Physical and Environmental Protection Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the PE control family policy (POL-PE). It covers every control in the physical and environmental protection family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the PE family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the moderate security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• PR.DS — Data Security (Protect function)
• DE.CM — Continuous Monitoring (Detect function)

3. Controls Covered #

This procedure covers the following 20 controls in the PE family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the PE control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

NIST SP 800-116 Rev 1: Guidelines for the Use of PIV Credentials in Facility Access

• The organization should authenticate PIV credentials electronically at physical access points, using more authentication factors for controlled, limited, and exclusion areas as risk increases. (NIST SP 800-116 Rev 1, §§4-5)
• The organization should use physical access control products from the GSA FIPS 201 Approved Products List. (NIST SP 800-116 Rev 1; OMB M-19-17)

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the PE controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Physical and Environmental Protection family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The Physical Security Officer carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The CISO oversees the procedure and receives its performance measures. See the PE policy (POL-PE) for the role definitions.

4.2 Control-Specific Procedures #

PE-01 — Policy and Procedures #

Baselines: Low / Moderate / High

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] physical and environmental protection policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the physical and environmental protection policy and the associated physical and environmental protection controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures; and
3. Review and update the current physical and environmental protection:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Procedure:

The CISO’s office keeps the master copies of POL-PE and PROC-PE under version control and runs their review. The CISO’s office starts a review every 3 years, and sooner when a major change to applicable policy is issued. The CISO opens the review in the policy library in the document management system. The CISO collects input from System Owners and Information System Security Officers (ISSOs) on what has changed in operations, such as badge practices, escort rules, and facility provider arrangements, and then drafts the revision.

The CISO approves the revised policy and procedures. The CISO’s office sends the approved versions to the Authorizing Official (AO), System Owners, ISSOs, and key stakeholders through the standard distribution channel and records the distribution in the review record. The CISO’s office archives superseded versions instead of deleting them, so the rule in force on any past date can be found.

Evidence: the version history of both documents, the review and distribution records in the document management system, and the change log that states what each revision changed and why.

PE-02 — Physical Access Authorizations #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

1. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides;
2. Issue authorization credentials for facility access;
3. Review the access list detailing authorized facility access by individuals at least annually; and
4. Remove individuals from the facility access list when access is no longer required.

Procedure:

The System Owner sponsors facility access through a ticketing system request that names the individual, the business justification, and the areas required. The System Owner or designee approves the request. Approval places the individual on the authorized access list and starts credential issuance. No one receives a badge without an approved request.

Every year the ISSO pulls the current access list, sends it to the sponsoring System Owners for confirmation, and records their attestation. The ISSO removes any entry that no sponsor confirms, and the credential issuer deactivates the associated credentials on the day the review closes. A separation or transfer starts removal without waiting for the yearly cycle: the leaver workflow notifies the credential issuer, and out-processing includes recovering or disabling the badge.

Evidence: approved access requests, the dated access list with yearly attestations, removal records, and the credential issuance and deactivation log.

PE-03 — Physical Access Control #

Baselines: Low / Moderate / High / High Value Asset (HVA) overlay CSF 2.0: PR.DS (Data Security)

1. Enforce physical access authorizations at [Assignment: organization-defined entry and exit points — to be defined] by:

1. Verifying individual access authorizations before granting access to the facility; and
2. Controlling ingress and egress to the facility using CSP defined physical access control systems/devices AND guards;

2. Maintain physical access audit logs for [Assignment: organization-defined entry or exit points — to be defined];
3. Control access to areas within the facility designated as publicly accessible by implementing the following controls: [Assignment: organization-defined physical access controls — to be defined];
4. Escort visitors and control visitor activity in all circumstances within restricted access area where the information system resides;
5. Secure keys, combinations, and other physical access devices;
6. Inventory [Assignment: organization-defined physical access devices — to be defined] every at least annually; and
7. Change combinations and keys at least annually or earlier as required by a security relevant event and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

Procedure:

Personnel enter through the badge readers and, where posted, the guard force. At each controlled door, the reader validates the Personal Identity Verification (PIV) credential’s certificates electronically at the assurance level NIST SP 800-116 Rev. 1 sets for the area. The reader also checks the authorization record, and the physical access log records the transaction. Where guards control a door, they confirm the credential against the authorization record. Where a facility provider operates the building, the Organization relies on the provider’s HSPD-12-compliant infrastructure and keeps its own record of whom it sponsored, to which areas, and when.

