Location of System Components PE-18

Source: NIST SP 800-53 Rev.5, Physical and Environmental Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

PE-18 (Location of System Components) is about where the hardware physically sits. You place components to reduce the chance of damage from hazards — water, heat, dust, physical bumps — and to keep them out of easy reach of people who should not touch them. It is a Physical and Environmental Protection control that enters at the High baseline.

What good looks like

• Put the server where hazards are lowest — away from windows, water lines, floor level, and high-traffic areas.
• Position it to limit access — a locked rack or room, not an open desk anyone walks past.
• Think about both halves together: the safest spot for hazards should also be a hard spot to tamper with.
• Consider the supporting risks a location brings — cabling, cooling, and who shares the space.
• Record the placement decision so the reasoning survives past the person who made it.

Framework mapping

• NIST CSF 2.0 — PR.AA-06 — Physical access to assets is managed, monitored, and enforced
• NIST CSF 2.0 — PR.IR-02 — Technology assets are protected from environmental threats

How to move it toward Implemented

• Document where the server is and why that spot was chosen — the hazards you avoided (water, heat, traffic) and the access controls in place (locked rack or room).
• Note the physical safeguards: is it in a rack that locks, in a room that locks, and who holds the keys.
• If the location is not ideal, record the compensating step you took (moved it off the floor, added a lock) so the gap and the fix are both visible.
• Attach that placement rationale as hardening evidence on the asset, naming PE-18 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.