Task 2 RMF_Physical And Environmental Protection Plan.docx

{COMMAND}

{SYSTEM NAME} {ACRONYM}

System Version: {VERSION} eMASS# {EMASS#}

Confidentiality: {CONFIDENTIALITY} Integrity: {INTEGRITY} Availability: {AVAILABILITY}

Department of the {SERVICE}

{LOGO}

Physical and Environmental Protection Plan Document Version: 1.0.0

{DATE}

Prepared by: {ORGANIZATION}

DISTRIBUTION IS LIMITED TO U.S. GOVERNMENT AGENCIES AND THEIR CONTRACTORS.

OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO: {ORGANIZATION}

Change Record

Amplifying Guidance

i. DoD Instruction 5200.08, "Security of DoD Installations and Resources and the DoD Physical Security Review Board (PSRB)"

ii. DoD Regulation 5200.08-R, "Physical Security Program", as amended

Table of Contents

FOR OFFICIAL USE ONLY

{ACRONYM} {DATE}

PHYSICAL AND ENVIRONMENTAL PROTECTION PLAN

Template developed by:

http://www.i-assure.com FOR OFFICIAL USE ONLY

1.0 OVERVIEW

The physical security program is that part of security concerned with active and passive measures designed to prevent unauthorized access to personnel, equipment, installations, information, and to safeguard them against espionage, sabotage, terrorism, damage, and criminal activity. Physical security is a primary command responsibility.

This plan ensures that {ACRONYM} implements physical security to preserve the confidentiality, integrity, and availability of {ACRONYM} information system resources.

This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in Appendix A, “Detailed Compliance Matrix”.

Table 1 - SP-800-53v4 Compliance Matrix

Enclosure 1 lists the personnel that have access to the facility where {ACRONYM} resides. The Access List has been formally approved and is reviewed every 90 days. All personnel have been authorized based on the appropriate roles and positions. Personnel must have two forms of identification. Examples of valid identification are:

· DoD issued Common Access Card (CAC)

· Base issued ID

· Other Government issued ID

· State issued driver license

· Passport It is {ACRONYM} policy that all Visitors must be escorted at all times in controlled areas. Visitors are required to sign the Visitor Log for access to any controlled area. All Visitors must be monitored by the Escort at all times. {ACRONYM} has not identified any Publicly Accessible areas.

{ACRONYM} issues all credentials through Base Security. The Personnel Security office verifies clearance information prior to identification being issued.

For personnel no longer requiring access, the Personnel Security Plan contains the credential revocation process and the Access List is updated to remove that person.

2.2 Physical Access Control

The {ACRONYM} has not identified additional physical access authorizations. The following physical security safeguards have been implemented for {ACRONYM} to detect and prevent physical tampering or alteration of {ACRONYM} components:

· Base Security – guard access at gate

· Facility Security – facility manned during workday and locked at night

· Keycard/Combination – only authorized personnel are listed in Access List and have credentials The following table lists the {ACRONYM} components and the NIST SP 800-53 required information:

All assets

Table 2 – Physical Access Control

2.2.1 Penetration Testing

Physical security penetration testing is not required per NIST 800-53.

2.2.2 Facility Entry and Exit Points

The following table lists all entry/exit points for the facility housing {ACRONYM}:

All Assets

Table 3 – Facility Entry and Exit Points

2.2.3 Publicly Accessible Areas

The {ACRONYM} does not contain publicly accessible areas.

2.2.4 Visitor Escorts and Monitoring

A CAC is required when entering the {ACRONYM}. For those personnel without a CAC, a Visit Request for base access must be processed. All Visitors must be escorted at all times in controlled areas. Visitors are required to sign the Visitor Log for access to any controlled area. All Visitors must be monitored by the Escort at all times.

2.2.5 Key and Combination Procedures

{ACRONYM} has adequately secured its keys, combinations, and other physical devices.

