+MA [H] Maintenance
---+MA-01 [H] Policy and Procedures
---+MA-02 [H] Controlled Maintenance
------+MA-02(02) [H] Automated Maintenance Activities
---+MA-03 [H] Maintenance Tools
------+MA-03(01) [H] Inspect Tools
------+MA-03(02) [H] Inspect Media
------+MA-03(03) [H] Prevent Unauthorized Removal
---+MA-04 [H] Nonlocal Maintenance
------+MA-04(03) [H] Comparable Security and Sanitization
---+MA-05 [H] Maintenance Personnel
------+MA-05(01) [H] Individuals Without Appropriate Access
---+MA-06 [H] Timely Maintenance

MA [H] Maintenance

Maintenance

1. Pregled

MA-01 [H] Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the maintenance policy and procedures; and
  3. Review and update the current maintenance:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Maintenance policy and procedures address the controls in the MA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of maintenance policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to maintenance policy and procedures assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a maintenance policy is developed and documented;
    2. the maintenance policy is disseminated to [Assignement: personnel or roles];
    3. maintenance procedures to facilitate the implementation of the maintenance policy and associated maintenance controls are developed and documented;
    4. the maintenance procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures;
      1. the current maintenance policy is reviewed and updated [Assignement: frequency];
      2. the current maintenance policy is reviewed and updated following [Assignement: events];
      1. the current maintenance procedures are reviewed and updated [Assignement: frequency];
      2. the current maintenance procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Maintenance policy and procedures system security plan privacy plan organizational risk management strategy other relevant documents or records

Interview

Organizational personnel with maintenance responsibilities organizational personnel with information security and privacy responsibilities
MA-02 [H] Controlled Maintenance

Control

  1. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
  2. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
  3. Require that [Assignement: personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
  4. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignement: information];
  5. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
  6. Include the following information in organizational maintenance records: [Assignement: information].

Discussion

Controlling system maintenance addresses the information security aspects of the system maintenance program and applies to all types of maintenance to system components conducted by local or nonlocal entities. Maintenance includes peripherals such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes the date and time of maintenance, a description of the maintenance performed, names of the individuals or group performing the maintenance, name of the escort, and system components or equipment that are removed or replaced. Organizations consider supply chain-related risks associated with replacement components for systems.

Assessment Objective

    1. maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements;
    2. maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements;
    3. records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements;
    1. all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved;
    2. all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored;
  3. [Assignement: personnel or roles] is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
  4. equipment is sanitized to remove [Assignement: information] from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement;
  5. all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair, or replacement actions;
  6. [Assignement: information] is included in organizational maintenance records.

Assessment Method

Examine

Maintenance policy procedures addressing controlled system maintenance maintenance records manufacturer/vendor maintenance specifications equipment sanitization records media sanitization records system security plan other relevant documents or records

Interview

Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities organizational personnel responsible for media sanitization system/network administrators
MA-03 [H] Maintenance Tools

Control

  1. Approve, control, and monitor the use of system maintenance tools; and
  2. Review previously approved system maintenance tools [Assignement: frequency].

Discussion

Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues associated with maintenance tools that are not within system authorization boundaries and are used specifically for diagnostic and repair actions on organizational systems. Organizations have flexibility in determining roles for the approval of maintenance tools and how that approval is documented. A periodic review of maintenance tools facilitates the withdrawal of approval for outdated, unsupported, irrelevant, or no-longer-used tools. Maintenance tools can include hardware, software, and firmware items and may be pre-installed, brought in with maintenance personnel on media, cloud-based, or downloaded from a website. Such tools can be vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and subsequently into systems. Maintenance tools can include hardware and software diagnostic test equipment and packet sniffers. The hardware and software components that support maintenance and are a part of the system (including the software implementing utilities such as "ping," "ls," "ipconfig," or the hardware and software implementing the monitoring port of an Ethernet switch) are not addressed by maintenance tools.

Assessment Objective

    1. the use of system maintenance tools is approved;
    2. the use of system maintenance tools is controlled;
    3. the use of system maintenance tools is monitored;
  2. previously approved system maintenance tools are reviewed [Assignement: frequency].

