Navigate

CCI-002866

CCI-002866 Definition

The organization schedules maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed schedules maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements. The organization must maintain a record of maintenance.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the record of maintenance to ensure the organization being inspected/assessed schedules maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.

Compelling Evidence

1.) Maintenance schedule for all information system components in accordance with manufacturer or vendor specifications. 2.) Audit logs to support that the maintenance is being performed.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002866.

Control	Description
MA-2	The organization: MA-2a.: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements; MA-2b.: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location; MA-2c.: Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs; MA-2d.: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs; MA-2e.: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and MA-2f.: Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.

Control

Description

MA-2

The organization:

MA-2a.: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;

MA-2b.: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;

MA-2c.: Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;

MA-2d.: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;

MA-2e.: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and

MA-2f.: Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.