NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PE-4, Access Control for Transmission, asks you to control physical access to system distribution and transmission lines within your facilities, using safeguards you define.
The guidance explains the goal. Protect against accidental damage, disruption, and physical tampering, and where traffic is unencrypted, against eavesdropping or modification. Its examples are disconnected or locked spare jacks, locked wiring closets, cabling protected by conduit or cable trays, and wiretapping sensors.
What it means in practice
Walk your building. Find where network cables run, where they terminate, and which wall jacks are live. Anyone who can plug into a live jack in an empty meeting room has reached your network without passing through a door you thought about.
Evidence to collect
- A list of wiring closets and patch panels, with who holds keys.
- Photos of locked closets and labeled or disabled spare jacks.
- Switch port configuration showing unused ports shut down.
- A cabling diagram or note on conduit and tray use.
Common gaps
- Unlocked closets that double as storage rooms.
- Live jacks in public or shared spaces.
- Encryption assumed but never confirmed on internal links.
How to implement it
Lock the closets and record key holders. Disable unused switch ports. Use network access control or port security where it fits. Where cable runs through shared spaces, enclose it. Encrypting traffic in transit reduces what a tap can learn, but it does not replace the physical measures.
Quick check
If everything is encrypted, can we skip PE-4?
Encryption lowers the eavesdropping risk, but the guidance also names accidental damage and tampering. Physical protection of the lines still matters for availability.
