Cyber · Trackr The Free Compliance Library
⌘K
PE · Plan wizard

Physical and Environmental Protection Plan

Documents how the facilities, environmental systems, and physical-access controls protecting the system are governed. Covers physical-access authorization, physical-access control, transmission and output-device protection, monitoring and visitor logging, emergency systems (power, lighting, fire suppression, water leak detection, HVAC), environmental protection, secure delivery and removal of assets, and alternate work-site protection. Covers the controls of the PE family in NIST SP 800-53 r5 and aligns with NFPA 75 (Fire Protection of Information Technology Equipment), TIA-942 (Data Center Standards), Uptime Institute Tier ratings, NIST SP 800-46 r2 (Telework Security), and FedRAMP physical-control inheritance models.

1 System metadata
Full official name of the information system.
Short identifier used in headings and references.
Role or named individual accountable for the system.
Describe what falls inside the authorization boundary - components, services, networks, data flows.
2 Baseline
Determines which controls in this family appear in your plan.
3 Physical and Environmental Protection approach
Approach basics → §4.x

Hosting model and identifiers that anchor the rest of the plan.

Where the system runs (e.g., 'FedRAMP-Moderate-authorized AWS GovCloud (US)', 'Agency-operated data center at Site A', 'Hybrid: prod on AWS GovCloud + DR at agency Tier-III facility').
Name and location of the primary facility (e.g., 'AWS GovCloud US-Gov-West-1 region', 'Building 4 Data Center, Crystal City VA').
Name and location of the alternate / disaster-recovery facility. Reference CP plan for the activation criteria.
Role responsible for physical-access decisions (e.g., 'Facility Security Officer (FSO)', 'ISSM / Physical Security delegate'). Reference PS-1 for the screening half of the workflow.
Brief phrase summarizing the workflow (e.g., 'ServiceNow request → ISSM approval → badge office', 'AWS IAM does not apply — physical access is provider-inherited; agency-staff badge handled via OPM workflow').
Where visitors are logged (e.g., 'Lobby visitor-management kiosk + paper logbook', 'Guard post + Signed-in workflow in BadgePass').
Provider supplying environmental controls (e.g., 'AWS — see FedRAMP package', 'Crystal City data-center operator — see SLA + SOC 2', 'Agency facility ops — internal').
Where provider-supplied evidence (FedRAMP CRM, SOC 2, SLA reports) is stored on file.
Facility Inventory → §2.x

List of facilities in scope and their roles.

    Suggested:
    Physical Access Authorization (PE-2) → §4.x

    Who is authorized to enter, on what basis, and how the list is maintained.

    Role accountable for maintaining the authorized-access list (e.g., 'Facility Security Officer with ISSO concurrence').
    What entitles a person to physical access (e.g., 'Active background investigation completion (PS-3) + need-to-access justification + supervisor approval').
    How often the access list is reviewed (typical values: 'Quarterly', 'Annually'). PE-2 ODV.
    How urgent / temporary access is granted (e.g., post-incident investigators, vendor maintenance crews) without bypassing core controls.
    Physical Access Control (PE-3) → §4.x

    How entry and egress are physically controlled.

    How exit is controlled (free egress for safety + monitoring, anti-passback, exit interviews for sensitive areas).
    Who must be escorted (visitors, vendors without clearance, contractor staff). Escort-to-visitor ratio. Reference MA-5 for maintenance personnel.
    IDS at entry / boundary (door-sensor, motion, glass-break). Alarm routing to security operations + on-call.
    How physical keys, electronic-credentials, and lock combinations are inventoried and rotated. Lost-key procedures.
    Transmission and Output (PE-4, PE-5) → §4.x

    Protection of cabling, ports, and output devices.

    How transmission lines are protected from interception / damage (conduit, raceway, locked patch panels, fiber for sensitive runs).
    How unused network ports / USB ports are physically disabled (port-blockers, NAC enforcement). Coordinated with IA-3.
    How printers, monitors, and copiers are positioned / shielded so output is not visible to unauthorized observers (privacy filters, secure-print release, no-monitor-facing-window policy).
    Monitoring and Visitor Management (PE-6, PE-8) → §4.x

    How activity at the boundary is monitored and visitors are tracked.

    How long surveillance recordings are retained (e.g., '90 days for routine; longer for incident-tagged'). PE-6(1) ODV.
    How long visitor logs are retained. PE-8 ODV. Common: 'One year', 'Per NARA records-retention schedule'.
    How often visitor logs are reviewed for anomalies (escort gaps, off-hours visits).
    Emergency Power, Lighting, and Shutoff (PE-9 through PE-12) → §4.x

    Power resilience and life-safety.

