Browse 1,193 controls and enhancements across 20 security and privacy families. Use the GovRAMP crosswalk to locate controls referenced by Security Snapshot, Core, and Moderate.
A shared catalog supports common-control planning; designation as a common, hybrid, or system-specific control depends on your organization’s implementation and inheritance decisions.
Sources and crosswalk scope
NIST OSCAL content 5.1.1+u4, retrieved 2026-09-18. GovRAMP Snapshot v1.4 and Core selection from Moderate v1.06 reference the December 2020 Rev. 5 text. Mappings establish exact identifier correspondence, not identical requirements, inherited implementation, or GovRAMP authorization. GovRAMP parameters and additional requirements remain authoritative for each program. Full Moderate, High, and other programs are not mapped here. Withdrawn controls are retained for reference.
Official pinned NIST sourceSHA-256: 81cf2de45ede9aef3de7ce09d65ea9d32f662c483bbf916f6e346292b22f7763
Physical and Environmental Protection · Base control
PE-8 · Visitor Access Records
Control statement and discussion
NIST control statement
a. Maintain visitor access records to the facility where the system resides for [Assignment: time period];
b. Review visitor access records [Assignment: frequency] ; and
c. Report anomalies in visitor access records to [Assignment: personnel].
Discussion
Visitor access records include the names and organizations of individuals visiting, visitor signatures, forms of identification, dates of access, entry and departure times, purpose of visits, and the names and organizations of individuals visited. Access record reviews determine if access authorizations are current and are still required to support organizational mission and business functions. Access records are not required for publicly accessible areas.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-8 — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement
PE-8(1) · Automated Records Maintenance and Review
View parent controlControl statement and discussion
NIST control statement
Maintain and review visitor access records using [Assignment: organization-defined automated mechanisms].
Discussion
Visitor access records may be stored and maintained in a database management system that is accessible by organizational personnel. Automated access to such records facilitates record reviews on a regular basis to determine if access authorizations are current and still required to support organizational mission and business functions.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Enhancement
PE-8(3) · Limit Personally Identifiable Information Elements
View parent controlControl statement and discussion
NIST control statement
Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: [Assignment: elements].
Discussion
Organizations may have requirements that specify the contents of visitor access records. Limiting personally identifiable information in visitor access records when such information is not needed for operational purposes helps reduce the level of privacy risk created by a system.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Base control
PE-9 · Power Equipment and Cabling
Control statement and discussion
NIST control statement
Protect power equipment and power cabling for the system from damage and destruction.
Discussion
Organizations determine the types of protection necessary for the power equipment and cabling employed at different locations that are both internal and external to organizational facilities and environments of operation. Types of power equipment and cabling include internal cabling and uninterruptable power sources in offices or data centers, generators and power cabling outside of buildings, and power sources for self-contained components such as satellites, vehicles, and other deployable systems.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-9 — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement
PE-9(1) · Redundant Cabling
View parent controlControl statement and discussion
NIST control statement
Employ redundant power cabling paths that are physically separated by [Assignment: distance].
Discussion
Physically separate and redundant power cables ensure that power continues to flow in the event that one of the cables is cut or otherwise damaged.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Enhancement
PE-9(2) · Automatic Voltage Controls
View parent controlControl statement and discussion
NIST control statement
Employ automatic voltage controls for [Assignment: critical system components].
Discussion
Automatic voltage controls can monitor and control voltage. Such controls include voltage regulators, voltage conditioners, and voltage stabilizers.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Base control
PE-10 · Emergency Shutoff
Control statement and discussion
NIST control statement
a. Provide the capability of shutting off power to [Assignment: system or individual system components] in emergency situations;
b. Place emergency shutoff switches or devices in [Assignment: location] to facilitate access for authorized personnel; and
c. Protect emergency power shutoff capability from unauthorized activation.
Discussion
Emergency power shutoff primarily applies to organizational facilities that contain concentrations of system resources, including data centers, mainframe computer rooms, server rooms, and areas with computer-controlled machinery.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-10 — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Base control
PE-11 · Emergency Power
Control statement and discussion
NIST control statement
Provide an uninterruptible power supply to facilitate [Selection (one): an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss.
