MA – Maintenance

NIST SP 800-53B – MA – Maintenance

1.Kravtext (engelskt original)#

MA-1 – Policy and Procedures#

• a. Develop, document, and disseminate to [organization-defined personnel or roles]:
  • 1. [organization-level or mission/business process-level or system-level] maintenance policy that:
    • (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    • (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
  • 2. Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;
• b. Designate an [organization-defined official] to manage the development, documentation, and dissemination of the maintenance policy and procedures; and
• c. Review and update the current maintenance:
  • 1. Policy [organization-defined frequency] and following [organization-defined events] ; and
  • 2. Procedures [organization-defined frequency] and following [organization-defined events].

MA-2 – Controlled Maintenance#

• a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
• b. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
• c. Require that [organization-defined personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
• d. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [organization-defined information];
• e. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
• f. Include the following information in organizational maintenance records: [organization-defined information].

MA-3 – Maintenance Tools#

• a. Approve, control, and monitor the use of system maintenance tools; and
• b. Review previously approved system maintenance tools [organization-defined frequency].

MA-3(1) – Inspect Tools

Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.

MA-3(2) – Inspect Media

Check media containing diagnostic and test programs for malicious code before the media are used in the system.

MA-3(3) – Prevent Unauthorized Removal

Prevent the removal of maintenance equipment containing organizational information by:

• (a) Verifying that there is no organizational information contained on the equipment;
• (b) Sanitizing or destroying the equipment;
• (c) Retaining the equipment within the facility; or
• (d) Obtaining an exemption from [organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility.

MA-4 – Nonlocal Maintenance#

• a. Approve and monitor nonlocal maintenance and diagnostic activities;
• b. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;
• c. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;
• d. Maintain records for nonlocal maintenance and diagnostic activities; and
• e. Terminate session and network connections when nonlocal maintenance is completed.

MA-5 – Maintenance Personnel#

• a. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
• b. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and
• c. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

MA-6 – Timely Maintenance#

Obtain maintenance support and/or spare parts for [organization-defined system components] within [organization-defined time period] of failure.

National Institute of Standards and Technology, OSCAL release 5.2.0. Republished courtesy of the National Institute of Standards and Technology. CC0 1.0. Source.