{"data":{"id":"PE-19","name":"Information Leakage","family":"PE","family_name":"Physical and Environmental Protection","withdrawn":false,"description":"Protect the system from information leakage due to electromagnetic signals emanations.","supplemental_guidance":"Information leakage is the intentional or unintentional release of data or information to an untrusted environment from electromagnetic signals emanations. The security categories or classifications of systems (with respect to confidentiality), organizational security policies, and risk tolerance guide the selection of controls employed to protect systems against information leakage due to electromagnetic signals emanations.","enhancements":[{"id":"PE-19(01)","name":"National Emissions Policies and Procedures","statement":"Protect system components, associated data communications, and networks in accordance with national Emissions Security policies and procedures based on the security category or classification of the information.","baselines":[]}],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"PE-19","name":"Information Leakage","description":"Protect the system from information leakage due to electromagnetic signals emanations.","discussion":"Information leakage is the intentional or unintentional release of data or information to an untrusted environment from electromagnetic signals emanations. The security categories or classifications of systems (with respect to confidentiality), organizational security policies, and risk tolerance guide the selection of controls employed to protect systems against information leakage due to electromagnetic signals emanations.","related_controls":["AC-18","PE-18","PE-20"],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.7.5","A.7.8","A.8.12"],"iso_27002_2022":["8.12"],"cobit_2019":[],"pci_dss_v4":[],"nist_csf_2":["PR.AA-06"],"cis_controls_v8":["CIS 3.13"],"soc2_tsc":["A1.2"],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":["Hygiene.37","SecNumCloud.12.2"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.C(63)","IV.D(78)"],"gdpr":[],"dora":[],"bio2":["8.12"],"rbi_csf":["Annex1.3"],"fisc":["FISC.F1"],"lgpd_bcb":[],"hkma_tme1":[],"mlps_2":["8.1.1.9"],"dnb_good_practice":[],"cra":[],"swift_cscf":[],"qatar_nia":["PS"],"sama_csf":["3.7"],"uae_ia":["T6"],"ffiec_is":["II.C.8"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":["A"],"fips_140":["FIPS 140-3 §7.7","FIPS 140-3 §7.8"],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":["§11.200(a)(3)"],"fda_cyber":[],"hitrust_csf":[],"iso_27799":[],"lloyds_ms":["PHYS.1"],"naic_ds":[],"nhs_dspt":[],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: iso_27001_2022 A.7.5, A.7.8 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 PR.AA-06 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-03: baselines LMH to ---, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-013"]}}