An electromagnetic pulse is a short burst of electromagnetic energy across a range of frequencies. It can be natural or man made, and it can disrupt or damage electronic equipment. NIST SP 800-53 Rev 5 control PE-21 Electromagnetic Pulse Protection asks you to employ protective measures against EMP damage for the systems you choose.
800-53 binds US federal systems and, through contract, some suppliers. Most commercial companies will document this control as not applicable or inherited. The guidance says EMP protection may be especially important for systems that are part of US critical infrastructure.
What it means in practice
The guidance lists measures such as shielding, surge suppressors, ferro resonant transformers and earth grounding. Surge suppression and proper grounding are routine and cheap, and they deserve a line in your records even if you stop there.
Evidence to collect
- The scope decision: which systems, and why.
- Records of surge protection and grounding.
- For critical infrastructure systems, shielding specifications and inspection reports.
- For hosted systems, the provider's report.
Common gaps
No written scope decision. Surge suppressors exist but are not documented.
How to implement it
Record your scope and rationale. Install surge protection on equipment racks. There are no enhancements for this control.
Quick check
Do I need shielding for a normal office server closet?
Usually not. Document the scope decision, and keep surge suppression and grounding in place.