The following devices are used for to gain physical access to {ACRONYM}:

Table 4 – Key and Combination Procedures

2.3 Access Control for Transmission Medium

{ACRONYM} protects distribution and transmission lines to ensure unauthorized access does not occur. The following distribution and transmission lines, and their security safeguards, have been identified:

Table 5 – Distribution and Transmission Lines

2.4 Access Control for Output Devices

The {ACRONYM} has not identified additional access controls for output devices. The process for determining authorization to {ACRONYM} is contained within the Personnel Security Plan. The following output devices have been identified for {ACRONYM}:

Table 6 – Access Control for Output Devices

2.5 Monitoring Physical Access

{ACRONYM} is actively monitoring all physical intrusion alarms and surveillance equipment. {ACRONYM} implements the following types of equipment:

· Door sensors

· Badge System {ACRONYM} recognizes the following types/classes of intrusions by automated mechanisms:

· Invalid CAC – scanned at {ACRONYM} Gate Guard station

· Invalid Entry – Base Badge system records card swipe actions The hardware/software associated with the intrusion system is separately accredited. All intrusions are reported to Base Security.

{ACRONYM} response actions include:

· Denial of access

· Alarm sent to Base Security. Base Security then determines the appropriate response

2.5.1 Video Surveillance

Does {ACRONYM} implement video surveillance?

☐ No

☐ Yes

If Yes:

Table 7 – Video Surveillance

2.5.2 Inspection/Assessment Records

The {ACRONYM} Access List is contained within Enclosure 1 and reviewed every 30 days. The following events or potential indications of events require an immediate review of physical access logs:

· Mishandled or lost resource: Equipment was stolen, lost, or left accessible to unauthorized parties.

· Local access: An unauthorized user was provided local physical access to {ACRONYM}.

· Abuse of resources: The physical destruction of {ACRONYM} by an unauthorized party.

The Incident Response Plan contains the review process and record of reviews concerning physical security events.

Visitor Access Records ensure only authorized personnel access the physical space in which {ACRONYM} resides. NIST SP 800-53 requires that these access records be automated.

Does {ACRONYM} implement automated mechanisms to facilitate the maintenance and review of access records?

☐ No

☐ Yes

If Yes, have they been observed?

☐ No

☐ Yes

If Yes, have they been maintained for at least one year?

☐ No

☐ Yes

If Yes, have they been reviewed at least every 30 days?

☐ No

☐ Yes

{ACRONYM} is required to protect power equipment and power cabling. {ACRONYM} is required to fulfill this requirement as {ACRONYM} is strictly a tenant of the facility.

The following protective measures have been implemented:

· All power equipment is located on a physically secure military base.

· All power cabling is contained within a physically secure facility.

· Only authorized personnel can access the base and facility.

Are redundant power cabling paths installed?

☐ No

☐ Yes

If Yes, are they physically separated by at least one foot?

☐ No

☐ Yes

Does the system contain critical information system components?

☒ No

☐ Yes

If Yes, are automatic voltage control mechanisms are in place?

☐ No

☐ Yes

4.2 Emergency Shutoff

{ACRONYM} is required to provide a capability to shut off the power to facilities or areas within facilities containing concentrations of information system resources (e.g., datacenters, server rooms, mainframe computer rooms) in emergency situations. {ACRONYM} must install the emergency shutoff switches or devices near more than one egress point of the IT area and ensure it is labeled and protected by a cover to prevent accidental shut-off to facilitate safe and easy access for personnel. {ACRONYM} is required to fulfill this requirement as {ACRONYM} is strictly a tenant of the facility.

Is an emergency shutoff switch or device installed?

☐ No

☐ Yes

If Yes, Is the switch/device near more than one egress point of the IT area?

☐ No

☐ Yes

If Yes, Is the switch/device labeled and protected by a cover?

☐ No

☐ Yes

4.3 Emergency Power

{ACRONYM} is required to provide a capacity to implement uninterruptible power supply to {ACRONYM}. Uninterruptible power supply must have sufficient capacity to support orderly shutdown of {ACRONYM} or transition {ACRONYM} to long-term alternate power in the event of a primary power source loss. {ACRONYM} is required to fulfill this requirement as {ACRONYM} is strictly a tenant of the facility.

