3.7 Maintenance

Statement

Inspect maintenance tools to ensure the latest software updates and patches are installed.

Guidance

Maintenance tools using outdated and/or unpatched software can provide a threat vector for adversaries and result in a significant vulnerability for organizations. This requirement enhances SP 800-171 requirement 03.07.04.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

Assessment objective

maintenance tools are inspected to ensure that the latest software updates and patches are installed.

Assessment method

• Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation list of personnel authorized to use maintenance tools maintenance tool usage records maintenance records system security plan other relevant documents or records

Assessment method

• Personnel with system maintenance responsibilities personnel with information security responsibilities

Assessment method

• Processes for inspecting maintenance tools processes for maintenance tool updates mechanisms supporting and/or implementing the inspection of maintenance tools mechanisms supporting and/or implementing maintenance tool updates