CCI-001631

After the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system.

Implementation Guidance

The organization being inspected/assessed sanitizes and inspects serviced components prior to reusing them on any information system. Alternatively, the organization being inspected/assessed complies with MA-4 (3) CCI 882.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines maintenance procedures for all non-local maintenance and diagnostic services to ensure that the organization being inspected/assessed sanitizes and inspects serviced components prior to reusing them on any information system. Alternatively, the organization conducting the inspection/assessment ensures the organization being inspected/assessed complies with MA-4 (3) CCI 882.

Compelling Evidence

1.) policy that states before removal from the facility for maintenance services, and prior to reconnection, an information system component is inspected for, and sanitized of, potentially malicious software.

The controls below (if any) were marked by NIST as being related to CCI-001631.