Environmental Controls PE-14

Physical and Environmental Protection · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds PE-14 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Physical and Environmental Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

PE-14 (Environmental Controls) is about keeping the space around the system within safe limits — things like temperature and humidity — and watching those levels so you notice when they drift. Overheating and moisture are two of the most common ways hardware fails, so this is a foundational Physical and Environmental Protection control in the Low baseline.

What good looks like

Keep the room within safe temperature and humidity ranges for the hardware — follow the vendor's stated limits for the server.
Monitor those levels on a set schedule so you see drift, not just failure.
Read the server's own onboard sensors (many servers report inlet temperature, fan speed, and voltages) as a second signal alongside any room reading.
Set a threshold and an owner: decide what ‘too hot’ is and who gets told when it is crossed.
Enhancements add automatic controls (PE-14(1)) and alarms and notifications (PE-14(2)); neither is required at Low, but an alarm is a small, high-value add.

Framework mapping

NIST CSF 2.0 — PR.IR-02 — Technology assets are protected from environmental threats

How to move it toward Implemented

Install and read the onboard thermal sensors: sudo apt install lm-sensors, run sudo sensors-detect, then sensors to see temperatures and fan speeds. On server hardware, sudo ipmitool sensor reads the baseboard management controller (BMC — the chip that monitors the physical box).
Log a reading on a schedule with cron — for example, a job that appends dated sensors output to a file — so you have a trend, not a single snapshot.
Write a short note of the acceptable range and the check frequency (for example, temperature under a stated limit, reviewed weekly), and who is notified if it is exceeded.
Attach that sensor log and range note as hardening evidence on the asset, naming PE-14 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.