Escorts stay with visitors under the circumstances the CISO and AO have approved, and the visit is logged. The System Owner controls keys, combinations, and other access devices. The ISSO leads an inventory of physical access control system (PACS) components at least once a year and reconciles the devices on hand against the record. Combinations and keys change at least once a year, and immediately when one is lost or exposed or when a holder transfers or leaves. Each rotation and inventory ends with a ticketing system ticket that shows completion.

Evidence: physical access logs, reader configuration records that show electronic PIV validation, the approved public-area and escort determinations, the annual PACS component inventory, and the rotation tickets with completion dates.

PE-04 — Access Control for Transmission #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Control physical access to [Assignment: organization-defined system distribution and transmission lines — to be defined] within organizational facilities using [Assignment: organization-defined security controls — to be defined].

Procedure:

Telecommunications closets are on the facility key control list. They stay locked, and keys go only to personnel whose duties require entry. A technician who needs access requests the visit, and the visit is recorded. The closet returns to a locked state when the work ends.

During the physical security review the ISSO inspects the spaces that carry system circuits: closet doors and locks, jack panels, and the conduit and cable tray runs between them. Any spare jack found live and unused is disconnected or locked out. The ISSO reports damaged conduit to the facility provider and tracks it to repair. Where lines pass through provider-controlled space, the ISSO confirms coverage through the provider’s facility documentation instead of direct inspection.

The ISSO opens a ticketing system ticket for each exposure the review finds, with an owner and a due date. Evidence: closet key issuance records, access requests for closet entry, the review’s inspection notes, and the remediation tickets that show the correction of each exposure.

PE-05 — Access Control for Output Devices #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Control physical access to output from [Assignment: organization-defined output devices — to be defined] to prevent unauthorized individuals from obtaining the output.

Procedure:

Shared printers, copiers, and scanners sit in work areas that badge-controlled doors or occupying staff keep under observation. System Owners do not place devices that produce sensitive output in publicly accessible space. When an office is set up or rearranged, the System Owner confirms device placement as part of the move. The ISSO checks placement and screen exposure during the periodic physical security review.

Each day, personnel collect their output when it prints and clear the device tray before they leave. Anyone who finds output turns it in. Personnel report repeated finds at a device to the ISSO. The ISSO relocates the device, restricts the area, or corrects the practice with the responsible team, and tracks the fix in the ticketing system.

Evidence: the placement confirmations from office setup, the ISSO’s review notes on device and screen exposure, and the tickets that document corrective actions on reported output-handling lapses.

PE-06 — Monitoring Physical Access #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security), DE.CM (Continuous Monitoring)

1. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents;
2. Review physical access logs at least monthly and upon occurrence of [Assignment: organization-defined events — to be defined]; and
3. Coordinate results of reviews and investigations with the organizational incident response capability.

Procedure:

The facility’s access control and monitoring infrastructure records entries at controlled doors, and the Organization reviews those records. On the review schedule, every month for low- and moderate-impact systems and monthly for high-impact systems, the ISSO pulls the physical access logs for the areas that house system equipment. The ISSO checks them for the trigger patterns: off-hours entries, repeated access to spaces outside a person’s duties, and out-of-order door sequences. The ISSO documents the review in a ticketing system ticket whether or not anything was found.

An anomaly moves the work from review to response. The ISSO opens an investigation, involves the facility provider’s security personnel where the provider controls the infrastructure, and hands confirmed incidents to the incident response process for handling and tracking. The ISSO adds the outcome to the review record so that patterns across cycles stay visible.

Evidence: the dated log review tickets, flagged-event documentation, investigation records, and the incident response entries for events that escalated.

PE-06(1) — Intrusion Alarms and Surveillance Equipment #

Baselines: Moderate / High

Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.

Procedure:

Alarm sensors and cameras that cover equipment spaces operate as part of the facility’s physical security infrastructure. When an alarm trips, the monitoring point dispatches a response and records the event, and the Organization receives notice when the event touches its space. The ISSO confirms coverage and alarm routing during the periodic physical security review, records the verification, and raises any gap with the facility provider through a ticketing system ticket tracked to closure. Evidence: the coverage verification notes, alarm event notifications received, and gap-remediation tickets.

