily available alternate locations during contingency operations. Organizations can define different sets of controls for specific alternate work sites or types of sites depending on the work-related activities conducted at the sites. Implementing and assessing the effectiveness of organization-defined controls and providing a means to communicate incidents at alternate work sites supports the contingency planning activities of organizations.

Assessment Objective

  1. [Assignement: alternate work sites] are determined and documented;
  2. [Assignement: controls] are employed at alternate work sites;
  3. the effectiveness of controls at alternate work sites is assessed;
  4. a means for employees to communicate with information security and privacy personnel in case of incidents is provided.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing alternate work sites for organizational personnel list of security controls required for alternate work sites assessments of security controls at alternate work sites system security plan privacy plan other relevant documents or records

Interview

Organizational personnel approving the use of alternate work sites organizational personnel using alternate work sites organizational personnel assessing controls at alternate work sites organizational personnel with information security and privacy responsibilities
PE-18 Location of System Components

Control

Position system components within the facility to minimize potential damage from [Assignement: physical and environmental hazards] and to minimize the opportunity for unauthorized access.

Discussion

Physical and environmental hazards include floods, fires, tornadoes, earthquakes, hurricanes, terrorism, vandalism, an electromagnetic pulse, electrical interference, and other forms of incoming electromagnetic radiation. Organizations consider the location of entry points where unauthorized individuals, while not being granted access, might nonetheless be near systems. Such proximity can increase the risk of unauthorized access to organizational communications using wireless packet sniffers or microphones, or unauthorized disclosure of information.

Assessment Objective

system components are positioned within the facility to minimize potential damage from [Assignement: physical and environmental hazards] and to minimize the opportunity for unauthorized access.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing the positioning of system components documentation providing the location and position of system components within the facility locations housing system components within the facility list of physical and environmental hazards with the potential to damage system components within the facility system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for positioning system components organizational personnel with information security responsibilities
PE-19 Information Leakage

Control

Protect the system from information leakage due to electromagnetic signals emanations.

Discussion

Information leakage is the intentional or unintentional release of data or information to an untrusted environment from electromagnetic signals emanations. The security categories or classifications of systems (with respect to confidentiality), organizational security policies, and risk tolerance guide the selection of controls employed to protect systems against information leakage due to electromagnetic signals emanations.

Assessment Objective

the system is protected from information leakage due to electromagnetic signal emanations.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing information leakage due to electromagnetic signal emanations mechanisms protecting the system against electronic signal emanations facility housing the system records from electromagnetic signal emanation tests system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for system environmental controls organizational personnel with information security responsibilities
PE-20 Asset Monitoring and Tracking

Control

Employ [Assignement: asset location technologies] to track and monitor the location and movement of [Assignement: assets] within [Assignement: controlled areas].

Discussion

Asset location technologies can help ensure that critical assets—including vehicles, equipment, and system components—remain in authorized locations. Organizations consult with the Office of the General Counsel and senior agency official for privacy regarding the deployment and use of asset location technologies to address potential privacy concerns.

Assessment Objective

[Assignement: asset location technologies] are employed to track and monitor the location and movement of [Assignement: assets] within [Assignement: controlled areas].

Assessment Method

Examine

Physical and environmental protection policy procedures addressing asset monitoring and tracking documentation showing the use of asset location technologies system configuration documentation list of organizational assets requiring tracking and monitoring asset monitoring and tracking records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with asset monitoring and tracking responsibilities legal counsel organizational personnel with information security and privacy responsibilities
PE-21 Electromagnetic Pulse Protection

Control

Employ [Assignement: protective measures] against electromagnetic pulse damage for [Assignement: system and system components].

Discussion

An electromagnetic pulse (EMP) is a short burst of electromagnetic energy that is spread over a range of frequencies. Such energy bursts may be natural or man-made. EMP interference may be disruptive or damaging to electronic equipment. Protective measures used to mitigate EMP risk include shielding, surge suppressors, ferro-resonant transformers, and earth grounding. EMP protection may be especially significant for systems and applications that are part of the U.S. critical infrastructure.

Assessment Objective

[Assignement: protective measures] are employed against electromagnetic pulse damage for [Assignement: system and system components].

Assessment Method

Examine

Physical and environmental protection policy procedures addressing protective measures to mitigate EMP risk to systems and components documentation detailing protective measures to mitigate EMP risk list of locations where protective measures to mitigate EMP risk are implemented system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for physical and environmental protection system developers/integrators organizational personnel with information security responsibilities
PE-22 Component Marking

Control

Mark [Assignement: system hardware components] indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.

Discussion

Hardware components that may require marking include input and output devices. Input devices include desktop and notebook computers, keyboards, tablets, and smart phones. Output devices include printers, monitors/video displays, facsimile machines, scanners, copiers, and audio devices. Permissions controlling output to the output devices are addressed in [AC-3](#ac-3) or [AC-4](#ac-4) . Components are marked to indicate the impact level or classification level of the system to which the devices are connected, or the impact level or classification level of the information permitted to be output. Security marking refers to the use of human-readable security attributes. Security labeling refers to the use of security attributes for internal system data structures. Security marking is generally not required for hardware components that process, store, or transmit information determined by organizations to be in the public domain or to be publicly releasable. However, organizations may require markings for hardware components that process, store, or transmit public information in order to indicate that such information is publicly releasable. Marking of system hardware components reflects applicable laws, executive orders, directives, policies, regulations, and standards.

Assessment Objective

[Assignement: system hardware components] are marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing component marking list of component marking security attributes component inventory information types and their impact/classification level system security plan other relevant documents or records

Interview

Organizational personnel with component marking responsibilities organizational personnel with component inventory responsibilities organizational personnel with information categorization/classification responsibilities organizational personnel with information security responsibilities
PE-23 Facility Location

Control

  1. Plan the location or site of the facility where the system resides considering physical and environmental hazards; and
  2. For existing facilities, consider the physical and environmental hazards in the organizational risk management strategy.

Discussion

Physical and environmental hazards include floods, fires, tornadoes, earthquakes, hurricanes, terrorism, vandalism, an electromagnetic pulse, electrical interference, and other forms of incoming electromagnetic radiation. The location of system components within the facility is addressed in [PE-18](#pe-18).

Assessment Objective

  1. the location or site of the facility where the system resides is planned considering physical and environmental hazards;
  2. for existing facilities, physical and environmental hazards are considered in the organizational risk management strategy.

Assessment Method

Examine

Physical and environmental protection policy physical site planning documents organizational assessment of risk contingency plan risk mitigation strategy documentation system security plan other relevant documents or records

Interview

Organizational personnel with site selection responsibilities for the facility housing the system organizational personnel with risk mitigation responsibilities organizational personnel with information security responsibilities

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace