Delivery and Removal PE-16
Physical and Environmental Protection · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds PE-16 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Physical and Environmental Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
PE-16 (Delivery and Removal) is about controlling hardware as it comes into and goes out of the facility — servers, drives, network gear — and keeping a record of what moved. The goal is that nothing is delivered or carried out without someone authorizing it and writing it down. It is a Physical and Environmental Protection control in the Low baseline.
What good looks like
- Authorize equipment before it enters or leaves — decide which component types this applies to (for a lab, at least the server and any storage media).
- Control the actual movement — deliveries go to a known person, and removals are approved, not casual.
- Keep records: what came in or went out, when, who authorized it, and its serial or asset tag.
- Pay special attention to storage media leaving the building, since data can walk out on a drive.
- Tie each record back to the asset so the inventory and the physical reality stay in step.
Framework mapping
How to move it toward Implemented
- Start a simple intake/removal log: date, item, serial or asset tag, who authorized it, in or out. A single spreadsheet or text file is fine.
- Capture the server's own identifiers so the record is exact:
sudo dmidecode -s system-serial-numberandsudo dmidecode -s system-product-name, orsudo lshw -shortfor a full component list. - For any drive or media that leaves, record its serial and note whether it was wiped first — that is the highest-risk case.
- Attach that intake/removal log as hardening evidence on the asset, naming
PE-16in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.