Logical controls assume that nobody can walk up to the hardware, plug something in, carry a disk out or switch the power off, and the Physical and Environmental Protection (PE) family is where that assumption is either earned or quietly broken. This guide works through the PE family of NIST SP 800-53 Rev. 5 control by control: what each key control and enhancement requires, which baselines select it, which organisation-defined parameters you must set, and what evidence an assessor will ask for. It is for system owners, facilities managers, security plan authors and assessors, and stays on the control text and its evidence rather than general physical security practice. For the catalogue as a whole, see the NIST SP 800-53 Guide.
Source note: this page summarises the official text and the sources listed at the end. Confirm against the official text before relying on it.
Key takeaways
- Ten PE controls apply at Low. Moderate adds cabling, output, power and alternate work site controls; High adds system-level access control and monitoring, generator power, fire suppression and leak detection.
- PE-2 and PE-3 are an access lifecycle. Authorised list, credentials, review and removal, then enforcement with logs, escorts, key inventories and key changes: joiner, mover, leaver applied to doors.
- Logs have to be reviewed and connected. PE-6 requires review of physical access logs at a frequency you set and on defined events, and coordination with the incident response capability. Badge logs that nobody reads do not satisfy it.
- Environmental controls are availability controls. PE-9 to PE-15 (power, shutoff, UPS, lighting, fire, climate, water) map to CSF 2.0 PR.IR-02 and are often inherited from a provider, so the inheritance evidence is the real work.
- PE-17 reaches into homes. At Moderate and High you must define permitted alternate work sites, the controls that apply there, how you assess them and how staff report incidents from them.
The PE family at a glance
The table lists every current PE base control with its baseline allocation, taken from NIST's OSCAL SP 800-53 Rev. 5 catalogue and baseline profiles (L = Low, M = Moderate, H = High). PE-7 Visitor Control is withdrawn. The privacy baseline selects one PE item, PE-8(3).
| Control | Title | Baselines | Enhancements selected in baselines |
|---|---|---|---|
| PE-1 | Policy and Procedures | L, M, H | None |
| PE-2 | Physical Access Authorizations | L, M, H | None selected; (1) to (3) by tailoring |
| PE-3 | Physical Access Control | L, M, H | (1) System Access at H |
| PE-4 | Access Control for Transmission | M, H | None |
| PE-5 | Access Control for Output Devices | M, H | None selected |
| PE-6 | Monitoring Physical Access | L, M, H | (1) Intrusion Alarms and Surveillance Equipment at M, H; (4) Monitoring Physical Access to Systems at H |
| PE-8 | Visitor Access Records | L, M, H | (1) Automated Records Maintenance and Review at H; (3) Limit PII Elements in the privacy baseline |
| PE-9 | Power Equipment and Cabling | M, H | None selected |
| PE-10 | Emergency Shutoff | M, H | None |
| PE-11 | Emergency Power | M, H | (1) Alternate Power Supply, Minimal Operational Capability at H |
| PE-12 | Emergency Lighting | L, M, H | None selected |
| PE-13 | Fire Protection | L, M, H | (1) Detection Systems at M, H; (2) Suppression Systems at H |
| PE-14 | Environmental Controls | L, M, H | None selected |
| PE-15 | Water Damage Protection | L, M, H | (1) Automation Support at H |
| PE-16 | Delivery and Removal | L, M, H | None |
| PE-17 | Alternate Work Site | M, H | None |
| PE-18 | Location of System Components | H | None selected |
| PE-19 to PE-23 | Information Leakage, Asset Monitoring and Tracking, Electromagnetic Pulse Protection, Component Marking, Facility Location | Not in a baseline | Add by tailoring |
For selection and tailoring method, see the NIST SP 800-53B Control Baselines and Tailoring Guide.
PE-2 and PE-3: authorisation and enforcement
PE-1 follows the standard policy and procedures pattern. The substance starts with PE-2, which has four parts: (a) develop, approve and maintain a list of individuals with authorised access to the facility where the system resides; (b) issue authorisation credentials for facility access; (c) review the access list at a frequency you define; and (d) remove individuals when access is no longer required. Tailoring options are PE-2(1) access by position or role, PE-2(2) two forms of identification for visitors and PE-2(3) restricting unescorted access to personnel with the clearances, formal access authorisations or need for access you define.
