Assessment Objective
Determine if:
- MA-02a.
- MA-02a.[01] maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements;
- MA-02a.[02] maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements;
- MA-02a.[03] records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements;
- MA-02b.
- MA-02b.[01] all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved;
- MA-02b.[02] all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored;
- MA-02c. [Assignment: personnel or roles] is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
- MA-02d. equipment is sanitized to remove [Assignment: information] from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement;
- MA-02e. all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair, or replacement actions;
- MA-02f. [Assignment: information] is included in organizational maintenance records.
Assessment Methods
Examine
- Maintenance policy
- procedures addressing controlled system maintenance
- maintenance records
- manufacturer/vendor maintenance specifications
- equipment sanitization records
- media sanitization records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
- organizational personnel responsible for media sanitization
- system/network administrators
Test
- Organizational processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for the system
- organizational processes for sanitizing system components
- mechanisms supporting and/or implementing controlled maintenance
- mechanisms implementing the sanitization of system components
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | MA-02 Controlled Maintenance |