# Place access-control components away from hazards and public reach > NIST PE-18 calls for positioning system components to reduce physical and environmental hazards and unauthorized access. Apply that lens to PACS panels, power, and interfaces. - Canonical URL: https://update.dsesecurity.com/updates/place-access-control-components-away-from-hazards-and-public-reach/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-08-25T21:35:43+00:00 - Modified: 2026-08-25T21:36:17+00:00 - Last reviewed by DSE: 2026-08-25 - Resource type: Checklist - DSE priority: Important - Topics: Access Control, Business Continuity, Cybersecurity - Reading time: 2 minutes ## What you need to know NIST PE-18 calls for positioning system components to reduce physical and environmental hazards and unauthorized access. Apply that lens to PACS panels, power, and interfaces. ## Potentially affected Access-control panels, power supplies, network switches, interfaces, door controllers, enrollment stations, and service ports installed in exposed or hazardous locations. ## DSE recommendation Survey component placement for public reach, water, heat, impact, service access, and utility hazards, then relocate or protect equipment using approved design and change control. ## Article Bottom line: a locked controller cabinet can still be poorly placed. Water piping, public ceilings, vehicle impact, heat, dust, shared tenant space, or an accessible disconnect can defeat availability or allow tampering before a door alarm is ever generated. ## Source fact: NIST addresses component location as a protection decision PE-18 in [NIST SP 800-53 Release 5.2.0](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_2_0/home?element=PE-18) calls for positioning system components within a facility to minimize potential damage from physical and environmental hazards and to minimize opportunities for unauthorized access. The control is broad enough to include computing and supporting components, not merely user workstations. Applied to PACS, placement affects both security and continuity. A controller above a publicly accessible ceiling, below a leak source, or beside an unprotected power cutoff can convert a local condition into multiple uncontrolled doors. ## Source boundary and applicability NIST SP 800-53 is a control catalog. Whether PE-18 is mandatory, selected, tailored, or used as guidance depends on the organization’s authorization framework, contract, regulation, and system boundary. It does not provide a universal mounting location, enclosure rating, flood elevation, fire requirement, or code approval. Qualified design disciplines and local requirements remain necessary. ## Applicability questions - Which doors and functions fail if this panel, power supply, switch, or interface is damaged? - Can the public, tenants, vendors, or unescorted staff reach the equipment or its cables? - Are water, condensation, temperature, dust, vibration, impact, or electromagnetic hazards present? - Is service access safe, observable, and possible without defeating another control? - Do enclosure, battery, ventilation, fire, and accessibility requirements constrain relocation? ## DSE recommendation: add placement risk to panel acceptance The following steps are DSE recommendations based on the cited source. Create an inventory with component location, controlled doors, power and network dependencies, enclosure, access population, environmental conditions, nearby utilities, and failure consequence. Inspect above and below the equipment, trace accessible cable and disconnect paths, and consider credible maintenance and building events. Rank deficiencies by the number and importance of affected openings. Use relocation, rated enclosure, barriers, leak protection, protected power, tamper monitoring, or procedural control only after responsible facilities, security, electrical, fire, and accessibility owners approve the design. Do not place batteries or energized equipment in a sealed or unlisted arrangement. ## Verification and evidence Retain the component inventory, sanitized plans, photographs, environmental and access observations, manufacturer installation requirements, approved risk treatment, change ticket, tamper and power-loss tests, and inspection cadence. Reassess after renovations, tenant changes, utility work, leaks, impacts, or repeated faults. ## Official references - [NIST SP 800-53 Release 5.2.0, PE-18 — Location of System Components](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_2_0/home?element=PE-18) – National Institute of Standards and Technology; released August 27, 2025 ## Primary reference - Name: NIST SP 800-53 Release 5.2.0, PE-18 — Location of System Components - Authority: National Institute of Standards and Technology - URL: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_2_0/home?element=PE-18 - Source publication date: 2025-08-27 ## Citation and use Preferred citation: “Place access-control components away from hazards and public reach,” DSE Security, https://update.dsesecurity.com/updates/place-access-control-components-away-from-hazards-and-public-reach/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.