PE-3 enforces those authorisations. Its seven parts are the ones assessors test most.
| PE-3 part | Requirement | Parameter you set | Practical reading |
|---|---|---|---|
| (a) | Verify authorisation before granting access, and control ingress and egress | Entry and exit points; the systems or devices used (for example guards, card readers) | Name every door to the facility and data rooms, and how each is controlled |
| (b) | Maintain physical access audit logs | Entry and exit points covered | Access control system event logs, or signed registers where there is no electronic system |
| (c) | Control access to publicly accessible areas | The controls applied | Reception, lobbies and meeting rooms separated from non-public areas |
| (d) | Escort visitors and control visitor activity | Circumstances requiring escort | Written escort rule; visitor badges visibly different |
| (e) | Secure keys, combinations and other physical access devices | None | Key cabinet, issued key log, spare badge stock locked away |
| (f) | Inventory physical access devices | Devices and frequency | Reconcile issued keys and badges against people, for example quarterly |
| (g) | Change combinations and keys | Frequency | Also when keys are lost, combinations compromised or holders transferred or terminated |
NIST allows PE-3b audit logs to be procedural, automated or both. PE-3(1) at High adds enforcement at the system itself, in addition to the facility, at the physical spaces you define: in practice a separately controlled server room, cage or rack. Tailoring candidates are PE-3(2) perimeter checks for exfiltration or removal of components, PE-3(3) continuous guards, PE-3(4) lockable casings, PE-3(5) tamper protection, PE-3(7) physical barriers and PE-3(8) access control vestibules. PE-3(6) Facility Penetration Testing is withdrawn; physical testing now sits in CA-8. For door hardware and the access control system itself, see the Physical Access Control Systems Security Guide and the Tailgating and Piggybacking Guide.
PE-4, PE-5 and PE-16: cabling, output and what crosses the threshold
- PE-4 Access Control for Transmission (M, H): control physical access to the distribution and transmission lines you define using the safeguards you define. NIST's examples are locked or disconnected spare jacks, locked wiring closets, conduit and wiretapping sensors. Live floor ports in meeting rooms are the usual finding.
- PE-5 Access Control for Output Devices (M, H): control physical access to output from devices you define, such as printers, to stop unauthorised people obtaining it. PE-5(2) links individual identity to receipt of output, which is what badge-release printing delivers. PE-5(1) and PE-5(3) are withdrawn.
- PE-16 Delivery and Removal (L, M, H): authorise and control the types of system components you define entering and exiting the facility, and maintain records of those components. It pairs with MA-2 for components leaving for repair, MP-6 sanitisation and CM-8 inventory.
PE-16 and PE-3(2) are the physical controls that address ATT&CK T1200 Hardware Additions and T1052.001 Exfiltration over USB, alongside device control on the endpoint. See the Removable Media and USB Control Guide.
PE-6 and PE-8: monitoring and visitor records
PE-6 has three parts: (a) monitor physical access to the facility to detect and respond to physical security incidents; (b) review physical access logs at a frequency you define and when events you define occur; and (c) coordinate results of reviews and investigations with the incident response capability. NIST's discussion lists the anomalies to look for: out-of-hours access, repeated access to areas not normally visited, unusually long stays and out-of-sequence access. Treat them as detection rules.
| Enhancement | Baseline | Requirement | Typical implementation |
|---|---|---|---|
| PE-6(1) Intrusion Alarms and Surveillance Equipment | M, H | Monitor facility access with intrusion alarms and surveillance equipment | Door-held and forced-door alarms, CCTV at entrances, alarm monitoring centre |
| PE-6(2) Automated Intrusion Recognition and Responses | Tailoring | Recognise defined classes of intrusion and start defined responses automatically | Forced door on a data room locks inner doors and pages the duty officer |
| PE-6(3) Video Surveillance | Tailoring | Video surveillance of defined areas, review and retention periods you set | Retention aligned with log retention and privacy notices |
| PE-6(4) Monitoring Physical Access to Systems | H | Monitor access to the system as well as the facility | Rack or cage door sensors, data room access feed into the SIEM |
PE-8 requires visitor access records kept for a period you define, reviewed at a frequency you define, with anomalies reported to personnel you define. PE-8(1) at High uses automated mechanisms to maintain and review them. PE-8(3), the only PE item in the privacy baseline, limits personally identifiable information in visitor records to the elements identified in the privacy risk assessment. Visitor management systems that capture photographs, ID scans and signatures by default can breach PE-8(3) without anyone deciding to. See the NIST SP 800-53 PT PII Processing and Transparency guide.