Discussion
An uninterruptible power supply (UPS) is an electrical system or mechanism that provides emergency power when there is a failure of the main power source. A UPS is typically used to protect computers, data centers, telecommunication equipment, or other electrical equipment where an unexpected power disruption could cause injuries, fatalities, serious mission or business disruption, or loss of data or information. A UPS differs from an emergency power system or backup generator in that the UPS provides near-instantaneous protection from unanticipated power interruptions from the main power source by providing energy stored in batteries, supercapacitors, or flywheels. The battery duration of a UPS is relatively short but provides sufficient time to start a standby power source, such as a backup generator, or properly shut down the system.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-11 — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement
PE-11(1) · Alternate Power Supply — Minimal Operational Capability
View parent controlControl statement and discussion
NIST control statement
Provide an alternate power supply for the system that is activated [Selection (one): manually; automatically] and that can maintain minimally required operational capability in the event of an extended loss of the primary power source.
Discussion
Provision of an alternate power supply with minimal operating capability can be satisfied by accessing a secondary commercial power supply or other external power supply.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Enhancement
PE-11(2) · Alternate Power Supply — Self-contained
View parent controlControl statement and discussion
NIST control statement
Provide an alternate power supply for the system that is activated [Selection (one): manually; automatically] and that is:
(a) Self-contained;
(b) Not reliant on external power generation; and
(c) Capable of maintaining [Selection (one): minimally required operational capability; full operational capability] in the event of an extended loss of the primary power source.
Discussion
The provision of a long-term, self-contained power supply can be satisfied by using one or more generators with sufficient capacity to meet the needs of the organization.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Base control
PE-12 · Emergency Lighting
Control statement and discussion
NIST control statement
Employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.
Discussion
The provision of emergency lighting applies primarily to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Emergency lighting provisions for the system are described in the contingency plan for the organization. If emergency lighting for the system fails or cannot be provided, organizations consider alternate processing sites for power-related contingencies.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-12 — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement
PE-12(1) · Essential Mission and Business Functions
View parent controlControl statement and discussion
NIST control statement
Provide emergency lighting for all areas within the facility supporting essential mission and business functions.
Discussion
Organizations define their essential missions and functions.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Base control
PE-13 · Fire Protection
Control statement and discussion
NIST control statement
Employ and maintain fire detection and suppression systems that are supported by an independent energy source.
Discussion
The provision of fire detection and suppression systems applies primarily to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Fire detection and suppression systems that may require an independent energy source include sprinkler systems and smoke detectors. An independent energy source is an energy source, such as a microgrid, that is separate, or can be separated, from the energy sources providing power for the other parts of the facility.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-13 — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement
PE-13(1) · Detection Systems — Automatic Activation and Notification
View parent controlControl statement and discussion
NIST control statement
Employ fire detection systems that activate automatically and notify [Assignment: personnel or roles] and [Assignment: emergency responders] in the event of a fire.
Discussion
Organizations can identify personnel, roles, and emergency responders if individuals on the notification list need to have access authorizations or clearances (e.g., to enter to facilities where access is restricted due to the classification or impact level of information within the facility). Notification mechanisms may require independent energy sources to ensure that the notification capability is not adversely affected by the fire.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-13 (1) — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement
PE-13(2) · Suppression Systems — Automatic Activation and Notification
View parent controlControl statement and discussion
NIST control statement
(a) Employ fire suppression systems that activate automatically and notify [Assignment: personnel or roles] and [Assignment: emergency responders] ; and
(b) Employ an automatic fire suppression capability when the facility is not staffed on a continuous basis.
Discussion
Organizations can identify specific personnel, roles, and emergency responders if individuals on the notification list need to have appropriate access authorizations and/or clearances (e.g., to enter to facilities where access is restricted due to the impact level or classification of information within the facility). Notification mechanisms may require independent energy sources to ensure that the notification capability is not adversely affected by the fire.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-13 (2) — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement
PE-13(4) · Inspections
View parent controlControl statement and discussion
NIST control statement
Ensure that the facility undergoes [Assignment: frequency] fire protection inspections by authorized and qualified inspectors and identified deficiencies are resolved within [Assignment: time period].
