Navigate

PE-16

PE-16: Delivery and Removal

a: Authorize and control [one of ] entering and exiting the facility; and

b: Maintain records of the system components.

Supplemental

Enforcing authorizations for entry and exit of system components may require restricting access to delivery areas and isolating the areas from the system and media libraries.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
DAF Baseline

CSF Categories
PR.DS-3

Related Controls

The controls below (if any) were marked by NIST as being related to PE-16.

Control	Description
CM-3	a: Determine and document the types of changes to the system that are configuration-controlled; b: Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses; c: Document configuration change decisions associated with the system; d: Implement approved configuration-controlled changes to the system; e: Retain records of configuration-controlled changes to the system for [the time period to retain records of configuration-controlled changes is defined;]; f: Monitor and review activities associated with configuration-controlled changes to the system; and g: Coordinate and provide oversight for configuration change control activities through [the configuration change control element responsible for coordinating and overseeing change control activities is defined;] that convenes [one or more of "{{ insert: param, cm-03_odp.04 }} "/"when {{ insert: param, cm-03_odp.05 }} "].
CM-8	a: Develop and document an inventory of system components that: 1: Accurately reflects the system; 2: Includes all components within the system; 3: Does not include duplicate accounting of components or components assigned to any other system; 4: Is at the level of granularity deemed necessary for tracking and reporting; and 5: Includes the following information to achieve system component accountability: [information deemed necessary to achieve effective system component accountability is defined;] ; and b: Review and update the system component inventory [frequency at which to review and update the system component inventory is defined;].
MA-2	a: Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b: Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location; c: Require that [personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs is/are defined;] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement; d: Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement is defined;]; e: Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and f: Include the following information in organizational maintenance records: [information to be included in organizational maintenance records is defined;].
MA-3	a: Approve, control, and monitor the use of system maintenance tools; and b: Review previously approved system maintenance tools [frequency at which to review previously approved system maintenance tools is defined;].
MP-5	a: Protect and control [types of system media to protect and control during transport outside of controlled areas are defined;] during transport outside of controlled areas using [one of ]; b: Maintain accountability for system media during transport outside of controlled areas; c: Document activities associated with the transport of system media; and d: Restrict the activities associated with the transport of system media to authorized personnel.
PE-20	Employ [asset location technologies to be employed to track and monitor the location and movement of assets is defined;] to track and monitor the location and movement of [assets whose location and movement are to be tracked and monitored are defined;] within [controlled areas within which asset location and movement are to be tracked and monitored are defined;].
SR-2	a: Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [systems, system components, or system services for which a supply chain risk management plan is developed are defined;]; b: Review and update the supply chain risk management plan [the frequency at which to review and update the supply chain risk management plan is defined;] or as required, to address threat, organizational or environmental changes; and c: Protect the supply chain risk management plan from unauthorized disclosure and modification.
SR-3	a: Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined;] in coordination with [supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes is/are defined;]; b: Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [supply chain controls employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events are defined;] ; and c: Document the selected and implemented supply chain processes and controls in [one or more of "security and privacy plans"/"supply chain risk management plan"/"{{ insert: param, sr-03_odp.05 }} "].
SR-4	Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [systems, system components, and associated data that require valid provenance are defined;].
SR-6	Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide is defined;].

Enhancements

The controls below (if any) add on to the requirements of PE-16.

Control	Description
No controls

Related CCIs

The CCIs below are tied to PE-16.

CCI	Definition
CCI-000981	Authorize organization-defined types of system components entering and exiting the facility.
CCI-000983	Control organization-defined types of system components entering and exiting the facility.
CCI-000984	Maintain records of system components.
CCI-002974	Defines types of system components to authorize and control entering and exiting the facility and to maintain records.