Assessment Objective

Determine if:

• MA-04(05)(a) the approval of each nonlocal maintenance session is required by [Assignment: personnel or roles];
• MA-04(05)(b) [Assignment: personnel and roles] is/are notified of the date and time of planned nonlocal maintenance.

Assessment Methods

Examine

• Maintenance policy
• procedures addressing nonlocal system maintenance
• notifications supporting nonlocal maintenance sessions
• maintenance records
• audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with system maintenance responsibilities
• organizational personnel with notification responsibilities
• organizational personnel with approval responsibilities
• organizational personnel with information security responsibilities

Test

• Organizational processes for approving and notifying personnel regarding nonlocal maintenance
• mechanisms supporting the notification and approval of nonlocal maintenance

Saincheisteanna nasctha

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final