Electronic equipment gives off signals. In theory, a skilled attacker with the right gear can pick up those emissions and reconstruct data. NIST SP 800-53 Rev 5 control PE-19 Information Leakage asks you to protect the system from information leakage due to electromagnetic signals emanations.
800-53 binds US federal systems and, through contract, some suppliers. Most commercial companies will find this control not applicable, and should document that with a short reason.
What it means in practice
The guidance says information leakage is the intentional or unintentional release of data to an untrusted environment through electromagnetic emanations. The controls you choose depend on the security categories of your systems, your policies and your risk tolerance.
For nearly all commercial settings the risk is low. If you handle highly sensitive government data, shielded rooms or approved equipment may apply.
Evidence to collect
- A risk statement explaining why the control is or is not applicable.
- If applicable, shielding or equipment certifications and inspection records.
Common gaps
The control is skipped with no written rationale.
How to implement it
Write two sentences: your data classification, and why emanation risk is accepted. PE-19.1 National Emissions Policies and Procedures covers national standards for sites that need them.
Quick check
Can I mark PE-19 not applicable?
For most commercial systems yes, with a written rationale that references your risk assessment.
