03.07.06 Maintenance Personnel

Statement

• a. Establish a process for maintenance personnel authorization.

• b. Maintain a list of authorized maintenance organizations or personnel.

• c. Verify that non-escorted personnel who perform maintenance on the system possess the required access authorizations.

• d. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Guidance

Maintenance personnel refers to individuals who perform hardware or software maintenance on the system, while [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.10.01)03.10.01 addresses physical access for individuals whose maintenance duties place them within the physical protection perimeter of the system. The technical competence of supervising individuals relates to the maintenance performed on the system, while having required access authorizations refers to maintenance on and near the system. Individuals who have not been previously identified as authorized maintenance personnel (e.g., manufacturers, consultants, systems integrators, and vendors) may require privileged access to the system, such as when they are required to conduct maintenance with little or no notice. Organizations may choose to issue temporary credentials to these individuals based on their risk assessments. Temporary credentials may be for one-time use or for very limited time periods.

Assessment objective

a process for maintenance personnel authorization is established.

Assessment objective

a list of authorized maintenance organizations or personnel is maintained.

Assessment objective

organizational personnel with required access authorizations are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Assessment objective

organizational personnel with required technical competence are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Assessment objective

non-escorted personnel who perform maintenance on the system possess the required access authorizations.

Assessment method

• maintenance policy and procedures service provider contracts service-level agreements list of authorized personnel maintenance records access control records system security plan other relevant documents or records

Assessment method

• personnel with system maintenance responsibilities personnel with information security responsibilities

Assessment method

• processes for authorizing and managing maintenance personnel mechanisms for supporting or implementing the authorization of maintenance personnel

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final