PE-08 — Visitor Access Records #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security), DE.CM (Continuous Monitoring)

1. Maintain visitor access records to the facility where the system resides for a minimum of one (1) year;
2. Review visitor access records at least monthly; and
3. Report anomalies in visitor access records to [Assignment: organization-defined personnel — to be defined].

Procedure:

Every visitor signs in at the controlled entrance with their name, organization, the host they are visiting, and the arrival time. The visitor signs out with the departure time. The Organization keeps the record whether the register is its own or the facility provider’s. It retains its copy for at least 1 year.

At least every month, the ISSO pulls the visitor records for the review period. The ISSO checks each entry for a host who exists, a visit with a purpose, and a sign-out that closes the entry. The ISSO records the review in the ticketing system. The ISSO treats any entry that cannot be explained as an anomaly and documents it. The ISSO notifies the Information System Security Manager (ISSM) and reports the anomaly to the facility security staff, including the Federal Protective Service where applicable, for any follow-up the building’s protection requires.

Evidence: the retained visitor registers, the review ticket with its findings, the anomaly reports, and the notification records to the ISSM and facility security staff.

PE-08(3) — Limit Personally Identifiable Information Elements #

Baselines: Privacy

Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: [Assignment: organization-defined elements — to be defined].

Procedure:

During the privacy risk assessment, the Privacy Officer compares each field on the visitor sign-in forms and screens with [PE-08(3) parameter 1 — to be defined]. The Information Owner removes any field that is not on the list. The Senior Agency Official for Privacy (SAOP) then approves the final list of elements in writing.

Before a new or changed sign-in form goes into use, the Privacy Officer checks it against the approved list and records the result. The Information Owner briefs the staff who sign in visitors on which details they may collect.

Evidence: the approved element list, the Privacy Officer’s form review records, and the staff briefing record.

PE-09 — Power Equipment and Cabling #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Protect power equipment and power cabling for the system from damage and destruction.

Procedure:

In spaces the Organization controls, power distribution units, panels, and cable runs that serve system equipment sit behind locked doors, and only personnel whose duties require it have access. Cabling runs through protected pathways, not across open floor. The System Owner confirms these conditions when equipment is installed or moved.

In provider-operated facilities and cloud data centers, the Organization inherits the protection of power infrastructure. The ISSO verifies it through the provider’s facility documentation instead of physical inspection and files the verification with the system’s records. The ISSO refreshes the verification when the provider or facility changes.

Anyone who observes damage, exposure, or degradation in either environment, such as a breached cable path or an unsecured power room, reports it through the ticketing system. The responsible party receives the ticket and works it to closure. Evidence: installation confirmations, the recorded provider verifications, and the tickets that document reported conditions and their correction.

PE-10 — Emergency Shutoff #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

1. Provide the capability of shutting off power to [Assignment: organization-defined system or individual system components — to be defined] in emergency situations;
2. Place emergency shutoff switches or devices in near more than one egress point of the IT area and ensures it is labeled and protected by a cover to prevent accidental shut-off to facilitate access for authorized personnel; and
3. Protect emergency power shutoff capability from unauthorized activation.

Procedure:

The emergency power shutoff for each equipment space sits at the location the System Owner or contractor recommended and the CISO and AO approved. The facility records hold the approval. The switches sit inside controlled space, shielded against casual or accidental activation, and carry labels so that responders can find them quickly in an emergency.

In provider-operated data centers the shutoff capability belongs to the provider’s electrical infrastructure. The Organization checks the provider’s documentation to verify that the shutoff exists and has protection, and keeps that verification on file.

Personnel assigned to equipment spaces receive a briefing on shutoff locations and activation criteria when they take on the duty. Anyone who uses the shutoff, or finds it impaired, reports it immediately, and the report is recorded in the ticketing system. Evidence: the approved placement record, provider verifications, briefing acknowledgments, and reports of activation or impairment with their follow-up.

PE-11 — Emergency Power #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Provide an uninterruptible power supply to facilitate [Selection: an orderly shutdown of the system; transition of the system to long-term alternate power — to be defined] in the event of a primary power source loss.

Procedure:

Equipment spaces the Organization operates run on uninterruptible power supply (UPS)-protected circuits. The UPS carries the load through short interruptions. When an outage persists, it keeps the equipment powered long enough for a clean shutdown or for the facility’s long-term alternate power to take over. The System Owner runs maintenance and battery tests on the service schedule and files the results with the facility records.

