Physical and Environmental Protection Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for physical and environmental protection in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers physical and environmental protection for the facilities, rooms, and equipment where the Organization processes information. Physical access defeats logical controls, so the Organization must control it. The Organization must authorize physical access individually and audit it. It must control and escort visitors, monitor entry and exit, and protect equipment against power, fire, temperature, and water hazards. It must keep the physical records needed to reconstruct an incident.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• PR.DS — Data Security (Protect function)
• DE.CM — Continuous Monitoring (Detect function)

These categories fall under the Detect, Protect function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every physical and environmental protection control in the moderate baseline of FIPS 200 and NIST SP 800-53B:

• PE-01 — Policy and Procedures
• PE-02 — Physical Access Authorizations
• PE-03 — Physical Access Control
• PE-04 — Access Control for Transmission
• PE-05 — Access Control for Output Devices
• PE-06 — Monitoring Physical Access
• PE-06(1) — Intrusion Alarms and Surveillance Equipment
• PE-08 — Visitor Access Records
• PE-08(3) — Limit Personally Identifiable Information Elements
• PE-09 — Power Equipment and Cabling
• PE-10 — Emergency Shutoff
• PE-11 — Emergency Power
• PE-12 — Emergency Lighting
• PE-13 — Fire Protection
• PE-13(1) — Detection Systems — Automatic Activation and Notification
• PE-13(2) — Suppression Systems — Automatic Activation and Notification
• PE-14 — Environmental Controls
• PE-15 — Water Damage Protection
• PE-16 — Delivery and Removal
• PE-17 — Alternate Work Site

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy, September 15, 2016.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the PE control family. They add to the NIST SP 800-53 control requirements in the Policy section.

NIST SP 800-116 Rev 1: Guidelines for the Use of PIV Credentials in Facility Access

• The organization should authenticate PIV credentials electronically at physical access points, using more authentication factors for controlled, limited, and exclusion areas as risk increases. (NIST SP 800-116 Rev 1, §§4-5)
• The organization should use physical access control products from the GSA FIPS 201 Approved Products List. (NIST SP 800-116 Rev 1; OMB M-19-17)

3. Policy #

The Organization must implement and maintain its physical and environmental protection controls to meet the following requirements:

PE-01 — Policy and Procedures #

Baselines: Low / Moderate / High

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] physical and environmental protection policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the physical and environmental protection policy and the associated physical and environmental protection controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures; and
3. Review and update the current physical and environmental protection:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep a physical and environmental protection policy and the procedures that put it into practice. The policy states its purpose and scope, assigns roles and responsibilities, records management’s commitment and coordination across organizational entities, and sets compliance expectations. It must stay consistent with federal law and directives. The procedures make the PE controls workable in daily operations. The CISO owns both documents: the CISO develops them, documents them, and distributes them to the Authorizing Official (AO), System Owners, Information System Security Officers (ISSOs), and key stakeholders. The CISO reviews and updates the policy and the procedures every year, and sooner when a major change to applicable policy requires it. A PE control operated against an outdated document is a gap.

PE-02 — Physical Access Authorizations #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

1. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides;
2. Issue authorization credentials for facility access;
3. Review the access list detailing authorized facility access by individuals at least annually; and
4. Remove individuals from the facility access list when access is no longer required.

Implementation guidance:

The System Owner must develop, approve, and maintain the list of individuals authorized to enter the facility that houses the system. The Organization must issue an access credential, a badge or equivalent, only to individuals on that list. The ISSO must review the access list every year and confirm that every entry still has a business reason to enter. The ISSO must promptly remove individuals whose duties no longer require facility access. The Organization must recover or deactivate their credentials. A provider or cloud service provider may operate the facility. The Organization then keeps the list obligation for its own personnel: it decides who appears on the list it sponsors, and it starts the removals.

PE-03 — Physical Access Control #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

1. Enforce physical access authorizations at [Assignment: organization-defined entry and exit points — to be defined] by:

1. Verifying individual access authorizations before granting access to the facility; and
2. Controlling ingress and egress to the facility using CSP defined physical access control systems/devices AND guards;

2. Maintain physical access audit logs for [Assignment: organization-defined entry or exit points — to be defined];
3. Control access to areas within the facility designated as publicly accessible by implementing the following controls: [Assignment: organization-defined physical access controls — to be defined];
4. Escort visitors and control visitor activity in all circumstances within restricted access area where the information system resides;
5. Secure keys, combinations, and other physical access devices;
6. Inventory [Assignment: organization-defined physical access devices — to be defined] every at least annually; and
7. Change combinations and keys at least annually or earlier as required by a security relevant event and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

Implementation guidance:

