Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• MNT-09_A01 personnel or roles who can authorize removal of equipment from the facility is/are defined.
  Defined parameters: the information owner
  Assessment rigor: 1
  Origin: 53A_R5_MA-03(03)_ODP
• MNT-09_A02 the removal of system maintenance equipment containing sensitive / regulated data is prevented by verifying that there is no sensitive / regulated data on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility.
  Assessment rigor: 1
  Origin: 53A_R5_MA-03(03)(a)
• MNT-09_A03 the removal of maintenance equipment containing organizational information is prevented by sanitizing or destroying the equipment.
  Assessment rigor: 1
  Origin: 53A_R5_MA-03(03)(b)
• MNT-09_A04 the removal of maintenance equipment containing organizational information is prevented by retaining the equipment within the facility.
  Assessment rigor: 1
  Origin: 53A_R5_MA-03(03)(c)
• MNT-09_A05 the removal of maintenance equipment containing organizational information is prevented by obtaining an exemption from personnel or roles explicitly authorizing removal of the equipment from the facility.
  Defined parameters: the information owner
  Assessment rigor: 1
  Origin: 53A_R5_MA-03(03)(d)
• MNT-09_A06 the removal of system maintenance equipment containing CUI is prevented by verifying that there is no CUI on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.07.04.c

Povezani zadaci

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.