Assessment Objective
Determine if:
- MA-04(03)(a)
- MA-04(03)(a)[01] nonlocal maintenance services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced;
- MA-04(03)(a)[02] nonlocal diagnostic services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; or
- MA-04(03)(b)
- MA-04(03)(b)[01] the component to be serviced is removed from the system prior to nonlocal maintenance or diagnostic services;
- MA-04(03)(b)[02] the component to be serviced is sanitized (for organizational information);
- MA-04(03)(b)[03] the component is inspected and sanitized (for potentially malicious software) after the service is performed and before reconnecting the component to the system.
Assessment Methods
Examine
- Maintenance policy
- procedures addressing nonlocal system maintenance
- service provider contracts and/or service-level agreements
- maintenance records
- inspection records
- audit records
- equipment sanitization records
- media sanitization records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- system maintenance provider
- organizational personnel with information security responsibilities
- organizational personnel responsible for media sanitization
- system/network administrators
Test
- Organizational processes for comparable security and sanitization for nonlocal maintenance
- organizational processes for the removal, sanitization, and inspection of components serviced via nonlocal maintenance
- mechanisms supporting and/or implementing component sanitization and inspection
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | MA-04(03) [H] Comparable Security and Sanitization |