D3-PEH Physical Enclosure Hardening: Specifying, Sealing and Inspecting Equipment Enclosures

A controller, switch or server in an unlocked cabinet, a dusty plant room or a roadside box is exposed to anyone who can open the door and to heat, water and vibration that never show up in a network diagram. MITRE D3FEND names the countermeasure Physical Enclosure Hardening (D3-PEH) and defines it as "Physical changes to a computer enclosure which reduce the ability for agents or the environment to affect the contained computer system." It sits under the Harden tactic as a child of Platform Hardening (D3-PH), and hardens the Computer Enclosure artefact, which D3FEND splits into Computer Case and Computer Cabinet. This card covers how to specify enclosures for environment and access, how tamper evidence and records make the control verifiable, and where it stops. It is for OT engineers, data centre and facilities security leads, and anyone responsible for equipment outside a controlled server room, and it builds on the Physical Security Guide for Security Teams.

Key takeaways

• Two threats, one enclosure. D3FEND's article names heat, gases, vibration and agent access: the same cabinet has to keep out people and the environment, and the specification should address both.
• Access hardening is locks plus evidence. D3FEND's considerations call for physical barriers such as locks and bolts, possibly tamper-evident hardware, and records of maintenance, access and any tampering marks.
• D3FEND lists no ATT&CK mapping. Our view is that hardened enclosures raise the cost of techniques that need physical contact, such as T1200 Hardware Additions and removable media use.
• Use the existing rating systems. NEMA 250 enclosure types and IEC 60529 IP codes describe environmental protection; they are not interchangeable, and neither rates resistance to a determined intruder.
• Verification is inspection. Scheduled checks of seals, locks, door sensors and inventory, with logged results, are what prove the control is still in place.

D3-PEH at a glance

How it works

D3FEND's article describes system designers or operators making physical changes to an enclosure, with additions of various materials to reduce the effects of heat, gases, vibration, or agent access. Its considerations add four operating requirements: track physical equipment with asset inventory tools and monitor people and devices for access control; check relevant regulations so enclosures comply; install and maintain hardened enclosures so they stay operable and free of tampering, with access controlled through locks, bolts and possibly tamper-evident hardware; and keep records of maintenance, access and any tampering marks or incidents.

In practice that splits into three design areas.

• Environmental protection: sealing, filtration, cooling or heating, corrosion resistance and vibration mounting, chosen for the location. A controller in a wash-down food plant and one in a dry office need different enclosures.
• Access resistance: lockable doors and panels, protected hinges and cable entries, removal of external ports or covers over them, and fixings that need tools from the inside.
• Tamper evidence and monitoring: numbered seals, door-open switches wired to an alarm or to the controller, and inspection records that let a change be noticed.

Locks themselves have their own D3FEND entry; see D3-EPL Physical Locking. Shielding against radiated signals is also separate: see D3-RFS RF Shielding and D3-EMH Electromagnetic Radiation Hardening.

Environmental ratings

Two rating systems describe how well an enclosure keeps out the environment. NEMA's own guidance states that IEC 60529 IP codes rate protection against solid objects and water but not against corrosion, icing, oil or coolants, which NEMA tests, so NEMA types cannot be exactly equated with IP ratings and NEMA's conversion table cannot be reversed. Selected NEMA 250 types for non-hazardous locations:

IEC 60529 IP codes use a first digit for solid objects and dust and a second for water, so IP65 means dust-tight and protected against water jets. Hazardous locations (NEMA types 7 to 10) need certified enclosures and are an engineering decision outside this card. Neither system rates resistance to forced or covert entry.

ATT&CK relationships

D3FEND lists no ATT&CK technique for D3-PEH. No ATT&CK technique is modelled as acting on the Computer Enclosure artefact, so D3FEND infers no relation (checked November 2026). The table below is an NHI Mgmt Group view, not a D3FEND mapping: these ATT&CK v20 techniques need physical contact with equipment, which a hardened, monitored enclosure makes slower and more visible.

Technique pages: MITRE ATT&CK T1200 Hardware Additions, MITRE ATT&CK T1091 Replication Through Removable Media and T0864 Transient Cyber Asset.