Assessment Method

Examine

Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation maintenance records system security plan other relevant documents or records

Interview

Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities
MA-04 [H] Nonlocal Maintenance

Control

  1. Approve and monitor nonlocal maintenance and diagnostic activities;
  2. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;
  3. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;
  4. Maintain records for nonlocal maintenance and diagnostic activities; and
  5. Terminate session and network connections when nonlocal maintenance is completed.

Discussion

Nonlocal maintenance and diagnostic activities are conducted by individuals who communicate through either an external or internal network. Local maintenance and diagnostic activities are carried out by individuals who are physically present at the system location and not communicating across a network connection. Authentication techniques used to establish nonlocal maintenance and diagnostic sessions reflect the network access requirements in [IA-2](#ia-2) . Strong authentication requires authenticators that are resistant to replay attacks and employ multi-factor authentication. Strong authenticators include PKI where certificates are stored on a token protected by a password, passphrase, or biometric. Enforcing requirements in [MA-4](#ma-4) is accomplished, in part, by other controls. [SP 800-63B](#e59c5a7c-8b1f-49ca-8de0-6ee0882180ce) provides additional guidance on strong authentication and authenticators.

Assessment Objective

    1. nonlocal maintenance and diagnostic activities are approved;
    2. nonlocal maintenance and diagnostic activities are monitored;
    1. the use of nonlocal maintenance and diagnostic tools are allowed only as consistent with organizational policy;
    2. the use of nonlocal maintenance and diagnostic tools are documented in the security plan for the system;
  3. strong authentication is employed in the establishment of nonlocal maintenance and diagnostic sessions;
  4. records for nonlocal maintenance and diagnostic activities are maintained;
    1. session connections are terminated when nonlocal maintenance is completed;
    2. network connections are terminated when nonlocal maintenance is completed.

Assessment Method

Examine

Maintenance policy procedures addressing nonlocal system maintenance remote access policy remote access procedures system design documentation system configuration settings and associated documentation maintenance records records of remote access diagnostic records system security plan other relevant documents or records

Interview

Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities system/network administrators
MA-05 [H] Maintenance Personnel

Control

  1. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
  2. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and
  3. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Discussion

Maintenance personnel refers to individuals who perform hardware or software maintenance on organizational systems, while [PE-2](#pe-2) addresses physical access for individuals whose maintenance duties place them within the physical protection perimeter of the systems. Technical competence of supervising individuals relates to the maintenance performed on the systems, while having required access authorizations refers to maintenance on and near the systems. Individuals not previously identified as authorized maintenance personnel—such as information technology manufacturers, vendors, systems integrators, and consultants—may require privileged access to organizational systems, such as when they are required to conduct maintenance activities with little or no notice. Based on organizational assessments of risk, organizations may issue temporary credentials to these individuals. Temporary credentials may be for one-time use or for very limited time periods.

Assessment Objective

    1. a process for maintenance personnel authorization is established;
    2. a list of authorized maintenance organizations or personnel is maintained;
  2. non-escorted personnel performing maintenance on the system possess the required access authorizations;
  3. organizational personnel with required access authorizations and technical competence is/are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Assessment Method

Examine

Maintenance policy procedures addressing maintenance personnel service provider contracts service-level agreements list of authorized personnel maintenance records access control records system security plan other relevant documents or records

Interview

Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities
MA-06 [H] Timely Maintenance

Control

Obtain maintenance support and/or spare parts for [Assignement: system components] within [Assignement: time period] of failure.

Discussion

Organizations specify the system components that result in increased risk to organizational operations and assets, individuals, other organizations, or the Nation when the functionality provided by those components is not operational. Organizational actions to obtain maintenance support include having appropriate contracts in place.

Assessment Objective

maintenance support and/or spare parts are obtained for [Assignement: system components] within [Assignement: time period] of failure.

Assessment Method

Examine

Maintenance policy procedures addressing system maintenance service provider contracts service-level agreements inventory and availability of spare parts system security plan other relevant documents or records

Interview

Organizational personnel with system maintenance responsibilities organizational personnel with acquisition responsibilities organizational personnel with information security responsibilities system/network administrators

1.1 Reference

1.2 Utvrđeni zahtjevi

1.3 Povezani propisi

2. Utvrđeni zahtjevi

Zahtjevi

3. Povezani propisi

Propisi