The organization: a. Develops, documents, and disseminates to {{ insert: param, pe-1_prm_1 }}: 1. A physical and environmental protection policy that addresses purpose, scope, roles, responsi...

The organization: a. Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides; b. Issues authorization credentials for...

The organization authorizes physical access to the facility where the information system resides based on position or role.

The organization requires two forms of identification from {{ insert: param, pe-2.2_prm_1 }} for visitor access to the facility where the information system resides.

The organization restricts unescorted access to the facility where the information system resides to personnel with {{ insert: param, pe-2.3_prm_1 }}.

The organization: a. Enforces physical access authorizations at {{ insert: param, pe-3_prm_1 }} by; 1. Verifying individual access authorizations before granting access to the facility; and ...

The organization enforces physical access authorizations to the information system in addition to the physical access controls for the facility at {{ insert: param, pe-3.1_prm_1 }}.

The organization performs security checks {{ insert: param, pe-3.2_prm_1 }} at the physical boundary of the facility or information system for unauthorized exfiltration of information or removal of...

The organization employs guards and/or alarms to monitor every physical access point to the facility where the information system resides 24 hours per day, 7 days per week.

The organization uses lockable physical casings to protect {{ insert: param, pe-3.4_prm_1 }} from unauthorized physical access.

The organization employs {{ insert: param, pe-3.5_prm_1 }} to {{ insert: param, pe-3.5_prm_2 }} physical tampering or alteration of {{ insert: param, pe-3.5_prm_3 }} within the information system.

The organization employs a penetration testing process that includes {{ insert: param, pe-3.6_prm_1 }}, unannounced attempts to bypass or circumvent security controls associated with physical acces...

The organization controls physical access to {{ insert: param, pe-4_prm_1 }} within organizational facilities using {{ insert: param, pe-4_prm_2 }}.

The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.

The organization: (a) Controls physical access to output from {{ insert: param, pe-5.1_prm_1 }}; and (b) Ensures that only authorized individuals receive output from the device.

The information system: (a) Controls physical access to output from {{ insert: param, pe-5.2_prm_1 }}; and (b) Links individual identity to receipt of the output from the device.

The organization marks {{ insert: param, pe-5.3_prm_1 }} indicating the appropriate security marking of the information permitted to be output from the device.

The organization: a. Monitors physical access to the facility where the information system resides to detect and respond to physical security incidents; b. Reviews physical access logs {{ inser...

The organization monitors physical intrusion alarms and surveillance equipment.

The organization employs automated mechanisms to recognize {{ insert: param, pe-6.2_prm_1 }} and initiate {{ insert: param, pe-6.2_prm_2 }}.

The organization employs video surveillance of {{ insert: param, pe-6.3_prm_1 }} and retains video recordings for {{ insert: param, pe-6.3_prm_2 }}.

The organization monitors physical access to the information system in addition to the physical access monitoring of the facility as {{ insert: param, pe-6.4_prm_1 }}.

The organization: a. Maintains visitor access records to the facility where the information system resides for {{ insert: param, pe-8_prm_1 }}; and b. Reviews visitor access records {{ insert: ...

The organization employs automated mechanisms to facilitate the maintenance and review of visitor access records.

The organization protects power equipment and power cabling for the information system from damage and destruction.

The organization employs redundant power cabling paths that are physically separated by {{ insert: param, pe-9.1_prm_1 }}.

The organization employs automatic voltage controls for {{ insert: param, pe-9.2_prm_1 }}.

The organization: a. Provides the capability of shutting off power to the information system or individual system components in emergency situations; b. Places emergency shutoff switches or dev...

The organization provides a short-term uninterruptible power supply to facilitate {{ insert: param, pe-11_prm_1 }} in the event of a primary power source loss.

The organization provides a long-term alternate power supply for the information system that is capable of maintaining minimally required operational capability in the event of an extended loss of ...

The organization provides a long-term alternate power supply for the information system that is: (a) Self-contained; (b) Not reliant on external power generation; and (c) Capable of maintaini...

The organization employs and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacua...

The organization provides emergency lighting for all areas within the facility supporting essential missions and business functions.

The organization employs and maintains fire suppression and detection devices/systems for the information system that are supported by an independent energy source.

The organization employs fire detection devices/systems for the information system that activate automatically and notify {{ insert: param, pe-13.1_prm_1 }} and {{ insert: param, pe-13.1_prm_2 }} i...

The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to {{ insert: param, pe-13.2_prm_1 }} and {{ insert: param...

The organization employs an automatic fire suppression capability for the information system when the facility is not staffed on a continuous basis.

The organization ensures that the facility undergoes {{ insert: param, pe-13.4_prm_1 }} inspections by authorized and qualified inspectors and resolves identified deficiencies within {{ insert: par...

The organization: a. Maintains temperature and humidity levels within the facility where the information system resides at {{ insert: param, pe-14_prm_1 }}; and b. Monitors temperature and humi...

The organization employs automatic temperature and humidity controls in the facility to prevent fluctuations potentially harmful to the information system.

The organization employs temperature and humidity monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment.

The organization protects the information system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key per...

The organization employs automated mechanisms to detect the presence of water in the vicinity of the information system and alerts {{ insert: param, pe-15.1_prm_1 }}.

The organization authorizes, monitors, and controls {{ insert: param, pe-16_prm_1 }} entering and exiting the facility and maintains records of those items.

The organization: a. Employs {{ insert: param, pe-17_prm_1 }} at alternate work sites; b. Assesses as feasible, the effectiveness of security controls at alternate work sites; and c. Provides...

The organization positions information system components within the facility to minimize potential damage from {{ insert: param, pe-18_prm_1 }} and to minimize the opportunity for unauthorized access.

The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards and for existing facilities, considers the physica...

The organization protects the information system from information leakage due to electromagnetic signals emanations.

The organization ensures that information system components, associated data communications, and networks are protected in accordance with national emissions and TEMPEST policies and procedures bas...

The organization: a. Employs {{ insert: param, pe-20_prm_1 }} to track and monitor the location and movement of {{ insert: param, pe-20_prm_2 }} within {{ insert: param, pe-20_prm_3 }}; and b. ...