Navigate

PE-14

PE-14: Environmental Controls

a: Maintain [one or more of "temperature"/"humidity"/"pressure"/"radiation"/"{{ insert: param, pe-14_odp.02 }} "] levels within the facility where the system resides at [acceptable levels for environmental controls are defined;] ; and

b: Monitor environmental control levels [frequency at which to monitor environmental control levels is defined;].

Supplemental

The provision of environmental controls applies primarily to organizational facilities that contain concentrations of system resources (e.g., data centers, mainframe computer rooms, and server rooms). Insufficient environmental controls, especially in very harsh environments, can have a significant adverse impact on the availability of systems and system components that are needed to support organizational mission and business functions.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	low

Overlays
DAF Baseline

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to PE-14.

Control	Description
AT-3	a: Provide role-based security and privacy training to personnel with the following roles and responsibilities: [one of ]: 1: Before authorizing access to the system, information, or performing assigned duties, and [the frequency at which to provide role-based security and privacy training to assigned personnel after initial training is defined;] thereafter; and 2: When required by system changes; b: Update role-based training content [the frequency at which to update role-based training content is defined;] and following [events that require role-based training content to be updated are defined;] ; and c: Incorporate lessons learned from internal or external security incidents or breaches into role-based training.
CP-2	a: Develop a contingency plan for the system that: 1: Identifies essential mission and business functions and associated contingency requirements; 2: Provides recovery objectives, restoration priorities, and metrics; 3: Addresses contingency roles, responsibilities, assigned individuals with contact information; 4: Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 5: Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented; 6: Addresses the sharing of contingency information; and 7: Is reviewed and approved by [one of ]; b: Distribute copies of the contingency plan to [one of ]; c: Coordinate contingency planning activities with incident handling activities; d: Review the contingency plan for the system [frequency of contingency plan review is defined;]; e: Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; f: Communicate contingency plan changes to [one of ]; g: Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and h: Protect the contingency plan from unauthorized disclosure and modification.

Control

Description

AT-3

a: Provide role-based security and privacy training to personnel with the following roles and responsibilities: [one of ]:
- 1: Before authorizing access to the system, information, or performing assigned duties, and [the frequency at which to provide role-based security and privacy training to assigned personnel after initial training is defined;] thereafter; and
- 2: When required by system changes;

b: Update role-based training content [the frequency at which to update role-based training content is defined;] and following [events that require role-based training content to be updated are defined;] ; and

c: Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

CP-2

a: Develop a contingency plan for the system that:
- 1: Identifies essential mission and business functions and associated contingency requirements;
- 2: Provides recovery objectives, restoration priorities, and metrics;
- 3: Addresses contingency roles, responsibilities, assigned individuals with contact information;
- 4: Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
- 5: Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;
- 6: Addresses the sharing of contingency information; and
- 7: Is reviewed and approved by [one of ];

b: Distribute copies of the contingency plan to [one of ];

c: Coordinate contingency planning activities with incident handling activities;

d: Review the contingency plan for the system [frequency of contingency plan review is defined;];

e: Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;

f: Communicate contingency plan changes to [one of ];

g: Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and

h: Protect the contingency plan from unauthorized disclosure and modification.

Enhancements

The controls below (if any) add on to the requirements of PE-14.

Control	Description
PE-14(1)	Employ the following automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system: [automatic environmental controls to prevent fluctuations that are potentially harmful to the system are defined;].
PE-14(2)	Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to [personnel or roles to be notified by environmental control monitoring when environmental changes are potentially harmful to personnel or equipment is/are defined;].

Related CCIs

The CCIs below are tied to PE-14.

CCI	Definition
CCI-000971	Maintain temperature; humidity; pressure; radiation; and/or organization-defined environmental control levels within the facility where the system resides at organization-defined acceptable levels.
CCI-000972	Defines acceptable temperature, humidity, pressure, radiation, and/or organization-defined environmental control levels to be maintained within the facility where the system resides.
CCI-000973	Monitor environmental control levels in accordance with organization-defined frequency.
CCI-000974	Defines a frequency for monitoring environmental control levels.