Navigate

CCI-002869

CCI-002869 Definition

The organization reviews records of maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed documents and implements a process to review records of maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements. The organization must maintain a record of reviews.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews records of maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.

Compelling Evidence

1.) Records of maintenance of alarm systems, surveillance systems, air-conditioning or heating systems, etc.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002869.

Control	Description
MA-2	The organization: MA-2a.: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements; MA-2b.: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location; MA-2c.: Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs; MA-2d.: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs; MA-2e.: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and MA-2f.: Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.

Control

Description

MA-2

The organization:

MA-2a.: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;

MA-2b.: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;

MA-2c.: Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;

MA-2d.: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;

MA-2e.: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and

MA-2f.: Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.