Assessment Objective

Determine if:

• the use of system maintenance tools is approved.
• the use of system maintenance tools is controlled.
• the use of system maintenance tools is monitored.
• media with diagnostic and test programs are checked for malicious code before the media are used in the system.
• the removal of system maintenance equipment containing CUI is prevented by verifying that there is no CUI on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility.

Assessment Methods

Examine

• maintenance policy and procedures
• procedures for system maintenance tools
• system maintenance tools
• maintenance tool inspection records
• equipment sanitization records
• media sanitization records
• system security plan
• other relevant documents or records

Interview

• personnel with system maintenance responsibilities
• personnel responsible for media sanitization
• personnel with information security responsibilities

Test

• processes for approving, controlling, and monitoring maintenance tools
• mechanisms for supporting or implementing the approval, control, or monitoring of maintenance tools
• processes for preventing the unauthorized removal of information
• processes for inspecting media for malicious code
• mechanisms for supporting media sanitization or the destruction of equipment
• mechanisms for supporting the verification of media sanitization
• processes for inspecting maintenance tools
• mechanisms for supporting or implementing the inspection of maintenance tools
• mechanisms for supporting or implementing the inspection of media used for maintenance

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final