Where you put the server matters. NIST SP 800-53 Rev 5 control PE-18 Location of System Components asks you to position system components within the facility to minimize damage from physical and environmental hazards and to minimize the chance of unauthorized access.
800-53 binds US federal systems and, through contract, some suppliers. For others it is a reference. It is a sensible checklist for any room that houses equipment.
What it means in practice
The guidance lists hazards: floods, fires, tornadoes, earthquakes, hurricanes, terrorism, vandalism, electromagnetic pulse, electrical interference and incoming radiation. You choose which apply to your site.
It also asks you to consider entry points where people who are not authorized might still be nearby. Proximity can allow wireless sniffing of organizational communications.
So the questions are simple. Is the equipment below a water pipe or on the ground floor of a flood prone building? Is it next to a window facing the street? Can someone in the lobby see a screen, or sniff the wireless network from the parking lot?
Evidence to collect
- A site risk assessment listing relevant hazards.
- A floor plan showing where equipment sits and why.
- Photos of rack placement, lock and line of sight.
- Records of any relocation done to reduce risk.
- Wireless coverage tests showing signal reach outside the building.
Common gaps
Equipment was placed where there was room, not where it was safe. A wiring closet doubles as a storage room. Access points broadcast strongly into public areas.
How to implement it
Walk the site with a short checklist. Move equipment away from water, windows and shared walls where possible. Lower access point power or use directional antennas. Record the changes.
PE-18.1 Facility Site is withdrawn in Rev 5, with its content moved to PE-23 Facility Location. If you are choosing a building, read PE-23.
Quick check
Does PE-18 care about wireless signals?
Yes. The guidance notes that nearby unauthorized people could sniff communications, so entry points and signal reach matter.
