Assessment Objective
Determine if:
- MA-05a.
- MA-05a.[01] a process for maintenance personnel authorization is established;
- MA-05a.[02] a list of authorized maintenance organizations or personnel is maintained;
- MA-05b. non-escorted personnel performing maintenance on the system possess the required access authorizations;
- MA-05c. organizational personnel with required access authorizations and technical competence is/are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.
Assessment Methods
Examine
- Maintenance policy
- procedures addressing maintenance personnel
- service provider contracts
- service-level agreements
- list of authorized personnel
- maintenance records
- access control records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes for authorizing and managing maintenance personnel
- mechanisms supporting and/or implementing authorization of maintenance personnel
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | MA-05 [M] Maintenance Personnel |