ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
PE > PE-6

PE-6 Monitoring Physical Access
Family: Physical and Environmental Protection (PE)

a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents;
b. Review physical access logs [Assignment: organization-defined frequency] and upon occurrence of [Assignment: organization-defined events] ; and
c. Coordinate results of reviews and investigations with the organizational incident response capability.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-6 > Discussion

PE-6 Monitoring Physical Access - Discussion
Family: Physical and Environmental Protection (PE)

Physical access monitoring includes publicly accessible areas within organizational facilities. Examples of physical access monitoring include the employment of guards, video surveillance equipment (i.e., cameras), and sensor devices. Reviewing physical access logs can help identify suspicious activity, anomalous events, or potential threats. The reviews can be supported by audit logging controls, such as [AU-2](#au-2) , if the access logs are part of an automated system. Organizational incident response capabilities include investigations of physical security incidents and responses to the incidents. Incidents include security violations or suspicious physical access activities. Suspicious physical access activities include accesses outside of normal work hours, repeated accesses to areas not normally accessed, accesses for unusual lengths of time, and out-of-sequence accesses.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-6 > PE-6(1) > Discussion

PE-6(1) Intrusion Alarms and Surveillance Equipment - Discussion
Family: Physical and Environmental Protection (PE) > PE-6 Monitoring Physical Access

Physical intrusion alarms can be employed to alert security personnel when unauthorized access to the facility is attempted. Alarm systems work in conjunction with physical barriers, physical access control systems, and security guards by triggering a response when these other forms of security have been compromised or breached. Physical intrusion alarms can include different types of sensor devices, such as motion sensors, contact sensors, and broken glass sensors. Surveillance equipment includes video cameras installed at strategic locations throughout the facility.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-6 > PE-6(1)

PE-6(1) Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment
Family: Physical and Environmental Protection (PE) > PE-6 Monitoring Physical Access

Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-6 > PE-6(2) > Discussion

PE-6(2) Automated Intrusion Recognition and Responses - Discussion
Family: Physical and Environmental Protection (PE) > PE-6 Monitoring Physical Access

Response actions can include notifying selected organizational personnel or law enforcement personnel. Automated mechanisms implemented to initiate response actions include system alert notifications, email and text messages, and activating door locking mechanisms. Physical access monitoring can be coordinated with intrusion detection systems and system monitoring capabilities to provide integrated threat coverage for the organization.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-6 > PE-6(2)

PE-6(2) Monitoring Physical Access | Automated Intrusion Recognition and Responses
Family: Physical and Environmental Protection (PE) > PE-6 Monitoring Physical Access

Recognize [Assignment: organization-defined classes or types of intrusions] and initiate [Assignment: organization-defined response actions] using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-6 > PE-6(3) > Discussion

PE-6(3) Video Surveillance - Discussion
Family: Physical and Environmental Protection (PE) > PE-6 Monitoring Physical Access

Video surveillance focuses on recording activity in specified areas for the purposes of subsequent review, if circumstances so warrant. Video recordings are typically reviewed to detect anomalous events or incidents. Monitoring the surveillance video is not required, although organizations may choose to do so. There may be legal considerations when performing and retaining video surveillance, especially if such surveillance is in a public location.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-6 > PE-6(3)

PE-6(3) Monitoring Physical Access | Video Surveillance
Family: Physical and Environmental Protection (PE) > PE-6 Monitoring Physical Access

(a) Employ video surveillance of [Assignment: organization-defined operational areas];
(b) Review video recordings [Assignment: organization-defined frequency] ; and
(c) Retain video recordings for [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-6 > PE-6(4) > Discussion

PE-6(4) Monitoring Physical Access to Systems - Discussion
Family: Physical and Environmental Protection (PE) > PE-6 Monitoring Physical Access

Monitoring physical access to systems provides additional monitoring for those areas within facilities where there is a concentration of system components, including server rooms, media storage areas, and communications centers. Physical access monitoring can be coordinated with intrusion detection systems and system monitoring capabilities to provide comprehensive and integrated threat coverage for the organization.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-6 > PE-6(4)

PE-6(4) Monitoring Physical Access | Monitoring Physical Access to Systems
Family: Physical and Environmental Protection (PE) > PE-6 Monitoring Physical Access

Monitor physical access to the system in addition to the physical access monitoring of the facility at [Assignment: organization-defined physical spaces].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-8

PE-8 Visitor Access Records
Family: Physical and Environmental Protection (PE)

a. Maintain visitor access records to the facility where the system resides for [Assignment: organization-defined time period];
b. Review visitor access records [Assignment: organization-defined frequency] ; and
c. Report anomalies in visitor access records to [Assignment: organization-defined personnel].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-8 > Discussion

PE-8 Visitor Access Records - Discussion
Family: Physical and Environmental Protection (PE)

Visitor access records include the names and organizations of individuals visiting, visitor signatures, forms of identification, dates of access, entry and departure times, purpose of visits, and the names and organizations of individuals visited. Access record reviews determine if access authorizations are current and are still required to support organizational mission and business functions. Access records are not required for publicly accessible areas.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-8 > PE-8(1) > Discussion

PE-8(1) Automated Records Maintenance and Review - Discussion
Family: Physical and Environmental Protection (PE) > PE-8 Visitor Access Records

Visitor access records may be stored and maintained in a database management system that is accessible by organizational personnel. Automated access to such records facilitates record reviews on a regular basis to determine if access authorizations are current and still required to support organizational mission and business functions.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-8 > PE-8(1)

PE-8(1) Visitor Access Records | Automated Records Maintenance and Review
Family: Physical and Environmental Protection (PE) > PE-8 Visitor Access Records

Maintain and review visitor access records using [Assignment: organization-defined organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-8 > PE-8(3) > Discussion

PE-8(3) Limit Personally Identifiable Information Elements - Discussion
Family: Physical and Environmental Protection (PE) > PE-8 Visitor Access Records

Organizations may have requirements that specify the contents of visitor access records. Limiting personally identifiable information in visitor access records when such information is not needed for operational purposes helps reduce the level of privacy risk created by a system.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-8 > PE-8(3)

PE-8(3) Visitor Access Records | Limit Personally Identifiable Information Elements
Family: Physical and Environmental Protection (PE) > PE-8 Visitor Access Records

Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: [Assignment: organization-defined elements].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-9

PE-9 Power Equipment and Cabling
Family: Physical and Environmental Protection (PE)

Protect power equipment and power cabling for the system from damage and destruction.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-9 > Discussion

PE-9 Power Equipment and Cabling - Discussion
Family: Physical and Environmental Protection (PE)

Organizations determine the types of protection necessary for the power equipment and cabling employed at different locations that are both internal and external to organizational facilities and environments of operation. Types of power equipment and cabling include internal cabling and uninterruptable power sources in offices or data centers, generators and power cabling outside of buildings, and power sources for self-contained components such as satellites, vehicles, and other deployable systems.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-9 > PE-9(1) > Discussion

PE-9(1) Redundant Cabling - Discussion
Family: Physical and Environmental Protection (PE) > PE-9 Power Equipment and Cabling

Physically separate and redundant power cables ensure that power continues to flow in the event that one of the cables is cut or otherwise damaged.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-9 > PE-9(1)

PE-9(1) Power Equipment and Cabling | Redundant Cabling
Family: Physical and Environmental Protection (PE) > PE-9 Power Equipment and Cabling

Employ redundant power cabling paths that are physically separated by [Assignment: organization-defined distance].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-9 > PE-9(2) > Discussion

PE-9(2) Automatic Voltage Controls - Discussion
Family: Physical and Environmental Protection (PE) > PE-9 Power Equipment and Cabling

Automatic voltage controls can monitor and control voltage. Such controls include voltage regulators, voltage conditioners, and voltage stabilizers.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-9 > PE-9(2)

PE-9(2) Power Equipment and Cabling | Automatic Voltage Controls
Family: Physical and Environmental Protection (PE) > PE-9 Power Equipment and Cabling

Employ automatic voltage controls for [Assignment: organization-defined critical system components].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-10

PE-10 Emergency Shutoff
Family: Physical and Environmental Protection (PE)

a. Provide the capability of shutting off power to [Assignment: organization-defined system or individual system components] in emergency situations;
b. Place emergency shutoff switches or devices in [Assignment: organization-defined location] to facilitate access for authorized personnel; and
c. Protect emergency power shutoff capability from unauthorized activation.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-10 > Discussion

PE-10 Emergency Shutoff - Discussion
Family: Physical and Environmental Protection (PE)

Emergency power shutoff primarily applies to organizational facilities that contain concentrations of system resources, including data centers, mainframe computer rooms, server rooms, and areas with computer-controlled machinery.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-11

PE-11 Emergency Power
Family: Physical and Environmental Protection (PE)

Provide an uninterruptible power supply to facilitate [Selection: an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-11 > Discussion

PE-11 Emergency Power - Discussion
Family: Physical and Environmental Protection (PE)

An uninterruptible power supply (UPS) is an electrical system or mechanism that provides emergency power when there is a failure of the main power source. A UPS is typically used to protect computers, data centers, telecommunication equipment, or other electrical equipment where an unexpected power disruption could cause injuries, fatalities, serious mission or business disruption, or loss of data or information. A UPS differs from an emergency power system or backup generator in that the UPS provides near-instantaneous protection from unanticipated power interruptions from the main power source by providing energy stored in batteries, supercapacitors, or flywheels. The battery duration of a UPS is relatively short but provides sufficient time to start a standby power source, such as a backup generator, or properly shut down the system.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-11 > PE-11(1) > Discussion

PE-11(1) Alternate Power Supply - Minimal Operational Capability - Discussion
Family: Physical and Environmental Protection (PE) > PE-11 Emergency Power

Provision of an alternate power supply with minimal operating capability can be satisfied by accessing a secondary commercial power supply or other external power supply.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-11 > PE-11(1)

PE-11(1) Emergency Power | Alternate Power Supply - Minimal Operational Capability
Family: Physical and Environmental Protection (PE) > PE-11 Emergency Power

Provide an alternate power supply for the system that is activated [Selection: manually; automatically] and that can maintain minimally required operational capability in the event of an extended loss of the primary power source.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-11 > PE-11(2) > Discussion

PE-11(2) Alternate Power Supply - Self-contained - Discussion
Family: Physical and Environmental Protection (PE) > PE-11 Emergency Power

The provision of a long-term, self-contained power supply can be satisfied by using one or more generators with sufficient capacity to meet the needs of the organization.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-11 > PE-11(2)

PE-11(2) Emergency Power | Alternate Power Supply - Self-contained
Family: Physical and Environmental Protection (PE) > PE-11 Emergency Power

Provide an alternate power supply for the system that is activated [Selection: manually; automatically] and that is:
(a) Self-contained;
(b) Not reliant on external power generation; and
(c) Capable of maintaining [Selection: minimally required operational capability; full operational capability] in the event of an extended loss of the primary power source.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-12

PE-12 Emergency Lighting
Family: Physical and Environmental Protection (PE)

Employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-12 > Discussion

PE-12 Emergency Lighting - Discussion
Family: Physical and Environmental Protection (PE)

The provision of emergency lighting applies primarily to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Emergency lighting provisions for the system are described in the contingency plan for the organization. If emergency lighting for the system fails or cannot be provided, organizations consider alternate processing sites for power-related contingencies.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-12 > PE-12(1) > Discussion

PE-12(1) Essential Mission and Business Functions - Discussion
Family: Physical and Environmental Protection (PE) > PE-12 Emergency Lighting

Organizations define their essential missions and functions.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-12 > PE-12(1)

PE-12(1) Emergency Lighting | Essential Mission and Business Functions
Family: Physical and Environmental Protection (PE) > PE-12 Emergency Lighting

Provide emergency lighting for all areas within the facility supporting essential mission and business functions.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-13

PE-13 Fire Protection
Family: Physical and Environmental Protection (PE)

