Assessment Objective
Determine if:
- MA-04(01)(a)
- MA-04(01)(a)[01] [Assignment: audit events] are logged for nonlocal maintenance sessions;
- MA-04(01)(a)[02] [Assignment: audit events] are logged for nonlocal diagnostic sessions;
- MA-04(01)(b)
- MA-04(01)(b)[01] the audit records of the maintenance sessions are reviewed to detect anomalous behavior;
- MA-04(01)(b)[02] the audit records of the diagnostic sessions are reviewed to detect anomalous behavior.
Assessment Methods
Examine
- Maintenance policy
- procedures addressing nonlocal system maintenance
- list of audit events
- system configuration settings and associated documentation
- maintenance records
- diagnostic records
- audit records
- reviews of maintenance and diagnostic session records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with audit and review responsibilities
- system/network administrators
Test
- Organizational processes for audit and review of nonlocal maintenance
- mechanisms supporting and/or implementing audit and review of nonlocal maintenance
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | MA-04(01) Logging and Review |