+MA-03 Maintenance Tools
---+MA-03(01) Inspect Tools
---+MA-03(02) Inspect Media
---+MA-03(03) Prevent Unauthorized Removal
---+MA-03(04) Restricted Tool Use
---+MA-03(05) Execution with Privilege
---+MA-03(06) Software Updates and Patches

MA-03 Maintenance Tools

Control

Approve, control, and monitor the use of system maintenance tools; and
Review previously approved system maintenance tools [Assignement: frequency].

Discussion

Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues associated with maintenance tools that are not within system authorization boundaries and are used specifically for diagnostic and repair actions on organizational systems. Organizations have flexibility in determining roles for the approval of maintenance tools and how that approval is documented. A periodic review of maintenance tools facilitates the withdrawal of approval for outdated, unsupported, irrelevant, or no-longer-used tools. Maintenance tools can include hardware, software, and firmware items and may be pre-installed, brought in with maintenance personnel on media, cloud-based, or downloaded from a website. Such tools can be vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and subsequently into systems. Maintenance tools can include hardware and software diagnostic test equipment and packet sniffers. The hardware and software components that support maintenance and are a part of the system (including the software implementing utilities such as "ping," "ls," "ipconfig," or the hardware and software implementing the monitoring port of an Ethernet switch) are not addressed by maintenance tools.

Assessment Objective

1. the use of system maintenance tools is approved;
2. the use of system maintenance tools is controlled;
3. the use of system maintenance tools is monitored;
previously approved system maintenance tools are reviewed [Assignement: frequency].

Assessment Method

Examine

Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation maintenance records system security plan other relevant documents or records

Interview

Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities

1. Visão geral

Título	Norma
MA-03(01) Inspect Tools	Control Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications. Discussion Maintenance tools can be directly brought into a facility by maintenance personnel or downloaded from a vendor’s website. If, upon inspection of the maintenance tools, organizations determine that the tools have been modified in an improper manner or the tools contain malicious code, the incident is handled consistent with organizational policies and procedures for incident handling. Assessment Objective maintenance tools used by maintenance personnel are inspected for improper or unauthorized modifications. Assessment Method Examine Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation maintenance tool inspection records maintenance records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities
MA-03(02) Inspect Media	Control Check media containing diagnostic and test programs for malicious code before the media are used in the system. Discussion If, upon inspection of media containing maintenance, diagnostic, and test programs, organizations determine that the media contains malicious code, the incident is handled consistent with organizational incident handling policies and procedures. Assessment Objective media containing diagnostic and test programs are checked for malicious code before the media are used in the system. Assessment Method Examine Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation maintenance records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities
MA-03(03) Prevent Unauthorized Removal	Control Prevent the removal of maintenance equipment containing organizational information by: Verifying that there is no organizational information contained on the equipment; Sanitizing or destroying the equipment; Retaining the equipment within the facility; or Obtaining an exemption from [Assignement: personnel or roles] explicitly authorizing removal of the equipment from the facility. Discussion Organizational information includes all information owned by organizations and any information provided to organizations for which the organizations serve as information stewards. Assessment Objective the removal of maintenance equipment containing organizational information is prevented by verifying that there is no organizational information contained on the equipment; or the removal of maintenance equipment containing organizational information is prevented by sanitizing or destroying the equipment; or the removal of maintenance equipment containing organizational information is prevented by retaining the equipment within the facility; or the removal of maintenance equipment containing organizational information is prevented by obtaining an exemption from [Assignement: personnel or roles] explicitly authorizing removal of the equipment from the facility. Assessment Method Examine Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation maintenance records equipment sanitization records media sanitization records exemptions for equipment removal system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities organizational personnel responsible for media sanitization
MA-03(04) Restricted Tool Use	Control Restrict the use of maintenance tools to authorized personnel only. Discussion Restricting the use of maintenance tools to only authorized personnel applies to systems that are used to carry out maintenance functions. Assessment Objective the use of maintenance tools is restricted to authorized personnel only. Assessment Method Examine Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation list of personnel authorized to use maintenance tools maintenance tool usage records maintenance records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities
MA-03(05) Execution with Privilege	Control Monitor the use of maintenance tools that execute with increased privilege. Discussion Maintenance tools that execute with increased system privilege can result in unauthorized access to organizational information and assets that would otherwise be inaccessible. Assessment Objective the use of maintenance tools that execute with increased privilege is monitored. Assessment Method Examine Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation list of personnel authorized to use maintenance tools maintenance tool usage records maintenance records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities
MA-03(06) Software Updates and Patches	Control Inspect maintenance tools to ensure the latest software updates and patches are installed. Discussion Maintenance tools using outdated and/or unpatched software can provide a threat vector for adversaries and result in a significant vulnerability for organizations. Assessment Objective maintenance tools are inspected to ensure that the latest software updates and patches are installed. Assessment Method Examine Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation list of personnel authorized to use maintenance tools maintenance tool usage records maintenance records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

Requisitos
Fonte	Requisito

3. Regulamentos relacionados

Regulamentos
Fonte	Regulamentação

Pedidos ligados

Ligações
Tipo de ligação	Pedido
is blocked by	MA-03 Maintenance Tools – Assessment Procedure
is blocked by	Maintenance Tools

NIST -
https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final