In provider-operated data centers, the Organization inherits emergency power from the provider’s infrastructure. The ISSO verifies the provider’s power protection through its facility documentation, files the verification, and refreshes it when the provider or facility changes.

After a power event, the System Owner confirms that the protection worked as intended, meaning the equipment stayed up or shut down cleanly, and reports the event and the outcome in the ticketing system. Evidence: UPS maintenance and test records, the recorded provider verifications, and post-event reports with their findings.

PE-12 — Emergency Lighting #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.

Procedure:

Emergency lighting in the facility switches on automatically when building power drops. It covers the exit paths and evacuation routes that serve the spaces the Organization occupies. The facility provider maintains and tests the fixtures on its life-safety schedule, and the Organization verifies that program instead of duplicating it.

The System Owner confirms coverage when the Organization first occupies a space and after any significant reconfiguration. During evacuation drills and any actual outage, personnel note fixtures that failed to activate. The observer reports the failure through the ticketing system to the facility provider, and the ISSO tracks it to repair. The ISSO keeps the verification and any outstanding deficiency visible in the facility record for the system.

Evidence: the occupancy and reconfiguration verifications, drill and outage observations, deficiency tickets with repair confirmation, and the provider’s test documentation where the provider supplies it.

PE-13 — Fire Protection #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Employ and maintain fire detection and suppression systems that are supported by an independent energy source.

Procedure:

Detection and suppression coverage for equipment spaces belongs to the facility’s fire protection plant: smoke detection paired with sprinkler or clean-agent suppression, powered independently of the building’s primary supply. The facility provider inspects and maintains the systems under its life-safety program.

The Organization’s role is verification and response. The ISSO obtains the provider’s coverage and maintenance documentation when the Organization occupies a space and files it with the system’s facility records. The ISSO refreshes the verification when the provider, the facility, or the occupied footprint changes. In cloud data centers the same verification relies on the provider’s documentation.

Anyone who learns that a detection or suppression system affecting the Organization’s space is out of service reports it to the ISSO immediately. The ISSO logs it in the ticketing system and tracks it with the provider until the protection is restored. The System Owner weighs the interim risk while the system is down. Evidence: filed coverage verifications, provider maintenance documentation, and outage tickets with restoration confirmation.

PE-13(1) — Detection Systems — Automatic Activation and Notification #

Baselines: Moderate / High

Employ fire detection systems that activate automatically and notify service provider building maintenance/physical security personnel and service provider emergency responders with incident response responsibilities in the event of a fire.

Procedure:

When fire detection in an equipment space trips, the facility’s alarm infrastructure activates on its own. It sends notification at the same time to the police and fire departments and to the internal distribution: the ISSO, System Owners, and Custodians. The ISSO maintains the internal notification list and updates it when role holders change. The ISSO confirms the end-to-end path, detector to responder and detector to distribution, as part of the facility verification. The ISSO records the confirmation in the ticketing system. The Organization retains alarm activations and the notifications they generated as the record that the capability works. Evidence: alarm activation records, the notifications they generated, the internal notification list, and the ticketing system confirmation of the verified path.

PE-13(2) — Suppression Systems — Automatic Activation and Notification #

Baselines: Moderate / High

1. Employ fire suppression systems that activate automatically and notify [Assignment: organization-defined personnel or roles — to be defined] and [Assignment: organization-defined emergency responders — to be defined]; and
2. Employ an automatic fire suppression capability when the facility is not staffed on a continuous basis.

Procedure:

Suppression systems in equipment spaces discharge automatically on fire conditions. The same activation sends notification to police and fire and to the internal recipients: the ISSO, System Owners, and Custodians. For a facility without continuous staffing, the System Owner confirms automatic suppression coverage before equipment operates there, and the ISSO files the confirmation with the facility verification records in the ticketing system. The Organization handles a discharge, real or accidental, as an incident. Evidence: the notification records, the provider’s post-event report, and the record of restoring suppression capability.

PE-14 — Environmental Controls #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

1. Maintain consistent with American Society of Heating, Refrigerating and Air-conditioning Engineers (ASHRAE) document entitled Thermal Guidelines for Data Processing Environments levels within the facility where the system resides at [Assignment: organization-defined acceptable levels — to be defined]; and
2. Monitor environmental control levels continuously.

