PE-15 Water Damage Protection

NIST 800-53 (r4) Control

The organization protects the information system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.

NIST 800-53 (r4) Supplemental Guidance

This control applies primarily to facilities containing concentrations of information system resources including, for example, data centers, server rooms, and mainframe computer rooms. Isolation valves can be employed in addition to or in lieu of master shutoff valves to shut off water supplies in specific areas of concern, without affecting entire organizations. Related control: AT-3.

NIST 800-53 (r5) Discussion

The provision of water damage protection primarily applies to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Isolation valves can be employed in addition to or in lieu of master shutoff valves to shut off water supplies in specific areas of concern without affecting entire organizations.

38North Guidance:

Meets Minimum Requirement:

• Install master shutoff and / or isolation valves in a secure yet readily assessible area.

• Document the location and use of master shutoff and / or isolation valves.

• Train personnel in the use of master shutoff and / or isolation valves.

• Test master shutoff and / or isolation valves.

• Document testing.

Best Practice:

• Install flow monitoring equipment and centralized monitoring for early leak alerting.

Unofficial FedRAMP Guidance:

• TBD

Assessment Evidence:

• Inspect master shutoff and / or isolation valves.

• Review documentation describing positioning and use of master shutoff and / or isolation valves.

• Interview personnel to validate that they know how to find master shutoff and / or isolation valves and are trained in their use.

• Review documentation showing that master shutoff and / or isolation valves are tested.

• Most recent water shutoff valve inspection report

CSP Implementation Tips:

• AWS: Fully inherited

• Azure: Fully inherited

• GCP: Fully inherited.