+MA [L] Maintenance
---+MA-01 [L] Policy and Procedures
---+MA-02 [L] Controlled Maintenance
---+MA-04 [L] Nonlocal Maintenance
---+MA-05 [L] Maintenance Personnel

MA [L] Maintenance

Maintenance

1. Apžvalga

MA-01 [L] Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the maintenance policy and procedures; and
  3. Review and update the current maintenance:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Maintenance policy and procedures address the controls in the MA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of maintenance policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to maintenance policy and procedures assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a maintenance policy is developed and documented;
    2. the maintenance policy is disseminated to [Assignement: personnel or roles];
    3. maintenance procedures to facilitate the implementation of the maintenance policy and associated maintenance controls are developed and documented;
    4. the maintenance procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] maintenance policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures;
      1. the current maintenance policy is reviewed and updated [Assignement: frequency];
      2. the current maintenance policy is reviewed and updated following [Assignement: events];
      1. the current maintenance procedures are reviewed and updated [Assignement: frequency];
      2. the current maintenance procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Maintenance policy and procedures system security plan privacy plan organizational risk management strategy other relevant documents or records

Interview

Organizational personnel with maintenance responsibilities organizational personnel with information security and privacy responsibilities
MA-02 [L] Controlled Maintenance

Control

  1. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
  2. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
  3. Require that [Assignement: personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
  4. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignement: information];
  5. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
  6. Include the following information in organizational maintenance records: [Assignement: information].

Discussion

Controlling system maintenance addresses the information security aspects of the system maintenance program and applies to all types of maintenance to system components conducted by local or nonlocal entities. Maintenance includes peripherals such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes the date and time of maintenance, a description of the maintenance performed, names of the individuals or group performing the maintenance, name of the escort, and system components or equipment that are removed or replaced. Organizations consider supply chain-related risks associated with replacement components for systems.

Assessment Objective

    1. maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements;
    2. maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements;
    3. records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements;
    1. all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved;
    2. all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored;
  3. [Assignement: personnel or roles] is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
  4. equipment is sanitized to remove [Assignement: information] from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement;
  5. all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair, or replacement actions;
  6. [Assignement: information] is included in organizational maintenance records.

Assessment Method

Examine

Maintenance policy procedures addressing controlled system maintenance maintenance records manufacturer/vendor maintenance specifications equipment sanitization records media sanitization records system security plan other relevant documents or records

Interview

Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities organizational personnel responsible for media sanitization system/network administrators
MA-04 [L] Nonlocal Maintenance

Control

  1. Approve and monitor nonlocal maintenance and diagnostic activities;
  2. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;
  3. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;
  4. Maintain records for nonlocal maintenance and diagnostic activities; and
  5. Terminate session and network connections when nonlocal maintenance is completed.

Discussion

Nonlocal maintenance and diagnostic activities are conducted by individuals who communicate through either an external or internal network. Local maintenance and diagnostic activities are carried out by individuals who are physically present at the system location and not communicating across a network connection. Authentication techniques used to establish nonlocal maintenance and diagnostic sessions reflect the network access requirements in [IA-2](#ia-2) . Strong authentication requires authenticators that are resistant to replay attacks and employ multi-factor authentication. Strong authenticators include PKI where certificates are stored on a token protected by a password, passphrase, or biometric. Enforcing requirements in [MA-4](#ma-4) is accomplished, in part, by other controls. [SP 800-63B](#e59c5a7c-8b1f-49ca-8de0-6ee0882180ce) provides additional guidance on strong authentication and authenticators.

Assessment Objective

    1. nonlocal maintenance and diagnostic activities are approved;
    2. nonlocal maintenance and diagnostic activities are monitored;
    1. the use of nonlocal maintenance and diagnostic tools are allowed only as consistent with organizational policy;
    2. the use of nonlocal maintenance and diagnostic tools are documented in the security plan for the system;
  3. strong authentication is employed in the establishment of nonlocal maintenance and diagnostic sessions;
  4. records for nonlocal maintenance and diagnostic activities are maintained;
    1. session connections are terminated when nonlocal maintenance is completed;
    2. network connections are terminated when nonlocal maintenance is completed.

Assessment Method

Examine

Maintenance policy procedures addressing nonlocal system maintenance remote access policy remote access procedures system design documentation system configuration settings and associated documentation maintenance records records of remote access diagnostic records system security plan other relevant documents or records

Interview

Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities system/network administrators
MA-05 [L] Maintenance Personnel

Control

  1. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
  2. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and
  3. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Discussion

Maintenance personnel refers to individuals who perform hardware or software maintenance on organizational systems, while [PE-2](#pe-2) addresses physical access for individuals whose maintenance duties place them within the physical protection perimeter of the systems. Technical competence of supervising individuals relates to the maintenance performed on the systems, while having required access authorizations refers to maintenance on and near the systems. Individuals not previously identified as authorized maintenance personnel—such as information technology manufacturers, vendors, systems integrators, and consultants—may require privileged access to organizational systems, such as when they are required to conduct maintenance activities with little or no notice. Based on organizational assessments of risk, organizations may issue temporary credentials to these individuals. Temporary credentials may be for one-time use or for very limited time periods.

Assessment Objective

    1. a process for maintenance personnel authorization is established;
    2. a list of authorized maintenance organizations or personnel is maintained;
  2. non-escorted personnel performing maintenance on the system possess the required access authorizations;
  3. organizational personnel with required access authorizations and technical competence is/are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Assessment Method

Examine

Maintenance policy procedures addressing maintenance personnel service provider contracts service-level agreements list of authorized personnel maintenance records access control records system security plan other relevant documents or records

Interview

Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai

3. Susiję teisės aktai

Teisės aktai