ComplianceNIST 800-53 control

NIST-MA-2 Controlled Maintenance

Official page ↗

Framework: NIST SP 800-53 rev5 (5.2.0)
Family: MA Maintenance
Control: MA-2

Control statement

a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location; c. Require that [Assignment: personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement; d. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: information]; e. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and f. Include the following information in organizational maintenance records: [Assignment: information].

Discussion

Controlling system maintenance addresses the information security aspects of the system maintenance program and applies to all types of maintenance to system components conducted by local or nonlocal entities. Maintenance includes peripherals such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes the date and time of maintenance, a description of the maintenance performed, names of the individuals or group performing the maintenance, name of the escort, and system components or equipment that are removed or replaced. Organizations consider supply chain-related risks associated with replacement components for systems.

Related control · Compliance (12)

NIST-CM-2 Baseline Configuration NIST 800-53 control
NIST-CM-3 Configuration Change Control NIST 800-53 control
NIST-CM-4 Impact Analyses NIST 800-53 control
NIST-CM-5 Access Restrictions for Change NIST 800-53 control
NIST-CM-8 System Component Inventory NIST 800-53 control
NIST-MA-4 Nonlocal Maintenance NIST 800-53 control
NIST-MP-6 Media Sanitization NIST 800-53 control
NIST-PE-16 Delivery and Removal NIST 800-53 control
NIST-SI-2 Flaw Remediation NIST 800-53 control
NIST-SR-11 Component Authenticity NIST 800-53 control
NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control
NIST-SR-4 Provenance NIST 800-53 control

Referenced by Compliance · enhancement of (1)

NIST-MA-2(2) Automated Maintenance Activities NIST 800-53 enhancement

Referenced by Compliance · has member (1)

NIST-MA Maintenance NIST 800-53 family

Referenced by Compliance · related control (18)

NIST-CA-7 Continuous Monitoring NIST 800-53 control
NIST-CM-2 Baseline Configuration NIST 800-53 control
NIST-CM-3 Configuration Change Control NIST 800-53 control
NIST-CM-4 Impact Analyses NIST 800-53 control
NIST-CM-8 System Component Inventory NIST 800-53 control
NIST-IR-4(10) Supply Chain Coordination NIST 800-53 enhancement
NIST-MA-3 Maintenance Tools NIST 800-53 control
NIST-MA-4 Nonlocal Maintenance NIST 800-53 control
NIST-MA-7 Field Maintenance NIST 800-53 control
NIST-MP-6 Media Sanitization NIST 800-53 control
NIST-PE-16 Delivery and Removal NIST 800-53 control
NIST-PM-31 Continuous Monitoring Strategy NIST 800-53 control
NIST-SI-13 Predictable Failure Prevention NIST 800-53 control
NIST-SI-2 Flaw Remediation NIST 800-53 control
NIST-SR-11(2) Configuration Control for Component Service and Repair NIST 800-53 enhancement
NIST-SR-2 Supply Chain Risk Management Plan NIST 800-53 control
NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control
NIST-SR-4 Provenance NIST 800-53 control