    Redundancy of power: dual feeds, UPS, generator, transfer-switch behavior. Dual A+B power at rack level (PE-9(1)).
    EPO (Emergency Power Off) location, activation criteria, blast-radius (rack vs row vs room). Whether EPO is hardware-disable / requires fire-marshal coordination.
    UPS runtime, generator capacity, fuel-supply duration, automated transfer-test cadence. PE-11(1) for graceful-shutdown automation.
    Battery-backed lighting in egress paths, IT areas. Inspection cadence. PE-12 ODV.
    Environmental Protection (PE-13, PE-14, PE-15) → §4.x

    Fire suppression, climate control, water-leak detection.

    VESDA / aspirating smoke detection, photoelectric, ionization. Notification routing (24/7 monitored alarm, fire-marshal direct line).
    How often fire suppression is inspected per NFPA 25 (typically annual + quarterly visual).
    Allowable range (e.g., '64-81°F (18-27°C); 20-80% RH per ASHRAE TC9.9 Class A1'). Reference TIA-942.
    Sensor coverage, BMS / DCIM integration, alert thresholds, escalation paths.
    Leak-detection cable / sensor coverage, automatic shutoff, drainage paths. PE-15(1) for automated shutoff.
    Delivery and Removal (PE-16) → §4.x

    How assets are checked in and removed.

    How new assets enter the facility (receiving-dock workflow, integrity inspection, asset-tag application, CMDB entry).
    Who can authorize removal of assets, what paperwork is required, chain-of-custody. Reference MP-5 if media, SR-12 if supply-chain element.
    Where intake / removal events are logged (CMDB, dedicated property-management tool, paper logbook + scanned).
    Alternate Work Site (PE-17) → §4.x

    Telework and alternate-location protections.

    Pointer to telework-security training (often part of AT-2 awareness). Reference NIST SP 800-46 r2 for guidance.
    How telework-site safeguards are periodically assessed (self-attestation, sample audits, video walkthrough for sensitive roles).
    Physical Scope and Coverage → §2.x

    Quantitative scope numbers that anchor metrics later in the plan.

    Approximate count of persons on the PE-2 access list.
    Total number of in-scope facilities (primary + alternate + telework typical-locations if quantified).
    Order-of-magnitude visitors per month (anchors visitor-log review effort).
    Approximate count of users on telework arrangement (PE-17).
    Physical-and-Environmental Metrics & KPIs → §6.x

    Metrics tracked to demonstrate PE control effectiveness.

      Suggested:
      Provider Assurance Verification → §6.x

      How inherited controls are verified for systems hosted in cloud / colocation.

      How often the provider's FedRAMP package / SOC 2 report is reviewed for control effectiveness (typically annual at report receipt).
      How significant changes to provider environment are tracked (FedRAMP CSP change notices, provider service-health channels, vendor-incident notifications).
      Pointer to the shared-responsibility / customer-responsibility matrix for the provider (e.g., 'AWS GovCloud CRM rev 2025-Q1 at /repo/compliance/aws-crm.pdf').
      Cross-references to other RMF artifacts → §7

      Where this plan plugs into the broader RMF package.

      Where in the SSP the PE control implementations are summarized (e.g., 'SSP §13.9').
      Convention for PE-related POA&M items (e.g., 'POAM-PE-' for general).
      How PS-3 personnel screening underwrites PE-2 access authorization. Specifically the trigger that updates the PE-2 list when a screening lapses.
      How PE-3 escort policy applies to MA-5 maintenance personnel. Coordination of vendor-visit windows.
      How PE-16 delivery / removal procedures apply to media transport (MP-5).
      How PE environmental controls underwrite CP-2 contingency-plan assumptions about facility availability. Where alternate-facility (PE primary's DR) lives in the CP plan.
      How physical-access incidents (unauthorized entry, environmental alarms) escalate into the IR plan workflow.
      Pointer to the CA-7 monitoring strategy document tying PE continuous-monitoring metrics to the broader ConMon plan.
      4 Per-control implementation

      Pick a baseline in section 2 and the applicable controls will appear here. Each control gets a card with the official text, related controls, linked CCIs, and fields for your implementation status, narrative, responsible role, and evidence.

      5 Document metadata

      Your answers autosave to this browser. Click Save progress to download a JSON file you can re-upload later or share.