Some assets matter enough that you want to know where they are at all times. NIST SP 800-53 Rev 5 control PE-20 Asset Monitoring and Tracking asks you to employ location technologies to track and monitor the movement of certain assets within defined areas.
800-53 binds US federal systems and, through contract, some suppliers. For others it is a reference. It fits equipment you move often or cannot afford to lose.
What it means in practice
The guidance says location technologies help ensure critical assets, including vehicles, equipment and system components, stay in authorized locations. It also tells organizations to consult counsel and privacy officials before deployment, because tracking raises privacy concerns.
Choose what to track and where. RFID tags on test hardware, GPS on field kits, or managed device location for company laptops are examples. Do not track personal devices without a clear legal basis and notice.
Evidence to collect
- The list of tracked assets and the defined areas.
- The technology in use and its configuration.
- Alerts for assets that leave authorized areas, with resolution notes.
- Legal and privacy review sign off.
- Employee notices where tracking applies.
Common gaps
Tracking exists but no one looks at the alerts. Privacy review never happened. The asset list is stale.
How to implement it
Start small with the assets that would hurt most to lose. Define zones, route alerts to someone who owns them and get privacy review first. A current inventory helps here, and discovery gives you the baseline.
Click through it at your own pace, or open it full screen.
Quick check
Should I involve legal before tracking devices?
Yes. The guidance recommends consulting counsel and the privacy official to address privacy concerns.
