Title

The identity of maintenance personnel installing or modifying a device or software must be verified and recorded. (Cat II impact)

Discussion

The identity of maintenance personnel performing software load upgrades or maintenance of a DSN component must be recorded. This will make a particular person or vendor representative accountable for all actions performed, giving the ISSO and site personnel the means to investigate activity. The preferred means of maintaining records is to obtain a DD form 2875 from all individuals performing work on the system.

Check Content

Review site documentation to confirm the identity of maintenance personnel installing or modifying a device or software is verified and recorded. Use of DD form 2875 is the preferred method to obtain identity information. If the identity of maintenance personnel installing or modifying a device or software is not verified and recorded, this is a finding.

Fix Text

Implement the use of DD Form 2875 to verify and record the identity of maintenance personnel installing or modifying a device or software on a DSN component. This list should contain military, civilian personnel, and vendor representatives.

Additional Identifiers

Rule ID: SV-8469r2_rule

Vulnerability ID: V-7983

Group Title: Identity of maintenance personnel

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.