Discussion
Authorized and qualified personnel within the jurisdiction of the organization include state, county, and city fire inspectors and fire marshals. Organizations provide escorts during inspections in situations where the systems that reside within the facilities contain sensitive information.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Base control
PE-14 · Environmental Controls
Control statement and discussion
NIST control statement
a. Maintain [Selection (one-or-more): temperature; humidity; pressure; radiation; [Assignment: environmental control] ] levels within the facility where the system resides at [Assignment: acceptable levels] ; and
b. Monitor environmental control levels [Assignment: frequency].
Discussion
The provision of environmental controls applies primarily to organizational facilities that contain concentrations of system resources (e.g., data centers, mainframe computer rooms, and server rooms). Insufficient environmental controls, especially in very harsh environments, can have a significant adverse impact on the availability of systems and system components that are needed to support organizational mission and business functions.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-14 — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement
PE-14(1) · Automatic Controls
View parent controlControl statement and discussion
NIST control statement
Employ the following automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system: [Assignment: automatic environmental controls].
Discussion
The implementation of automatic environmental controls provides an immediate response to environmental conditions that can damage, degrade, or destroy organizational systems or systems components.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Enhancement
PE-14(2) · Monitoring with Alarms and Notifications
View parent controlControl statement and discussion
NIST control statement
Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to [Assignment: personnel or roles].
Discussion
The alarm or notification may be an audible alarm or a visual message in real time to personnel or roles defined by the organization. Such alarms and notifications can help minimize harm to individuals and damage to organizational assets by facilitating a timely incident response.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Base control
PE-15 · Water Damage Protection
Control statement and discussion
NIST control statement
Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.
Discussion
The provision of water damage protection primarily applies to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Isolation valves can be employed in addition to or in lieu of master shutoff valves to shut off water supplies in specific areas of concern without affecting entire organizations.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-15 — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement
PE-15(1) · Automation Support
View parent controlControl statement and discussion
NIST control statement
Detect the presence of water near the system and alert [Assignment: personnel or roles] using [Assignment: automated mechanisms].
Discussion
Automated mechanisms include notification systems, water detection sensors, and alarms.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Base control
PE-16 · Delivery and Removal
Control statement and discussion
NIST control statement
a. Authorize and control [Assignment: organization-defined types of system components] entering and exiting the facility; and
b. Maintain records of the system components.
Discussion
Enforcing authorizations for entry and exit of system components may require restricting access to delivery areas and isolating the areas from the system and media libraries.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-16 — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Base control
PE-17 · Alternate Work Site
Control statement and discussion
NIST control statement
a. Determine and document the [Assignment: alternate work sites] allowed for use by employees;
b. Employ the following controls at alternate work sites: [Assignment: controls];
c. Assess the effectiveness of controls at alternate work sites; and
d. Provide a means for employees to communicate with information security and privacy personnel in case of incidents.
Discussion
Alternate work sites include government facilities or the private residences of employees. While distinct from alternative processing sites, alternate work sites can provide readily available alternate locations during contingency operations. Organizations can define different sets of controls for specific alternate work sites or types of sites depending on the work-related activities conducted at the sites. Implementing and assessing the effectiveness of organization-defined controls and providing a means to communicate incidents at alternate work sites supports the contingency planning activities of organizations.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · PE-17 — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Base control
PE-18 · Location of System Components
Control statement and discussion
NIST control statement
Position system components within the facility to minimize potential damage from [Assignment: physical and environmental hazards] and to minimize the opportunity for unauthorized access.
Discussion
Physical and environmental hazards include floods, fires, tornadoes, earthquakes, hurricanes, terrorism, vandalism, an electromagnetic pulse, electrical interference, and other forms of incoming electromagnetic radiation. Organizations consider the location of entry points where unauthorized individuals, while not being granted access, might nonetheless be near systems. Such proximity can increase the risk of unauthorized access to organizational communications using wireless packet sniffers or microphones, or unauthorized disclosure of information.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Physical and Environmental Protection · Base control
PE-19 · Information Leakage
Control statement and discussion
NIST control statement
Protect the system from information leakage due to electromagnetic signals emanations.
Discussion
Information leakage is the intentional or unintentional release of data or information to an untrusted environment from electromagnetic signals emanations. The security categories or classifications of systems (with respect to confidentiality), organizational security policies, and risk tolerance guide the selection of controls employed to protect systems against information leakage due to electromagnetic signals emanations.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
