NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PE-9, Power Equipment and Cabling, is one sentence: protect power equipment and power cabling for the system from damage and destruction.
The guidance says you decide what protection fits each location, inside and outside the facility. It names internal cabling, uninterruptible power sources in offices and data centers, and generators and power cabling outside of buildings.
What it means in practice
Power failures take systems down as reliably as attacks do. For a small company the practical questions are simple. Where does power enter the building? Is the UPS protected from water, impact, and tampering? Is the cabling in a place where it will not be cut or crushed?
Evidence to collect
- Photos of the UPS, panels and cable routes.
- A maintenance log for UPS batteries and generators.
- Test records for failover.
- A provider report if a colocation facility handles power.
The record lists two enhancements: PE-9.1 Redundant Cabling and PE-9.2 Automatic Voltage Controls.
Common gaps
- UPS units on the floor in a room that can flood.
- Batteries past their service life.
- Generator tests that were never recorded.
How to implement it
Walk the power path. Raise or enclose equipment, label breakers, and schedule battery checks. Keep every test as a dated record.
Quick check
Do cloud only companies need PE-9?
Not directly. Your evidence is the provider's report on its facilities, plus your own decision about regions and redundancy.
