IT-12: Physical and Environmental Protection (PE) Standard

Control:

Physical Access Authorizations

Required for:

High

IU Implementation

• Develop, approve, and maintain a list of individuals who are authorized to access the physical area where IT resources are housed.
• Review the list of authorized individuals at least quarterly and remove individuals from the list who are no longer authorized for access.

Notes

• This control applies to all employees, students, and contractors.
• Use of centrally provisioned, common IT infrastructure and services provided by UITS often fulfills many of these requirements. Check with the service owner for details.

NIST Cross Reference

PE-2

Control:

Physical Access Controls

Required for:

High

IU Implementation

• Implement physical access control for the physical areas housing IT resources.
• Maintain physical access logs for the facility.
• Ensure visitors are monitored and/or escorted in the facility.

Notes

• This control applies to all employees, students, and contractors.
• Examples of appropriate physical controls can include locked doors, reception desk staff, keycard readers, and/or door keys or access cards for authorized personnel only.
• Controls for visitors may include visitor badges, visitor escorts, and/or requiring visitors to sign in at the front desk.
• See also PS-5, Access Control for Output Devices in this standard.
• Use of centrally provisioned, common IT infrastructure and services provided by UITS often fulfills many of these requirements. Check with the service owner for details

SCOPE: Does not apply to public areas.

NIST Cross Reference

PE-3

Control:

Access Control for Output Devices

Required for:

High

IU Implementation

Control physical access to information output devices such as printers and fax machines to prevent unauthorized access to Critical or Restricted data.

Notes

See Physical Access Controls in this standard for examples of access controls.

SCOPE: Applies to devices such as computers, monitors, printers, copiers, fax machines, and audio devices.

NIST Cross Reference

PE-5

Control:

Monitoring Physical Access

Required for:

High

IU Implementation

Monitor physical access to areas storing information systems.

Notes

Use of centrally provisioned, common IT infrastructure and services provided by UITS often fulfills many of these requirements. Check with the service owner for details.

NIST Cross Reference

PE-6

Control:

Visitor Access Records

Required for:

High

IU Implementation

Document visitor access to data centers. Retain access logs for a minimum of 45 days.

Notes

Logs can be electronic or as simple as a sign-in sheet. Logs are only needed for the parts of a facility that require authorized access (i.e., they are not necessary for public areas).

Use of centrally provisioned, common IT infrastructure and services provided by UITS often fulfills many of these requirements. Check with the service owner for details.

NIST Cross Reference

PE-8

Control:

Emergency Power

Required for:

High

IU Implementation

Use a backup or uninterruptible power supply to continue operations in the event of the loss of primary power, and/or to facilitate an orderly shutdown of the resource.

Notes

Some systems may require longer backup power solutions than others. Consider the effects of an outage on systems in terms of their criticality or impact on public safety, and take these effects into consideration when determining the length of time for which backup power is needed.

Use of centrally provisioned, common IT infrastructure and services provided by UITS often fulfills many of these requirements. Check with the service owner for details.

NIST Cross Reference

PE-11

Control:

Delivery and Removal

Required for:

High

IU Implementation

Develop a process to authorize, control, and record the entry and exit of information technology resource components into and out of the facility.

Maintain records of current components.

Notes

Use of centrally provisioned, common IT infrastructure and services provided by UITS often fulfills many of these requirements. Check with the service owner for details.

NIST Cross Reference

PE-16