Procedure:

The cooling and environmental plant that serves equipment spaces holds server-inlet temperature between 18 and 27 degrees Celsius and dew point between 5.5 and 15 degrees Celsius. Sensors feed continuous monitoring, not periodic checks. In provider-operated data centers the provider runs both the plant and the monitoring. Alerts on excursions go to the provider’s operations team, and the provider reports events that affect the Organization’s equipment under the service arrangement.

The System Owner verifies at occupancy, and again when the facility or provider changes, that the ranges and continuous monitoring apply to the Organization’s footprint, and the ISSO files the verification. The ISSO logs excursions that reach the Organization in the ticketing system and tracks them against the provider’s correction. The System Owner reviews each excursion for any effect on equipment health.

Evidence: the filed environmental verifications, excursion notifications and their tickets, and the provider’s monitoring documentation where the provider supplies it.

PE-15 — Water Damage Protection #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.

Procedure:

When the Organization occupies a space that holds its equipment, the System Owner works with the facility provider to identify the water shutoff and isolation valves that serve it. The System Owner records the locations in the facility record for the system. The System Owner briefs the on-site personnel who would respond to a leak on the valve locations and the provider’s emergency contact path. The System Owner notes the briefing in the record.

During the periodic physical security review, the System Owner confirms that the recorded locations are still accurate and that the provider reports the valves serviceable. Provider maintenance covers the mechanical side. The Organization’s check confirms that personnel still know the locations and can reach the valves. Anyone who finds a leak or moisture near equipment reports it immediately through the ticketing system and to the provider. The ticket holds the response and the outcome.

Evidence: the recorded valve locations, briefing notes, review confirmations, and leak-event tickets with their resolution.

PE-16 — Delivery and Removal #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

1. Authorize and control all information system components entering and exiting the facility; and
2. Maintain records of the system components.

Procedure:

Component deliveries and removals start with an authorization: the System Owner approves the movement in the ticketing system before the component arrives at or leaves the dock. Deliveries arrive in the delivery area, which stays apart from equipment spaces. Each delivery is checked against the authorization and logged with the item, date, carrier, and authorization reference. Removals follow the same steps in reverse: no component leaves without the approved ticket, and the departure is logged against it.

The movement log connects physical custody to the asset record. The ISSO reconciles the two during the periodic review and follows up on any component that moved without a matching authorization and any authorization with no recorded movement. The ISSO investigates and documents each discrepancy.

Evidence: the approval tickets, the delivery and removal log entries tied to each authorization, and the reconciliation records with the disposition of any discrepancy.

PE-17 — Alternate Work Site #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security), DE.CM (Continuous Monitoring)

1. Determine and document the [Assignment: organization-defined alternate work sites — to be defined] allowed for use by employees;
2. Employ the following controls at alternate work sites: [Assignment: organization-defined controls — to be defined];
3. Assess the effectiveness of controls at alternate work sites; and
4. Provide a means for employees to communicate with information security and privacy personnel in case of incidents.

Procedure:

An employee’s alternate work arrangement begins with the Telework Agreement. The signed agreement states the security conditions for the site, and the approved site must be one the System Owner or contractor defined and the CISO and AO accepted. The agreement is on file before remote work starts.

The ISSO assesses whether the alternate-site safeguards work through employee attestations, spot checks of the required conditions, and a review of incidents that originated at remote locations. The ISSO documents the assessment and its findings. Weaknesses lead to corrections in the agreement terms or the site approvals.

Employees who work remotely report security and privacy incidents through the same channels as on-site staff, the service desk and the ISSO, and the service desk records each report in the ticketing system. Telework onboarding covers the reporting path so that employees know it before they need it. Evidence: signed Telework Agreements, site approvals, the ISSO’s assessment records, and the incident reports from alternate work sites.

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Procedure execution records for PE
• Configuration documentation
• Periodic review records

7. Performance Measurement #

The CISO measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the CISO trends and reports it. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy, September 15, 2016.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• HSPD-12: Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-116 Rev. 1: Guidelines for the Use of PIV Credentials in Facility Access, June 2018.
• OMB M-19-17: Enabling Mission Delivery through Improved Identity, Credential, and Access Management (ICAM), May 21, 2019.