NIST SP 800-53 (controls) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| MA-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy that: (a) Addresses purpose, s | |
| MA-02 | Controlled Maintenance | a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b. Approve and monitor all maintenance activ | |
| MA-02(01) in MA-2 |
Record Content withdrawn | ||
| MA-02(02) in MA-2 |
Automated Maintenance Activities | (a) Schedule, conduct, and document maintenance, repair, and replacement actions for the system using [Assignment: organization-defined automated mechanisms] ; and (b) Produce up-to date, accurate, and complete records of all maintenance, r | |
| MA-03 | Maintenance Tools | a. Approve, control, and monitor the use of system maintenance tools; and b. Review previously approved system maintenance tools [Assignment: frequency]. | |
| MA-03(01) in MA-3 |
Inspect Tools | Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications. | |
| MA-03(02) in MA-3 |
Inspect Media | Check media containing diagnostic and test programs for malicious code before the media are used in the system. | |
| MA-03(03) in MA-3 |
Prevent Unauthorized Removal | Prevent the removal of maintenance equipment containing organizational information by: (a) Verifying that there is no organizational information contained on the equipment; (b) Sanitizing or destroying the equipment; (c) Retaining the equip | |
| MA-03(04) in MA-3 |
Restricted Tool Use | Restrict the use of maintenance tools to authorized personnel only. | |
| MA-03(05) in MA-3 |
Execution with Privilege | Monitor the use of maintenance tools that execute with increased privilege. | |
| MA-03(06) in MA-3 |
Software Updates and Patches | Inspect maintenance tools to ensure the latest software updates and patches are installed. | |
| MA-04 | Nonlocal Maintenance | a. Approve and monitor nonlocal maintenance and diagnostic activities; b. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system; c. Employ | |
| MA-04(01) in MA-4 |
Logging and Review | (a) Log [Assignment: organization-defined audit events] for nonlocal maintenance and diagnostic sessions; and (b) Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior. | |
| MA-04(02) in MA-4 |
Document Nonlocal Maintenance withdrawn | ||
| MA-04(03) in MA-4 |
Comparable Security and Sanitization | (a) Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; or (b) Remove the component to be serviced | |
| MA-04(04) in MA-4 |
Authentication and Separation of Maintenance Sessions | Protect nonlocal maintenance sessions by: (a) Employing [Assignment: authenticators that are replay resistant] ; and (b) Separating the maintenance sessions from other network sessions with the system by either: (1) Physically separated com | |
| MA-04(05) in MA-4 |
Approvals and Notifications | (a) Require the approval of each nonlocal maintenance session by [Assignment: personnel or roles] ; and (b) Notify the following personnel or roles of the date and time of planned nonlocal maintenance: [Assignment: personnel and roles]. | |
| MA-04(06) in MA-4 |
Cryptographic Protection | Implement the following cryptographic mechanisms to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications: [Assignment: cryptographic mechanisms]. | |
| MA-04(07) in MA-4 |
Disconnect Verification | Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions. | |
| MA-05 | Maintenance Personnel | a. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel; b. Verify that non-escorted personnel performing maintenance on the system possess the required access | |
| MA-05(01) in MA-5 |
Individuals Without Appropriate Access | (a) Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements: (1) Maintenance personnel who do not have needed access authorization | |
| MA-05(02) in MA-5 |
Security Clearances for Classified Systems | Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification l | |
| MA-05(03) in MA-5 |
Citizenship Requirements for Classified Systems | Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens. | |
| MA-05(04) in MA-5 |
Foreign Nationals | Ensure that: (a) Foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by the United States and foreign al | |
| MA-05(05) in MA-5 |
Non-system Maintenance | Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorizations. | |
| MA-06 | Timely Maintenance | Obtain maintenance support and/or spare parts for [Assignment: system components] within [Assignment: time period] of failure. | |
| MA-06(01) in MA-6 |
Preventive Maintenance | Perform preventive maintenance on [Assignment: system components] at [Assignment: time intervals]. | |
| MA-06(02) in MA-6 |
Predictive Maintenance | Perform predictive maintenance on [Assignment: system components] at [Assignment: time intervals]. | |
| MA-06(03) in MA-6 |
Automated Support for Predictive Maintenance | Transfer predictive maintenance data to a maintenance management system using [Assignment: automated mechanisms]. | |
| MA-07 | Field Maintenance | Restrict or prohibit field maintenance on [Assignment: systems or system components] to [Assignment: trusted maintenance facilities]. |
30 of 1196.