Table 8 – Emergency Power Is a long-term alternate power supply self-contained?

☐ No

☐ Yes

If Yes, Is the alternate power supply reliant on external power generation?

☐ No

☐ Yes

If No, Is the alternate power supply capable of maintaining minimally required operational capability or full operational capability in the event of an extended loss of the primary power source?

☐ No

☐ Yes

4.4 Emergency Lighting

{ACRONYM} is required to comply with established OSHA requirements by employing and maintaining emergency lighting for {ACRONYM}. Emergency lighting activates in the event of a power outage or disruption, and it covers emergency exits and evacuation routes within the facility. {ACRONYM} is required to fulfill this requirement as {ACRONYM} is strictly a tenant of the facility.

Does {ACRONYM} support essential mission and/or business functions?

☒ No

☐ Yes

If yes, Is emergency lighting present?

☐ No

☐ Yes

If yes, does it cover emergency exits and evacuation routes within the facility?

☐ No

☐ Yes

{ACRONYM} is required to implement fire detection and suppression. Fire detection devices/systems for {ACRONYM} must activate automatically. {ACRONYM} is required to fulfill this requirement as {ACRONYM} is strictly a tenant of the facility.

Are fire detection and suppression devices/systems available?

☐ No

☐ Yes

If Yes, are they supported by an independent energy source?

☐ No

☐ Yes

If Yes, do they activate automatically?

☐ No

☐ Yes

If Yes, do they activate automatically when the facility is not staffed?

☐ No

☐ Yes

If Yes, do they automatically activate to notify personnel or roles defined below in the event of a fire?

☐ No

☐ Yes

Table 9 – Fire Protection Roles Are fire protection systems inspected and documented at least annually?

☐ No

☐ Yes

If Yes, are all deficiencies identified resolved within 60 days?

☐ No

☐ Yes

5.2 Temperature and Humidity Controls

{ACRONYM} is required to implement automatic temperature and humidity controls. Automatic temperature and humidity controls for {ACRONYM} must prevent fluctuations potentially harmful to {ACRONYM}. {ACRONYM} is required to fulfill this requirement as {ACRONYM} is strictly a tenant of the facility.

Are automatic temperature and humidity controls available?

☐ No

☐ Yes

If Yes, do they provide an alarm or notification of changes potentially harmful to personnel or equipment?

☐ No

☐ Yes

If Yes, are they are set within DoD specified guidelines? (64.4 – 80.6 degrees F; 45% – 60% Relative Humidity; Dew Point 41.9 ° – 59°F; measured at the air intake inlet of the IT equipment casing; for other systems, levels within manufacturer specifications) ☐ No

☐ Yes

Are temperature and humidity levels continuously monitored unless manufacturer specifications allow for a wide enough tolerance that control is not required?

☐ No

☐ Yes

5.3 Water Damage Protection

{ACRONYM} is required to implement master shutoff valves for water sources. Master shutoff valves for {ACRONYM} must be installed and accessible. {ACRONYM} is required to fulfill this requirement as {ACRONYM} is strictly a tenant of the facility.

Are master shutoff valves installed?

☐ No

☐ Yes

If Yes, is inspection documentation (e.g., inspection form, tag attached to valve) available?

☐ No

☐ Yes

The following list of key personnel have knowledge of location and activation procedures for master shutoff valves and any other relevant documents or records:

Table 10 – Water Damage Control Roles

Are water detection mechanisms installed?

☐ No

☐ Yes

If Yes, do they provide automated alerts upon water detection?

☐ No

☐ Yes

The following list identifies automated mechanisms to detect the presence of water in the vicinity of the information system and personnel or roles that are alerted:

Public Works

Table 11 – Water Presence Detection

6.0 DELIVERY AND REMOVAL

Delivery and removal of {ACRONYM} components must be documented to ensure the actions were authorized. The following process/documentation exists to ensure a detailed and accurate record of all {ACRONYM} components that enter and exit the facility exists:

Table 12 – Delivery and Removal Procedures This plan documents all system components entering and exiting the facility and visually inspects the controls (e.g., logs, scans, etc.) to ensure implementation. Logs are contained in Enclosure 3.

7.0 ALTERNATE WORK SITE

{ACRONYM} is required to implement physical security controls for alternate worksites. {ACRONYM} must define security controls to employ at alternate work sites, which must include all applicable building and safety codes for the {ACRONYM} environment. {ACRONYM} is required to fulfill this requirement as {ACRONYM} is strictly a tenant of the facility. This requirement does not apply to Telework activities.

Are alternate worksites authorized?

☐ No

☐ Yes

If Yes, are all security controls identified and all applicable to all building and safety codes?

☐ No

☐ Yes

The following list designates alternate worksite locations and requirement status:

PE-2 thru PE-16, PE18 thru PE-20

Table 13 – Alternate Worksite Controls

It is {ACRONYM} policy to position all system components in the following manner:

· Deter viewing from unauthorized personnel

· Do not locate near water hazards

· Ensure proper HVAC temperature Is {ACRONYM} positioned according to the environmental policy?

☐ No

☐ Yes

8.2 System Hazards

{ACRONYM} planned the location of the facility where {ACRONYM} resides with regard to physical and environmental hazards. {ACRONYM} has determined that the following environmental and physical hazards are applicable:

ENVIRONMENTAL HAZARDS

PHYSICAL HAZARDS

Table 14 – System Hazards

9.0 INFORMATION LEAKAGE

TEMPEST is a National Security Agency specification referring to spying on information systems through leaking emanations, including unintentional radio or electrical signals, sounds, and vibrations. TEMPEST applies to Classified systems.

Is {ACRONYM} considered Classified?

☐ No

☐ Yes

If Yes, have measures to protect against compromising emanations been implemented according to DOD Directive S-5200.19?

☐ No

☐ Yes

If Yes, has an examination of the TEMPEST countermeasures been reviewed and inspected to ensure those countermeasures have been implemented?

☐ No

☐ Yes

10.0 ASSET MONITORING AND TRACKING

Asset monitoring and tracking ensures {ACRONYM} components are accounted for. {ACRONYM} tracks and monitor the location and movement of all components within controlled areas utilizing the following technologies:

Table 15 – Asset Monitoring and Tracking

APPENDIX A – DETAILED COMPLIANCE MATRIX

The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations".

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the roles as organizational personnel with physical and environmental protection responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the roles as organizational personnel with physical and environmental protection responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDI 5200.08 and DoD 5200.08-R meet the requirement for Physical and Environmental Policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 5200.08 and DoD 5200.08-R

DoD has defined the personnel or roles as organizational personnel with physical and environmental protection responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 5200.08 and DoD 5200.08-R

DoD has defined the personnel or roles as organizational personnel with physical and environmental protection responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency reviewed annually - updated as appropriate but at least within 10 years of date of issuance.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDI 5200.08 and DoD 5200.08-R meet the requirement for Physical and Environmental Policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R.

DoD has defined the frequency reviewed annually - updated as appropriate but at least within 10 years of date of issuance.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency reviewed annually - updated as appropriate.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R.

DoD has defined the frequency reviewed annually - updated as appropriate.

Automatically compliant with this CCI because they are covered at the DoD level

High Moderate The organization conducting the inspection/assessment obtains and examines documentation of the capability to shut off the power to facilities or areas within facilities containing concentrations of information system resources (e.g., datacenters, server rooms, mainframe computer rooms) in emergency situations.

The purpose is to validate the organization has provided the capability of shutting off power in emergency situations.

Section 4.2

High

The organization conducting the inspection/assessment will physically inspect emergency shutoff switches or devices for placement to validate the organization has installed the emergency shutoff switches or devices near more than one egress point of the IT area and ensure it is labeled and protected by a cover to prevent accidental shut-off to facilitate safe and easy access for personnel.

DoD has defined the location as near more than one egress point of the IT area and ensure it is labeled and protected by a cover to prevent accidental shut-off.

Section 4.2

High

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the location as near more than one egress point of the IT area and ensures it is labeled and protected by a cover to prevent accidental shut-off.

