Browse 1,193 controls and enhancements across 20 security and privacy families. Use the GovRAMP crosswalk to locate controls referenced by Security Snapshot, Core, and Moderate.
A shared catalog supports common-control planning; designation as a common, hybrid, or system-specific control depends on your organization’s implementation and inheritance decisions.
Sources and crosswalk scope
NIST OSCAL content 5.1.1+u4, retrieved 2026-09-18. GovRAMP Snapshot v1.4 and Core selection from Moderate v1.06 reference the December 2020 Rev. 5 text. Mappings establish exact identifier correspondence, not identical requirements, inherited implementation, or GovRAMP authorization. GovRAMP parameters and additional requirements remain authoritative for each program. Full Moderate, High, and other programs are not mapped here. Withdrawn controls are retained for reference.
Physical and Environmental Protection · Base control
PE-13 · Fire Protection
Control statement and discussion
NIST control statement
Employ and maintain fire detection and suppression systems that are supported by an independent energy source.
Discussion
The provision of fire detection and suppression systems applies primarily to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Fire detection and suppression systems that may require an independent energy source include sprinkler systems and smoke detectors. An independent energy source is an energy source, such as a microgrid, that is separate, or can be separated, from the energy sources providing power for the other parts of the facility.
GovRAMP crosswalk
GovRAMP Moderate Readiness · PE-13 — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement
PE-13(1) · Detection Systems — Automatic Activation and Notification
Employ fire detection systems that activate automatically and notify [Assignment: personnel or roles] and [Assignment: emergency responders] in the event of a fire.
Discussion
Organizations can identify personnel, roles, and emergency responders if individuals on the notification list need to have access authorizations or clearances (e.g., to enter to facilities where access is restricted due to the classification or impact level of information within the facility). Notification mechanisms may require independent energy sources to ensure that the notification capability is not adversely affected by the fire.
GovRAMP crosswalk
GovRAMP Moderate Readiness · PE-13 (1) — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement
PE-13(2) · Suppression Systems — Automatic Activation and Notification
(a) Employ fire suppression systems that activate automatically and notify [Assignment: personnel or roles] and [Assignment: emergency responders] ; and
(b) Employ an automatic fire suppression capability when the facility is not staffed on a continuous basis.
Discussion
Organizations can identify specific personnel, roles, and emergency responders if individuals on the notification list need to have appropriate access authorizations and/or clearances (e.g., to enter to facilities where access is restricted due to the impact level or classification of information within the facility). Notification mechanisms may require independent energy sources to ensure that the notification capability is not adversely affected by the fire.
GovRAMP crosswalk
GovRAMP Moderate Readiness · PE-13 (2) — Direct NIST identifier reference. GovRAMP source matrix
Physical and Environmental Protection · Enhancement · Withdrawn
Ensure that the facility undergoes [Assignment: frequency] fire protection inspections by authorized and qualified inspectors and identified deficiencies are resolved within [Assignment: time period].
Discussion
Authorized and qualified personnel within the jurisdiction of the organization include state, county, and city fire inspectors and fire marshals. Organizations provide escorts during inspections in situations where the systems that reside within the facilities contain sensitive information.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