Employ and maintain fire detection and suppression systems that are supported by an independent energy source.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-13 > Discussion

PE-13 Fire Protection - Discussion
Family: Physical and Environmental Protection (PE)

The provision of fire detection and suppression systems applies primarily to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Fire detection and suppression systems that may require an independent energy source include sprinkler systems and smoke detectors. An independent energy source is an energy source, such as a microgrid, that is separate, or can be separated, from the energy sources providing power for the other parts of the facility.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-13 > PE-13(1) > Discussion

PE-13(1) Detection Systems - Automatic Activation and Notification - Discussion
Family: Physical and Environmental Protection (PE) > PE-13 Fire Protection

Organizations can identify personnel, roles, and emergency responders if individuals on the notification list need to have access authorizations or clearances (e.g., to enter to facilities where access is restricted due to the classification or impact level of information within the facility). Notification mechanisms may require independent energy sources to ensure that the notification capability is not adversely affected by the fire.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-13 > PE-13(1)

PE-13(1) Fire Protection | Detection Systems - Automatic Activation and Notification
Family: Physical and Environmental Protection (PE) > PE-13 Fire Protection

Employ fire detection systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders] in the event of a fire.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-13 > PE-13(2) > Discussion

PE-13(2) Suppression Systems - Automatic Activation and Notification - Discussion
Family: Physical and Environmental Protection (PE) > PE-13 Fire Protection

Organizations can identify specific personnel, roles, and emergency responders if individuals on the notification list need to have appropriate access authorizations and/or clearances (e.g., to enter to facilities where access is restricted due to the impact level or classification of information within the facility). Notification mechanisms may require independent energy sources to ensure that the notification capability is not adversely affected by the fire.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-13 > PE-13(2)

PE-13(2) Fire Protection | Suppression Systems - Automatic Activation and Notification
Family: Physical and Environmental Protection (PE) > PE-13 Fire Protection

(a) Employ fire suppression systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders] ; and
(b) Employ an automatic fire suppression capability when the facility is not staffed on a continuous basis.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-13 > PE-13(4) > Discussion

PE-13(4) Inspections - Discussion
Family: Physical and Environmental Protection (PE) > PE-13 Fire Protection

Authorized and qualified personnel within the jurisdiction of the organization include state, county, and city fire inspectors and fire marshals. Organizations provide escorts during inspections in situations where the systems that reside within the facilities contain sensitive information.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-13 > PE-13(4)

PE-13(4) Fire Protection | Inspections
Family: Physical and Environmental Protection (PE) > PE-13 Fire Protection

Ensure that the facility undergoes [Assignment: organization-defined frequency] fire protection inspections by authorized and qualified inspectors and identified deficiencies are resolved within [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-14

PE-14 Environmental Controls
Family: Physical and Environmental Protection (PE)

a. Maintain [Selection; one or more: temperature; humidity; pressure; radiation; [Assignment: organization-defined environmental control] ] levels within the facility where the system resides at [Assignment: organization-defined acceptable levels] ; and
b. Monitor environmental control levels [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-14 > Discussion

PE-14 Environmental Controls - Discussion
Family: Physical and Environmental Protection (PE)

The provision of environmental controls applies primarily to organizational facilities that contain concentrations of system resources (e.g., data centers, mainframe computer rooms, and server rooms). Insufficient environmental controls, especially in very harsh environments, can have a significant adverse impact on the availability of systems and system components that are needed to support organizational mission and business functions.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-14 > PE-14(1) > Discussion

PE-14(1) Automatic Controls - Discussion
Family: Physical and Environmental Protection (PE) > PE-14 Environmental Controls

The implementation of automatic environmental controls provides an immediate response to environmental conditions that can damage, degrade, or destroy organizational systems or systems components.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-14 > PE-14(1)

PE-14(1) Environmental Controls | Automatic Controls
Family: Physical and Environmental Protection (PE) > PE-14 Environmental Controls

Employ the following automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system: [Assignment: organization-defined automatic environmental controls].