Where it is implemented

• Data centres and server rooms: lockable racks and cages, with rack door sensors; covered in the Data Centre Security Guide.
• OT and field sites: control cabinets, marshalling panels and remote terminal unit boxes. NIST SP 800-82 Rev 3 (section 6.2.1.2) says equipment cabinets should be locked when not needed for operation or safety, and that keys for OT assets such as PLCs and safety systems should stay in the "Run" position unless the device is being actively programmed.
• Branch and public locations: network cabinets in shops and offices, kiosks, and digital signage, where people pass close to equipment.
• Devices themselves: chassis intrusion switches and lockable bezels on servers and desktops, configured in firmware to log or alert when the case is opened.

Implementation steps

1. Inventory enclosures. Record every cabinet and case that holds in-scope equipment, its location, who holds keys and what it contains. D3FEND's first consideration is asset inventory.
2. Assess each location. Note exposure to the public, to contractors, and to dust, water, heat, corrosion and vibration. The Physical Security Site Assessment Checklist gives a structure.
3. Specify the enclosure. Choose the NEMA type or IP code for the environment, then add access features: lock grade, hinge and cable entry protection, covered ports, and a door switch where monitoring exists.
4. Add tamper evidence. Numbered seals on doors and panels that should rarely open, with the numbers recorded.
5. Control keys. Issue keys to named people, log issue and return, avoid master keying for sensitive enclosures, and change locks after a lost key. NRC Regulatory Guide 5.12, cited by D3FEND, sets out these practices for regulated facilities.
6. Retrofit in priority order. Unattended and public locations first, then plant areas, then controlled rooms. Plan work in maintenance windows: opening a live control cabinet is itself a safety activity.

How to verify it works

• Scheduled inspections: lock condition, seal numbers against the register, signs of forced entry, filters and cooling, with results logged.
• Door and chassis alarms: test that an opening generates an event in the alarm system, controller log or SIEM.
• Key audit: reconcile keys issued against the register; NRC RG 5.12 suggests an annual access list review for security keys.
• Environmental readings: temperature and humidity inside critical cabinets, trended over time.

Example metrics (examples, not standards): percentage of in-scope enclosures inspected on schedule; seal mismatches found per quarter and percentage explained by a work order; door-open events without a matching work order; keys unaccounted for.

Limits and failure patterns

• Locks delay, they do not stop. NRC RG 5.12 describes locks as delay devices whose value depends on being integrated with seals, detection and response. An enclosure nobody monitors only slows an attacker.
• Insiders and contractors: anyone with a key passes. Records and work orders are the control here, not the cabinet.
• Doors left open: cabinets propped open for cooling or convenience undo both environmental and access protection.
• Ports outside the enclosure: a locked cabinet with a network jack or USB port exposed on its side gives the access the lock was meant to prevent.
• Rating mismatch: choosing an IP code where a NEMA corrosion rating was needed, or the reverse, leads to early failure of equipment.

Framework mapping

NIST SP 800-82 Rev 3 was published in September 2023; NIST's publication page shows an initial public draft of Revision 4 open for comment as of November 2026, so section numbers may change.

Practitioner checklist

• Keep an inventory of every enclosure holding in-scope equipment, with location, contents and key holders.
• Specify enclosures by NEMA type or IP code for the environment, plus access features for the location.
• Lock cabinets when not needed for operation or safety, and keep PLC key switches in "Run" unless programming.
• Cover or remove external ports and protect cable entries and hinges.
• Fit numbered seals on rarely opened panels and record the numbers.
• Wire door and chassis intrusion switches to an alarm or log where monitoring exists.
• Run key control: named holders, issue log, no master keying for sensitive enclosures, rekey after loss.
• Inspect on a schedule and reconcile every door-open event or seal change with a work order.

Standards and references

• MITRE D3FEND: Physical Enclosure Hardening (D3-PEH)
• US NRC: Regulatory Guide 5.12 Rev 1, General Use of Locks in the Protection and Control of Facilities, Radioactive Materials, Classified Information, Classified Matter, and Safeguards Information
• NIST: SP 800-82 Rev 3, Guide to Operational Technology (OT) Security
• NIST: SP 800-53 Rev 5, Security and Privacy Controls
• NEMA: NEMA Enclosure Types
• MITRE ATT&CK: T1200 Hardware Additions

Related NHI Mgmt Group resources: MITRE D3FEND Guide · OT Security Guide · Physical and Environmental Security Policy Template · D3-HBWP Hardware-based Write Protection