Water Damage Protection PE-15
Physical and Environmental Protection · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds PE-15 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Physical and Environmental Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
PE-15 (Water Damage Protection) is about protecting the system from water leaks — a burst pipe, an overflowing drain, or a leaking cooling line — by making sure someone can shut the water off fast. It centers on master shutoff or isolation valves that are reachable, working, and known to the right people. It is a Physical and Environmental Protection control in the Low baseline.
What good looks like
- Know where the master shutoff or isolation valve is for water lines near the system, and make sure it actually works.
- Make sure the valve is accessible — not blocked, not behind a locked door no one can open in a hurry.
- Make sure key personnel know where it is and how to close it, so a leak at 2 a.m. does not depend on one person.
- Keep the hardware off the floor where you can (a raised rack, off the slab), so a small pool of water is not an instant outage.
- The enhancement adds automatic water detection (PE-15(1)) that alerts staff; it is not required at Low, but a cheap leak sensor near the rack is worth considering.
Framework mapping
- NIST CSF 2.0 — PR.IR-02 — Technology assets are protected from environmental threats
How to move it toward Implemented
- Write down the location of the shutoff valve for the water lines nearest the server, confirm it turns, and note the date you last tested it.
- List the key personnel who know how to close it, with a way to reach them — this is the ‘known to key personnel’ part of the control.
- Note where the server sits relative to water risks (pipes overhead, drains, cooling lines) and whether it is raised off the floor.
- Attach that valve-location note and personnel list as hardening evidence on the asset, naming
PE-15in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.