Control statement
Provide an uninterruptible power supply to facilitate [Organization-defined: pe-11_odp] in the event of a primary power source loss.
Discussion
An uninterruptible power supply (UPS) is an electrical system or mechanism that provides emergency power when there is a failure of the main power source. A UPS is typically used to protect computers, data centers, telecommunication equipment, or other electrical equipment where an unexpected power disruption could cause injuries, fatalities, serious mission or business disruption, or loss of data or information. A UPS differs from an emergency power system or backup generator in that the UPS provides near-instantaneous protection from unanticipated power interruptions from the main power source by providing energy stored in batteries, supercapacitors, or flywheels. The battery duration of a UPS is relatively short but provides sufficient time to start a standby power source, such as a backup generator, or properly shut down the system.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Emergency Power as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to physical access, facility protection, environmental safeguards, and visitor accountability.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- badge and visitor logs
- physical access reviews
- facility diagrams and sensor records
- environmental and power test results
Common failure patterns
- logical security assumptions invalidated by physical access
- tailgating and visitor exceptions normalized
- critical infrastructure not included in access reviews
- environmental alarms not integrated into response
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
an uninterruptible power supply is provided to facilitate [Organization-defined: pe-11_odp] in the event of a primary power source loss.
Examine
- Physical and environmental protection policy
- procedures addressing emergency power
- uninterruptible power supply
- uninterruptible power supply documentation
- uninterruptible power supply test records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with the responsibility for emergency power and/or planning
- organizational personnel with information security responsibilities
Test
- Mechanisms supporting and/or implementing an uninterruptible power supply
- the uninterruptable power supply
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
PE-11(1) — Alternate Power Supply — Minimal Operational Capability
Provide an alternate power supply for the system that is activated [Organization-defined: pe-11.01_odp] and that can maintain minimally required operational capability in the event of an extended loss of the primary power source.
Official discussion
Provision of an alternate power supply with minimal operating capability can be satisfied by accessing a secondary commercial power supply or other external power supply.
Organization-defined parameters (1)
Assessment objectives and methods
- PE-11(01)[01]an alternate power supply provided for the system is activated [Organization-defined: pe-11.01_odp];
- PE-11(01)[02]the alternate power supply provided for the system can maintain minimally required operational capability in the event of an extended loss of the primary power source.
Examine
- Physical and environmental protection policy
- procedures addressing emergency power
- alternate power supply
- alternate power supply documentation
- alternate power supply test records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with the responsibility for emergency power and/or planning
- organizational personnel with information security responsibilities
Test
- Mechanisms supporting and/or implementing an alternate power supply
- the alternate power supply
PE-11(2) — Alternate Power Supply — Self-contained
Provide an alternate power supply for the system that is activated [Organization-defined: pe-11.02_odp.01] and that is:
- (a)Self-contained;
- (b)Not reliant on external power generation; and
- (c)Capable of maintaining [Organization-defined: pe-11.02_odp.02] in the event of an extended loss of the primary power source.
Official discussion
The provision of a long-term, self-contained power supply can be satisfied by using one or more generators with sufficient capacity to meet the needs of the organization.
Organization-defined parameters (2)
Assessment objectives and methods
an alternate power supply provided for the system is activated [Organization-defined: pe-11.02_odp.01];
- PE-11(02)(a)the alternate power supply provided for the system is self-contained;
- PE-11(02)(b)the alternate power supply provided for the system is not reliant on external power generation;
- PE-11(02)(c)the alternate power supply provided for the system is capable of maintaining [Organization-defined: pe-11.02_odp.02] in the event of an extended loss of the primary power source.
Examine
- Physical and environmental protection policy
- procedures addressing emergency power
- alternate power supply
- alternate power supply documentation
- alternate power supply test records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with the responsibility for emergency power and/or planning
- organizational personnel with information security responsibilities
Test
- Mechanisms supporting and/or implementing an alternate power supply
- the alternate power supply
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.