PE-9 to PE-15 and PE-18: power, fire, climate and water
| Control | Baseline | Requirement in short | Evidence that usually works |
|---|---|---|---|
| PE-9 Power Equipment and Cabling | M, H | Protect power equipment and cabling from damage and destruction | Site survey, dual feeds to racks; (1) separated redundant paths and (2) automatic voltage controls by tailoring |
| PE-10 Emergency Shutoff | M, H | Ability to cut power in an emergency, switches at defined locations, protected from unauthorised activation | Emergency power off button locations, covers or guards, photographs |
| PE-11 Emergency Power | M, H | UPS to allow orderly shutdown or transition to long-term alternate power | UPS runtime against load, battery test records; (1) generator at H with test logs |
| PE-13 Fire Protection | L, M, H | Detection and suppression supported by an independent energy source | (1) automatic detection notifying defined people at M, H; (2) automatic suppression at H, required when the facility is not continuously staffed |
| PE-14 Environmental Controls | L, M, H | Maintain defined levels (for example temperature, humidity) and monitor them | Set points and monitoring records; (1) automatic controls and (2) alarms by tailoring |
| PE-15 Water Damage Protection | L, M, H | Accessible, working master shutoff or isolation valves known to key personnel | Valve map, staff briefing record; (1) leak detection with alerts at H |
| PE-18 Location of System Components | H | Position components to minimise damage from defined hazards and unauthorised access | Floor plan showing racks away from windows, water pipes and public areas |
The PE-11 parameter is a choice between orderly shutdown and transition to long-term alternate power: set it from the contingency plan, not from the UPS you happen to own. See the NIST SP 800-53 CP Contingency Planning and Power and Physical Infrastructure Dependency guides.
PE-17 and the tailoring-only controls
PE-17 Alternate Work Site (M, H) has four parts: (a) determine and document the alternate work sites employees may use; (b) apply controls you define at those sites; (c) assess the effectiveness of those controls; and (d) give employees a way to contact security and privacy staff about incidents. NIST includes employees' private residences. A workable implementation is a remote working standard (screen privacy, locked paper storage, no family use of work devices), an annual attestation plus endpoint compliance data as the assessment, and one reporting route. SP 800-171 Rev. 3 carries the same idea as 03.10.06.
The tailoring-only controls are niche: PE-19 emanations protection and PE-21 electromagnetic pulse protection for classified and critical environments, PE-22 component marking, and PE-20 asset location tracking, where NIST advises consulting legal and privacy officials first. PE-23 Facility Location is the most broadly useful: weigh physical and environmental hazards when choosing a new site or colocation provider.
Where identity fits
A physical access control system is an identity system. Badges are credentials, the access list in PE-2a is an entitlement store and PE-2d is deprovisioning. Two failures recur: badges that stay active after the leaver's directory account is disabled, and shared pool badges that make PE-3b logs useless. Treat the access control system's integration accounts, controller credentials and its management console as privileged, non-human identities: they can open every door. Feed PE-2 from the same joiner, mover and leaver source as logical access and reconcile the two. See the Physical and cyber security convergence guide and the NIST SP 800-53 AC Access Control guide.
How to evidence PE controls
SP 800-53A Rev. 5 assessment procedures use examine, interview and test. The table turns them into evidence an assessor can accept in one pass.
| Control | Examine | Interview or test | Common gap |
|---|---|---|---|
| PE-2 | Authorised access list, last review record, removal records | Sample five recent leavers and check badge deactivation dates | Badges active weeks after the leaving date |
| PE-3 | Entry point list, access control logs, key and badge inventory, key change log | Walk the perimeter; test a door with a deactivated badge | Unlisted side doors and loading bays; no key inventory |
| PE-6 | Log review records with dates; incidents raised from reviews | Ask how an out-of-hours data room entry would be noticed | Logs kept but never reviewed |
| Inherited PE | Provider SOC 2 or FedRAMP package, customer responsibility matrix | Confirm which PE parts the provider does not cover | Whole family marked inherited, including PE-17 and PE-5 |
For assessment depth, see the NIST SP 800-53A Guide.
Implementing the PE family: a phased approach
This sequence is NHI Mgmt Group's recommendation for a Moderate system hosted partly on premises and partly with a provider.
- Draw the boundary. List every facility, data room, cage and alternate work site within the system boundary, and for each say whether PE is implemented, shared or inherited.
- Collect inheritance evidence. Obtain each provider's attestation and responsibility matrix and record which PE controls remain yours (usually PE-5, PE-17 and PE-16 for your own deliveries).
- Set the parameters. Fill the PE-2c review frequency, PE-3a entry points, PE-3f inventory frequency, PE-6b review frequency and triggers, PE-8a retention, PE-11 objective and PE-14 levels in the system security plan.
- Connect physical to logical lifecycle. Feed the access control system from HR or identity governance so leavers lose badges and accounts together.
- Turn PE-6 into detection. Configure alerts for the anomaly types NIST lists, send data room events to the SIEM and define the incident route.
- Test. Run a deactivated badge test, a forced door test and a log review before assessment; agree any CA-8 physical penetration test with facilities and legal.
Run automated badge deprovisioning in report-only mode for a month, fix mismatches, then enforce. Roll back by returning the feed to report-only while manual leaver processing continues.
Decision guidance
- Low versus Moderate: Low covers access authorisation and control, monitoring, visitors, lighting, fire, climate, water and delivery. Moderate adds cabling and output protection, power controls, intrusion alarms, fire detection notification and alternate work sites.
- Cloud only: most of PE is inherited; keep PE-1, PE-17 and office controls, and document the inheritance.
- Small organisations: a locked comms cabinet, a key log, a visitor book with a defined retention and a quarterly review can satisfy the Low controls; spend on deprovisioning discipline before cameras.
Detection and measurement
- Median time between leaving date and badge deactivation, target the same day.
- Share of physical access log reviews completed on schedule, with findings raised.
- Number of active badges with no matching active identity in the HR or identity source.
- Forced-door and door-held alarms per month on data rooms, and share investigated.
- UPS, generator and fire system tests completed against plan.
Framework mapping
| SP 800-53 PE | CSF 2.0 | SP 800-171 Rev. 3 | ISO/IEC 27001:2022 Annex A | ATT&CK context |
|---|---|---|---|---|
| PE-2, PE-3 | PR.AA-06 | 03.10.01, 03.10.07 | 7.1, 7.2, 7.3 | T1200 |
| PE-4 | PR.AA-06 | 03.10.08 | 7.12 | None |
| PE-6, PE-8 | DE.CM-02 | 03.10.02 | 7.4 | None |
| PE-9 to PE-15, PE-18 | PR.IR-02 | None | 7.5, 7.8, 7.11 | None |
| PE-16 | PR.PS-03, ID.AM-08 | None | 7.10, 7.14 | T1052.001 |
| PE-17 | PR.AA-06 | 03.10.06 | 7.9, 6.7 | None |
In SP 800-171 Rev. 3 the Physical Protection family (03.10) withdraws 03.10.03 to 03.10.05, folding them into 03.10.07. CSF, ISO and ATT&CK links are "intersects with", not equivalence, and are our reading. Check against NIST's published informative references before relying on them in an audit. See the NIST SP 800-53 to ISO 27001 Mapping Guide.
Common failure patterns
- Two leaver processes: IT disables the account, facilities never hears, and the badge keeps working.
- Everything marked inherited: the provider's attestation covers its data halls, not your offices, printers or home workers.
- Logs without review: the access control system keeps a year of events, nobody looks, and PE-6b has no evidence.
- Alarm routes go stale: PE-13(1) and PE-14 notifications reach a shared mailbox or someone who left.
- Over-collecting visitor data: ID scans kept indefinitely, against PE-8(3).
Practitioner checklist
- List every facility, data room and alternate work site in the boundary and its PE responsibility split.
- Set every PE organisation-defined parameter in the system security plan.
- Feed badge provisioning and removal from the same source as logical accounts and reconcile monthly.
- Keep a key and badge inventory and change keys and combinations when holders leave.
- Alert on out-of-hours, repeated, long and out-of-sequence data room access and route it to incident response.
- Limit visitor record fields to what the privacy risk assessment allows and set a retention period.
- Record UPS, generator, fire and environmental tests with current alert recipients.
- Define the remote working controls for PE-17 and how staff report incidents from home.
Standards and references
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
- NIST: OSCAL content, SP 800-53 Rev. 5 catalogue and baseline profiles
- NIST: SP 800-53B, Control Baselines for Information Systems and Organizations
- NIST: SP 800-53A Rev. 5, Assessing Security and Privacy Controls
- NIST: SP 800-171 Rev. 3
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK: Hardware Additions
Related NHI Mgmt Group resources: NIST SP 800-53 Guide · Physical Security Guide for Security Teams · Data Centre Security Guide · NIST SP 800-53 MA Maintenance · Physical and Environmental Security Policy Template