Access Control for Output Devices PE-5

Physical and Environmental Protection · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds PE-5 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Physical and Environmental Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

PE-5 (Access Control for Output Devices) is about keeping the things a system outputs — what shows on a monitor, what comes off a printer — away from people who should not see it. For a server the main output is the console screen and any attached printer. It is a Moderate-baseline control.

What good looks like

Place monitors and consoles so their screens cannot be read by passers-by.
Keep printers and their output trays in a controlled area, not an open hallway.
Do not leave a logged-in console unattended where anyone could read or use it.
Collect or shred printed output promptly rather than leaving it sitting out.
Lock or blank the screen when the machine is left alone.

Framework mapping

NIST CSF 2.0 — PR.AA-06 — Physical access to assets is managed, monitored, and enforced commensurate with risk

How to move it toward Implemented

Position the server's console or monitor so the screen faces away from doors and windows, and turn on a screen lock when it sits idle.
For the Linux text console, set an idle logout by adding a TMOUT value in a file under /etc/profile.d/ so an unattended session closes on its own.
If a printer is attached, move it into the controlled space and make a habit of collecting its output right away.
Attach a note of the console placement and the TMOUT timeout setting as hardening evidence on the asset, naming PE-5 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.