A laptop is delivered to the front desk and sits there for two days. A server is carried out for repair with no record. A box of old disks leaves on a Friday afternoon. NIST SP 800-53 Rev 5 control PE-16 Delivery and Removal is about closing those gaps.
800-53 binds US federal systems and, through contract, some suppliers. For other companies it is a reference, and it lines up with what customers ask about hardware handling and asset tracking.
What the control asks
Two parts. Authorize and control certain types of system components entering and exiting the facility. And maintain records of those components.
You choose which component types are in scope. The guidance adds that enforcing entry and exit authorization may mean restricting access to delivery areas and keeping them separate from the system and media libraries.
What it means in practice
Equipment should arrive through a known door, get logged, be checked against an order, and go to a safe place before it is configured. Equipment leaving should have a reason, an approver and a record, and its data should be dealt with under MP-6 before it goes.
For a remote first company the facility may be a small office plus shipping addresses. The same idea applies to equipment shipped to employees: you know what was sent, to whom, and what came back.
Evidence to collect
- The procedure for receiving and shipping equipment.
- A log of deliveries and removals with date, item, serial number, person and approver.
- Purchase orders matched to receipts.
- Asset inventory entries created at receipt and closed at disposal.
- Photos or layout showing the delivery area and its separation from the server space.
- Offboarding checklists showing equipment returned.
Common gaps
The log exists for servers and not for laptops or phones. Equipment is delivered to a shared area that anyone can enter. The asset inventory is updated months later. Returned devices are not recorded and no one can say if all were returned.
Another gap is repairs. Devices go out under warranty with data still on them.
How to implement it
Pick a single receiving point. Require a ticket for every inbound and outbound item. Scan or record the serial number and update the inventory the same day. Keep delivery space apart from storage and media areas. For shipped equipment, track courier confirmations.
Make asset inventory the backbone. If your inventory is current, most of this control becomes a report. Discovery tools help find what exists, and the demo shows how an asset inventory takes shape from what is already on the network.
Click through it at your own pace, or open it full screen.
This control has no enhancements. It pairs with PE-3 for access control, MP-5 for media transport and MP-6 for sanitization.
Mappings from PE-16 to other frameworks vary by source. If you cite one in a customer response, check it against the document the customer uses.
Quick check
Does PE-16 cover laptops shipped to remote employees?
It covers the component types you decide are in scope. Including laptops is sensible, and the record should show what was sent and returned.
What records does the control require?
Records of the system components that enter and leave. Serial numbers, dates and approvers make them useful.
