Navigate

PE-5

PE-5: Access Control For Output Devices

The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.

Supplemental

Controlling physical access to output devices includes, for example, placing output devices in locked rooms or other secured areas and allowing access to authorized individuals only, and placing output devices in locations that can be monitored by organizational personnel. Monitors, printers, copiers, scanners, facsimile machines, and audio devices are examples of information system output devices.

CIA Levels
Confidentiality	moderate
Integrity	unknown
Availability	unknown

Overlays
Int-B, Int-C, Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to PE-5.

Control	Description
PE-2	The organization: PE-2a.: Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides; PE-2b.: Issues authorization credentials for facility access; PE-2c.: Reviews the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency]; and PE-2d.: Removes individuals from the facility access list when access is no longer required.
PE-3	The organization: PE-3a.: Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by; PE-3a.1.: Verifying individual access authorizations before granting access to the facility; and PE-3a.2.: Controlling ingress/egress to the facility using [Selection (one or more): [Assignment: organization-defined physical access control systems/devices]; guards]; PE-3b.: Maintains physical access audit logs for [Assignment: organization-defined entry/exit points]; PE-3c.: Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; PE-3d.: Escorts visitors and monitors visitor activity [Assignment: organization-defined circumstances requiring visitor escorts and monitoring]; PE-3e.: Secures keys, combinations, and other physical access devices; PE-3f.: Inventories [Assignment: organization-defined physical access devices] every [Assignment: organization-defined frequency]; and PE-3g.: Changes combinations and keys [Assignment: organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
PE-4	The organization controls physical access to [Assignment: organization-defined information system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security safeguards].
PE-18	The organization positions information system components within the facility to minimize potential damage from [Assignment: organization-defined physical and environmental hazards] and to minimize the opportunity for unauthorized access.

Enhancements

The controls below (if any) add on to the requirements of PE-5.

Control	Description
PE-5 (1)	The organization: PE-5 (1)(a): Controls physical access to output from [Assignment: organization-defined output devices]; and PE-5 (1)(b): Ensures that only authorized individuals receive output from the device.
PE-5 (2)	The information system: PE-5 (2)(a): Controls physical access to output from [Assignment: organization-defined output devices]; and PE-5 (2)(b): Links individual identity to receipt of the output from the device.
PE-5 (3)	The organization marks [Assignment: organization-defined information system output devices] indicating the appropriate security marking of the information permitted to be output from the device.

Related CCIs

The CCIs below are tied to PE-5.

CCI	Definition
CCI-000937	The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.