NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PE-23, Facility Location, has two parts. Plan the location of the facility where the system resides with physical and environmental hazards in mind. For facilities you already use, fold those hazards into your risk management strategy.
The guidance lists floods, fires, tornadoes, earthquakes, hurricanes, terrorism, vandalism, electromagnetic pulse, electrical interference, and other incoming electromagnetic radiation. Where equipment sits inside the building is a separate control, PE-18.
What it means in practice
If you run your own server room or a colo cage, someone should be able to explain why that site was chosen and what hazards it carries. If you run in a cloud region, the same question applies at the provider level: what hazards affect the regions you use, and how does that show up in your risk register?
Evidence to collect
- A site or region selection record that names the hazards considered.
- A risk register entry for each material hazard, with an owner and a decision.
- For cloud, the regions in use and the provider documentation about their facilities.
- Notes on how a hazard changed a decision, such as moving a server room off the ground floor.
Common gaps
- The site was chosen for cost and nobody wrote down the hazards.
- Cloud regions were picked by default and never reviewed.
- Hazards sit in a facilities file that the security team never sees.
How to implement it
Run a one page hazard review per site or region. List the hazards from the guidance that are plausible for the location, rate them, and record the decision. Review it when you add a site or on a regular schedule. Link the entries to your risk register so they get tracked like any other risk.
Quick check
Does this cover cloud?
The control talks about the facility where the system resides. With cloud, that facility belongs to the provider, so your evidence is the region choice, the provider documentation, and your own risk decision.
