A power cut should never corrupt a database. NIST SP 800-53 Rev 5 control PE-11 Emergency Power asks you to provide an uninterruptible power supply so systems can keep running long enough for something defined to happen after the main power fails.
800-53 binds US federal systems and, through contract, some suppliers. For others it is a reference. If you use a colocation facility or the cloud, your evidence is the provider's report and your own on premises equipment, if any.
What the control asks
Provide a UPS to facilitate a chosen outcome when primary power is lost. The outcome might be an orderly shutdown or a transition to long term alternate power. The guidance explains that a UPS provides short term power, and differs from a generator, which provides longer term power and takes time to start.
What it means in practice
Decide what you want to happen. For a wiring closet it may be ten minutes to flush data and shut down. For a small server room it may be enough time for a generator to start. Size the UPS for that, with margin. Then test it.
Evidence to collect
- The design decision stating the intended outcome and runtime.
- UPS model, capacity and load records.
- Battery replacement and maintenance logs.
- Results of a power loss test or a runtime test.
- Alerts or monitoring showing UPS status.
Common gaps
The UPS was bought years ago and the batteries are dead. The load has doubled. Servers are configured for no automatic shutdown, so a UPS only delays the crash.
How to implement it
Calculate load, buy capacity for the runtime you need, wire network gear to the UPS and configure graceful shutdown software. Test once a year and keep the results.
Two enhancements extend this. PE-11.1 Alternate Power Supply, Minimal Operational Capability asks for a long term alternate source that can keep minimal operations going. PE-11.2 Alternate Power Supply, Self contained requires one that is independent of the external grid, automatic and not reliant on outside services.
Quick check
Is a UPS the same as a generator?
No. A UPS gives short term power. A generator gives longer term power but needs time to start. They often work together.
What does the auditor ask for first?
Usually the last test result and the battery service record.
