Navigate

PE-16

PE-16: Delivery And Removal

The organization authorizes, monitors, and controls [Assignment: organization-defined types of information system components] entering and exiting the facility and maintains records of those items.

Supplemental

Effectively enforcing authorizations for entry and exit of information system components may require restricting access to delivery areas and possibly isolating the areas from the information system and media libraries.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to PE-16.

Control	Description
CM-3	The organization: CM-3a.: Determines the types of changes to the information system that are configuration-controlled; CM-3b.: Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses; CM-3c.: Documents configuration change decisions associated with the information system; CM-3d.: Implements approved configuration-controlled changes to the information system; CM-3e.: Retains records of configuration-controlled changes to the information system for [Assignment: organization-defined time period]; CM-3f.: Audits and reviews activities associated with configuration-controlled changes to the information system; and CM-3g.: Coordinates and provides oversight for configuration change control activities through [Assignment: organization-defined configuration change control element (e.g., committee, board)] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined configuration change conditions]].
MA-2	The organization: MA-2a.: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements; MA-2b.: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location; MA-2c.: Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs; MA-2d.: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs; MA-2e.: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and MA-2f.: Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.
MA-3	The organization approves, controls, and monitors information system maintenance tools.
MP-5	The organization: MP-5a.: Protects and controls [Assignment: organization-defined types of information system media] during transport outside of controlled areas using [Assignment: organization-defined security safeguards]; MP-5b.: Maintains accountability for information system media during transport outside of controlled areas; MP-5c.: Documents activities associated with the transport of information system media; and MP-5d.: Restricts the activities associated with the transport of information system media to authorized personnel.
SA-12	The organization protects against supply chain threats to the information system, system component, or information system service by employing [Assignment: organization-defined security safeguards] as part of a comprehensive, defense-in-breadth information security strategy.

Enhancements

The controls below (if any) add on to the requirements of PE-16.

Control	Description
No controls

Related CCIs

The CCIs below are tied to PE-16.

CCI	Definition
CCI-000981	The organization authorizes organization-defined types of information system components entering and exiting the facility.
CCI-000982	The organization monitors organization-defined types of information system components entering and exiting the facility.
CCI-000983	The organization controls organization-defined types of information system components entering and exiting the facility.
CCI-000984	The organization maintains records of information system components entering and exiting the facility.
CCI-002974	The organization defines types of information system components to authorize, monitor, and control entering and exiting the facility and to maintain records.