# PE-16 Delivery and Removal

NIST SP 800-53 control. Family: PE Physical and Environmental Protection. Function: preventative. Baselines: low, moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: a. Authorize and control [Assignment: organization-defined types of system components] entering and exiting the facility; and b. Maintain records of the system components.
Guidance: Enforcing authorizations for entry and exit of system components may require restricting access to delivery areas and isolating the areas from the system and media libraries.

## Patterns that use it (1)
- Standard (1): SP-002 Server Module

## Clauses by framework (21 frameworks)
- iso_27001_2022: A.5.10, A.7.2, A.7.10
- cobit_2019: DSS01, DSS05
- soc2_tsc: A1.2
- bsi_grundschutz: INF.1, INF.2
- anssi: Hygiene.37, SecNumCloud.12.2
- osfi_b13: B-13.2.1
- gdpr: Art.32(1)(b)
- rbi_csf: Annex1.1
- fisc: FISC.F3
- qatar_nia: AM, PS
- sama_csf: 3.9
- uae_ia: T6
- bog_cisd: CISD-XIV
- ffiec_is: II.C.8, II.C.13(d)
- hipaa_sr: §164.310(d)(2)(iii)
- cmmc_2: PE
- nerc_cip: CIP-006-6
- hitrust_csf: 08.b, 09.f
- lloyds_ms: PHYS.1
- csa_ccm_v4: DCS-02
- csa_aicm: DCS-02
OSA's mapping for iso_27001_2022 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/PE-16
- Clauses only: /api/v1/controls/PE-16?fields=mappings
- Page for people: /controls/pe-16/