PE-14(2) Environmental Controls | Monitoring with Alarms and Notifications
Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to FedRAMP-defined personnel or roles.
3
artefacts
1
held by a system
1
at each review
moderate
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Environmental monitoring configuration showing the alarm thresholds · Physical access / facilities
periodic reviewEvidence produced at each review
- Alarm test records and sample notifications · Physical access / facilities
governing documentDocuments that govern the control
- Alarm routing list naming the recipients · Policy repository / GRC workspace
First move
Start with the 1 of 3 artefacts that already live in a system (Physical access / facilities); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Monitoring present but alarms route to an unmonitored mailbox
- Inherited from the data centre provider with no customer responsibility matrix entry evidencing it
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPE-14 Environmental Controls · PE-15 Water Damage Protection. Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel