Home NIST Guidelines PE-11(2)
PE-11(2) Physical Protection

Alternate Power Supply — Self-contained

High Risk Moderate Medium Cost

PE-11(2) (Alternate Power Supply — Self-contained) enhances base PE-11 within the NIST Physical and Environmental Protection family. Base PE-11 sets the foundational expectation; this enhancement adds specificity: Provide an alternate power supply for the system that is activated [organization-defined] and that is: Self-contained; Not reliant on external power generation; and Capable of maintaining [organization-defined] in the event of an extended loss of the primary power source. The pro. Covered entities and business associates apply it to data centers, clinic rooms, media handling areas, and environmental safeguards protecting systems that store ePHI.

Control Objective

Implement Alternate Power Supply — Self-contained so organization-defined physical and environmental protection safeguards operate consistently on systems and networks that handle ePHI, with measurable evidence for HIPAA and NIST assessments.

Implementation Guidance

  1. Map PE-11(2) to systems in scope (EHR, imaging, lab, pharmacy, billing, identity, backups, and BA connections).\n2. Translate “Alternate Power Supply — Self-contained” into technical settings, procedures, or architecture patterns owned by named roles.\n3. Prefer enforceable controls (config, automation, mediation) over awareness-only measures where feasible.\n4. Integrate with change, incident, and downtime processes so clinical operations are not surprised.\n5. Log and retain evidence of operation (tickets, configs, test results) aligned to audit needs.\n6. Include vendors/BAs in contracts and connection standards when they touch the control surface.\n7. Test after major EHR, network, or cloud changes — upgrades often reset protections.\n8. Review exceptions at least quarterly; expire “temporary” holes that expose ePHI paths.

Real-World Use Cases

How this control shows up in healthcare and HIPAA-covered environments.

Real-world scenario

UPS for EHR and network core (PE-11(2))\nAlternate power keeps charting and core switching up through short utility events. Evidence labeled for PE-11(2).\n\n### Fire suppression with notice (PE-11(2))\nAutomatic detection/suppression in the computer room notifies facilities and IT command. Evidence labeled for PE-11(2).\n\n### Environmental alarms (PE-11(2))\nTemperature/humidity alarms protect disk arrays storing imaging and EHR databases. Evidence labeled for PE-11(2).

Best Practices

  • Name an owner for PE-11(2) in the SSP control matrix.\n- Favor system enforcement on ePHI paths over informal email approval.\n- Measure coverage: percent of in-scope clinical systems where the enhancement operates.\n- Review exceptions quarterly with security and clinical informatics.\n- Feed relevant events to SIEM with a named use case.\n- Keep a one-page evidence pack (config + sample log + last test) ready for assessors.

Common Gaps & Violations

  • Policy cites PE-11(2) but production EHR/network paths show no enforcement of alternate power supply — self-contained.\n- Permanent exceptions with no expiry for vendors or “special” clinics.\n- Control implemented only on corporate IT — clinical devices and interfaces omitted.\n- No logs or test records; reliance on tribal knowledge.\n- Major upgrade silently disabled the enhancement.

Required Documentation

  • Procedure/standard for Alternate Power Supply — Self-contained (PE-11(2))\n- Architecture or configuration baselines showing enforcement points\n- Exception register with owners and expiry\n- Sample logs, alerts, or test results\n- Training or runbook references for clinical/IT operators

How to Test & Validate

  1. Attempt a prohibited or out-of-policy action related to alternate power supply — self-contained; confirm block, alert, or required workflow.\n2. Complete an authorized clinical/IT path; confirm success and logging.\n3. Sample open exceptions for approval and expiry.\n4. Verify at least one EHR-adjacent and one BA/vendor path are in scope.\n5. Confirm evidence retained for the last 90 days (or per policy).

Audit Considerations

Assessors look for operating evidence of Alternate Power Supply — Self-contained on systems touching ePHI — configs, logs, restore/DR artifacts, or failed-test results — not only a policy paragraph referencing PE-11(2).

HIPAA Mapping

How this NIST control supports HIPAA Security Rule expectations.

  • 164.310(a)(1) Facility Access Controls — limit physical access to facilities with ePHI systems.\n- 164.310(b) Workstation Use — policies for workstations that access ePHI.\n- 164.310(c) Workstation Security — physical safeguards for workstations that access ePHI.\n- 164.310(d)(1) Device and Media Controls — control receipt and removal of hardware/media with ePHI.

Compliance Tips

  • List PE-11(2) explicitly in the system security plan with system inventory references.\n- Prioritize emergency department, inpatient EHR, and remote access paths first.\n- Bundle evidence with related HIPAA evaluation, integrity, or workforce-security narratives where they overlap.

References & Resources

  • NIST SP 800-53 Rev. 5 — PE-11(2)\n- Related controls: PE-11

Related Guidelines

Related controls that commonly accompany PE-11(2).

PE-11 Medium

Emergency Power

PE-11 requires employing and maintaining automatic emergency lighting for the system that activates in the event of a power outage or…
PE-1 High

Physical Protection Policy and Procedures

PE-1 requires physical and environmental protection policy and procedures addressing purpose, scope, roles, management commitment…
PE-10 Medium

Emergency Shutoff

PE-10 requires providing the capability of shutting off power to systems or individual system components in emergency situations, placing…

Need Help Implementing PE-11(2)?

Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.

Contact Our Experts View All Guidelines