The Organization must enforce access authorizations at every physical access point. It verifies each individual’s authorization before entry and controls entry and exit through an HSPD-12-compliant physical access control system or posted guards. The physical access control system must verify each Personal Identity Verification (PIV) credential electronically by validating its certificates, not by visual inspection. The assurance level for each area follows NIST SP 800-116 Rev. 1. The Organization must keep audit logs for every access point where it enforces authorizations. For areas open to the public, the System Owner or supporting contractor must recommend the boundary controls, and the CISO and AO must approve them before they take effect. Through the same approval path, the CISO and AO decide when staff must escort visitors and monitor their activity. The System Owner must secure keys, combinations, and other access devices and inventory them at least once a year. The System Owner must change combinations and keys at least once a year, and immediately when a key is lost, a combination is exposed, or a holder transfers or leaves.

PE-04 — Access Control for Transmission #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

Control physical access to [Assignment: organization-defined system distribution and transmission lines — to be defined] within organizational facilities using [Assignment: organization-defined security controls — to be defined].

Implementation guidance:

The Organization must control physical access to telecommunications closets and to the distribution and transmission lines that serve its systems inside its facilities. The System Owner must make sure wiring closets stay locked, spare jacks are disconnected or locked out, and cable runs are shielded by conduit or cable trays. Where physical shielding is impractical, the System Owner must make sure the transmitted data is encrypted instead. The System Owner must confirm these protections for every space that carries system circuits, and the ISSO must verify them during physical security reviews. Where transmission infrastructure sits inside a provider-operated facility, the Organization confirms the protection through the provider’s documentation. The ISSO must record every discovered exposure, such as an unlocked closet or an abandoned live jack, and track it until it is corrected.

PE-05 — Access Control for Output Devices #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

Control physical access to output from [Assignment: organization-defined output devices — to be defined] to prevent unauthorized individuals from obtaining the output.

Implementation guidance:

The Organization must control physical access to the output of all IT assets, including printers, copiers, scanners, monitors, and similar devices, so that only authorized individuals can view or collect it. System Owners must place shared output devices in spaces that personnel can observe or that require badge access. All personnel must collect print jobs promptly and clear finished output from the device before they leave it. System Owners must position or filter monitors that display sensitive information in walkways or visitor-facing areas so that passersby cannot read them. Unclaimed output found on a device is unattended sensitive material: whoever finds it secures it and reports it. Personnel must raise repeated occurrences to the ISSO.

PE-06 — Monitoring Physical Access #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security), DE.CM (Continuous Monitoring)

Requirement:

1. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents;
2. Review physical access logs at least monthly and upon occurrence of [Assignment: organization-defined events — to be defined]; and
3. Coordinate results of reviews and investigations with the organizational incident response capability.

Implementation guidance:

The Organization must monitor physical access to the facilities that house its systems so that it detects and responds to physical security incidents. It uses the monitoring capability the facility operates and its own review of the resulting records. The ISSO must review physical access logs at least every month for low- and moderate-impact systems and monthly for high-impact systems. The ISSO must also review them immediately when there is an indication of suspicious activity. Examples are an entry far outside working hours, repeated attempts on areas the person never uses, or an access sequence that makes no operational sense. The ISSO must coordinate findings from log reviews and any resulting investigation with the Organization’s incident response capability. A physical anomaly receives the same handling as a network one.

PE-06(1) — Intrusion Alarms and Surveillance Equipment #

Baselines: Moderate / High

Requirement:

Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.

Implementation guidance:

Physical intrusion alarms and surveillance equipment must monitor facilities that house moderate- and high-impact systems, whether the Organization or the facility provider operates them. The System Owner must confirm that spaces containing system equipment fall within alarm and camera coverage. The ISSO must verify that alarm events reach a monitored response point. The ISSO must report coverage gaps found in review to the provider and track them until closed.

PE-08 — Visitor Access Records #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security), DE.CM (Continuous Monitoring)

Requirement:

1. Maintain visitor access records to the facility where the system resides for a minimum of one (1) year;
2. Review visitor access records at least monthly; and
3. Report anomalies in visitor access records to [Assignment: organization-defined personnel — to be defined].

Implementation guidance:

The Organization must keep visitor access records for every facility that houses its systems. Each record shows who visited, from what organization, whom they saw, and when they arrived and left. The Organization must retain those records for at least 1 year. The ISSO must review the visitor records at least every month for entries that do not match legitimate business. Examples are a visit with no identifiable host, a recurring visitor with no sponsor, or a missing sign-out. Anyone who finds an anomaly must report it to the ISSO. The ISSO must report it to the Information System Security Manager (ISSM) and to the facility security staff, including the Federal Protective Service where it holds protective responsibility for the building.

PE-08(3) — Limit Personally Identifiable Information Elements #

Baselines: Privacy

Requirement:

Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: [Assignment: organization-defined elements — to be defined].

Implementation guidance:

The Senior Agency Official for Privacy (SAOP) must approve the list of personally identifiable information (PII) elements that visitor access records may contain. Visitor access records must hold only [PE-08(3) parameter 1 — to be defined]. The Information Owner for visitor access records must make sure that staff who sign in visitors collect no other PII. Staff must not copy or record identity document numbers unless the approved list includes them. The Privacy Officer must check visitor sign-in forms and screens against the approved list before they go into use and after any change.

PE-09 — Power Equipment and Cabling #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

Protect power equipment and power cabling for the system from damage and destruction.

Implementation guidance:

The Organization must protect the power equipment and power cabling that serve its systems from damage and destruction. This applies whether the infrastructure sits in the Organization’s own space or in a provider-operated facility. Where the Organization controls the space, the System Owner must keep power distribution equipment in secured rooms. The System Owner must also protect cabling against accidental and deliberate harm. Where the data center or building provider operates the power plant, the Organization must obtain and review the provider’s documentation that shows the protection exists. The ISSO must record that verification. Anyone who finds a power protection failure in operations or during an inspection must report it. The Organization must track the failure to correction.

PE-10 — Emergency Shutoff #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

1. Provide the capability of shutting off power to [Assignment: organization-defined system or individual system components — to be defined] in emergency situations;
2. Place emergency shutoff switches or devices in near more than one egress point of the IT area and ensures it is labeled and protected by a cover to prevent accidental shut-off to facilitate access for authorized personnel; and
3. Protect emergency power shutoff capability from unauthorized activation.

Implementation guidance:

Facilities that house system equipment must provide a way to cut power to any piece of equipment in an emergency. The System Owner or supporting contractor must recommend where to place emergency shutoff switches so that authorized personnel can reach them quickly, and the CISO and AO must approve those locations before installation. The System Owner must make sure the shutoff has protection against accidental or unauthorized activation: a cover, an alarm, or placement inside a controlled space. An adversary who activates the shutoff causes a denial of service. Personnel who work in equipment spaces must know where the shutoff is and when to use it.

PE-11 — Emergency Power #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

Provide an uninterruptible power supply to facilitate [Selection: an orderly shutdown of the system; transition of the system to long-term alternate power — to be defined] in the event of a primary power source loss.

Implementation guidance:

An uninterruptible power supply must serve every facility that houses system equipment. The uninterruptible power supply (UPS) must carry the load long enough for a controlled shutdown and for the transfer to long-term alternate power when an outage persists. Where the Organization operates the equipment room, the System Owner must make sure the UPS is maintained and tested on its service schedule. Where the Organization inherits the capability from a data center or cloud provider, the ISSO must verify through the provider’s documentation that conditioned and backup power protect the Organization’s workloads. The ISSO must record the verification. An outage that lasts longer than the protection is a contingency event. The Organization handles and reports it as one.

PE-12 — Emergency Lighting #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

Employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.

Implementation guidance:

Facilities where the Organization’s systems and personnel operate must have automatic emergency lighting that activates on power loss and covers exit paths and evacuation routes. The lighting lets people leave and responders work when normal lighting fails. Where the Organization occupies provider-operated space, the provider operates the lighting and the Organization verifies it. The System Owner must confirm coverage of the spaces its personnel and equipment occupy, and the ISSO must record the verification. Anyone who observes an emergency lighting failure during an outage, a drill, or an inspection must report it to the facility provider, and the ISSO must track it until repaired.

PE-13 — Fire Protection #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

Employ and maintain fire detection and suppression systems that are supported by an independent energy source.

Implementation guidance:

Fire detection and suppression systems must protect every facility that houses system equipment. Those systems must run on an energy source independent of the one that powers the rest of the facility, so that the protection survives a failure or isolation of building power. The facility provider operates the detection and suppression infrastructure, and the Organization must verify it. The System Owner must confirm that the spaces holding its equipment are within detection and suppression coverage. The ISSO must record that verification and revisit it when the facility or provider changes. Anyone who finds a coverage gap or an out-of-service protection system must report it, and the Organization treats it as an unacceptable exposure until the protection is restored.

PE-13(1) — Detection Systems — Automatic Activation and Notification #

Baselines: Moderate / High

Requirement:

Employ fire detection systems that activate automatically and notify service provider building maintenance/physical security personnel and service provider emergency responders with incident response responsibilities in the event of a fire.

Implementation guidance:

Fire detection that serves equipment spaces must activate automatically and must notify, without human relay, the ISSO, System Owners, Custodians, and the police and fire departments. The System Owner must confirm that this notification path exists for each occupied facility. The ISSO must keep the internal recipient list current so that an alarm never goes to a vacated role.

PE-13(2) — Suppression Systems — Automatic Activation and Notification #

Baselines: Moderate / High

Requirement:

1. Employ fire suppression systems that activate automatically and notify [Assignment: organization-defined personnel or roles — to be defined] and [Assignment: organization-defined emergency responders — to be defined]; and
2. Employ an automatic fire suppression capability when the facility is not staffed on a continuous basis.

Implementation guidance:

Fire suppression that protects equipment spaces must activate automatically and must notify the ISSO, System Owners, Custodians, and the police and fire departments when it discharges. Any facility that is not staffed around the clock must have automatic suppression in place. The capability matters most when no one is in the building. The System Owner must verify both conditions for every facility that houses system equipment.

PE-14 — Environmental Controls #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

1. Maintain consistent with American Society of Heating, Refrigerating and Air-conditioning Engineers (ASHRAE) document entitled Thermal Guidelines for Data Processing Environments levels within the facility where the system resides at [Assignment: organization-defined acceptable levels — to be defined]; and
2. Monitor environmental control levels continuously.

Implementation guidance:

Data center spaces that house system equipment must hold temperature and humidity within the operating ranges that the American Society of Heating, Refrigerating and Air-Conditioning Engineers (ASHRAE) recommends. Server-inlet temperature must stay between 18 and 27 degrees Celsius. Humidity, measured by dew point, must stay between 5.5 and 15 degrees Celsius. The monitoring of environmental levels must be continuous, not sampled, so that the Organization catches drift while it is still a maintenance issue. Where the data center is provider-operated, the provider runs the cooling plant and the monitoring. The System Owner must verify through provider documentation that these ranges and continuous monitoring are in force for the Organization’s equipment. The ISSO must record the verification. Anyone who observes a sustained excursion beyond the ranges must report it. The Organization treats a sustained excursion as an availability risk.

PE-15 — Water Damage Protection #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.

Implementation guidance:

Facilities that house system equipment must have master shutoff and isolation valves that protect against water leakage. The valves must be reachable, in working order, and known to the personnel expected to use them. The facility provider maintains the plumbing infrastructure and its valves, and the Organization must know where its shutoffs are and who turns them. The System Owner must make sure the valve locations for spaces that hold organizational equipment are identified and that the responsible on-site personnel are briefed on them. The ISSO must record the verification and refresh it when the facility or the occupied footprint changes. Anyone who sees a leak near equipment must report it immediately, because the valve only helps if someone reaches it in time.

PE-16 — Delivery and Removal #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

1. Authorize and control all information system components entering and exiting the facility; and
2. Maintain records of the system components.

Implementation guidance:

The System Owner must authorize every system component that enters or leaves the facility in advance, and the Organization must control each movement through the delivery and removal process. The Organization refuses unscheduled arrivals and undocumented removals. The System Owner must approve component deliveries and removals for its systems. The Organization must keep a record of every component movement: what came or went, when, and under whose authorization. Delivery areas must stay separate from spaces that hold system equipment so that an unescorted courier is never next to production hardware. The ISSO must reconcile movement records against asset records so that the records match the physical inventory.

PE-17 — Alternate Work Site #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security), DE.CM (Continuous Monitoring)

Requirement:

1. Determine and document the [Assignment: organization-defined alternate work sites — to be defined] allowed for use by employees;
2. Employ the following controls at alternate work sites: [Assignment: organization-defined controls — to be defined];
3. Assess the effectiveness of controls at alternate work sites; and
4. Provide a means for employees to communicate with information security and privacy personnel in case of incidents.

Implementation guidance:

The System Owner or supporting contractor must define alternate work sites, including telework locations and other approved sites. The CISO and AO must approve those sites before employees work from them. At those sites, employees must follow the safeguards in the Organization Telework Agreement and the Information System Security Policy (ISSP). They must also follow any other alternate work site security policy the CISO and AO have approved. The Organization must assess whether those safeguards work as intended at the sites. Every employee who works remotely must have a working way to reach information security and privacy personnel when an incident occurs at the alternate site.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of physical and environmental protection controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves physical and environmental protection through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Integrate badging with the identity lifecycle so physical access changes automatically with personnel actions.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• HSPD-12: Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• NIST SP 800-116 Rev. 1: Guidelines for the Use of PIV Credentials in Facility Access, June 2018.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy, September 15, 2016.
• OMB M-19-17: Enabling Mission Delivery through Improved Identity, Credential, and Access Management (ICAM), May 21, 2019.