Automatically compliant with this CCI because they are covered at the DoD level

High

The organization conducting the inspection/assessment will ensure that the inspected organization has protected emergency power shutoff capability.

DoD has defined the location as near more than one egress point of the IT area and ensures it is labeled and protected by a cover to prevent accidental shut-off.

Section 4.2

High

High

Low

High

Low

DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

DoD has determined the emergency responders are not appropriate to define at the Enterprise level.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

DoD has determined the emergency responders are not appropriate to define at the Enterprise level.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

High

DoD has defined the frequency as annually.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

DoD has defined the time period as 60 days.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

DoD has defined the time period as 60 days.

Automatically compliant with this CCI because they are covered at the DoD level

High

Low The organization conducting the inspection/assessment reviews temperature and humidity controls to validate that they are set within DoD specified guidelines.

DoD has defined the acceptable levels as for commercial grade information systems: 64.4 – 80.6 degrees F; 45% – 60% Relative Humidity; Dew Point 41.9 ° – 59°F; measured at the air intake inlet of the IT equipment casing; for other systems, levels within manufacturer specifications.

Section 5.2

High

Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the acceptable levels as for commercial grade information systems: 64.4 – 80.6 degrees F; 45% – 60% Relative Humidity; Dew Point 41.9 ° – 59°F; measured at the air intake inlet of the IT equipment casing; for other systems, levels within manufacturer specifications.

Automatically compliant with this CCI because they are covered at the DoD level

High

Low The organization conducting the inspection/assessment will visually observe the inspected organization's independent monitoring device, obtain and examine audit logs, and interview physical security/safety personnel to validate the inspected organization monitors temperature and humidity levels continuously unless manufacturer specifications allow for a wide enough tolerance that control is not required.

DoD has defined the frequency as continuously unless manufacturer specifications allow for a wide enough tolerance that control is not required.

Section 5.2

High

Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as continuously unless manufacturer specifications allow for a wide enough tolerance that control is not required.

Automatically compliant with this CCI because they are covered at the DoD level

High

Low

High

Low

High

Low

DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines records authorizing all system components entering and exiting the facility.

DoD has defined the types of information system components as all system components.

Section 6.0

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines records monitoring all system components entering and exiting the facility.

DoD has defined the types of information system components as all system components.

Section 6.0

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the physical and environmental protection plan to determine if controls have been documented for all system components entering and exiting the facility and visually inspects the controls (e.g., logs, scans, etc.) to ensure implementation.

DoD has defined the types of information system components as all system components.

Section 6.0

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines records of physical entry and exit events to the facility. The purpose of the reviews is to ensure the organization is maintaining detailed and accurate records of information system components that enter and exit the facility.

If the organization is following GRS 18, Section 12 they are automatically compliant.

Section 6.0

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the types of information system components as all system components.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Moderate High Moderate

Moderate High Moderate High Moderate The organization conducting the inspection/assessment obtains and examines the documented security controls to ensure the organization being inspected/assessed defines security controls to employ at alternate work sites, which must include all applicable building and safety codes for the information system's environment.

DoD has determined the security controls are not appropriate to define at the Enterprise level, but must include all applicable building and safety codes for the information system's environment.

Section 7.0

Moderate High Moderate High Moderate The organization conducting the inspection/assessment obtains and examines:

1. The procedures for assessing the effectiveness of alternate work site security controls.

2. The audit records of assessments they have conducted of security controls effectiveness for alternate work sites.

Section 7.0

Moderate High Moderate High Moderate

DoD has determined the physical and environmental hazards are not appropriate to define at the Enterprise level.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

1. The list of roles or positions that have access to the facility where the information system resides.

2. The list of personnel assigned to those roles Recommended:

3. Access logs to verify access to the facility was authorized based on the appropriate roles and positions NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the list of acceptable forms of identification are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the credentials are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the list of personnel with authorized access to facilities where information systems reside to ensure it is current within every 90 days.

The review process should also determine if the organization has identified and officially designated its publicly accessible areas where access authorization is not required.

DoD has defined the frequency as every 90 days.

Enclosure 1

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low