Navigate

CCI-002874

CCI-002874 Definition

Defines the personnel or roles who can explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repairs or replacement.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed defines and documents the personnel or roles who can explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs. DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles who can explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs. DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) List of personnel or roles who can approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002874.

Control	Description
MA-2	The organization: a: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location; c: Requires that [organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs; d: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs; e: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and f: Includes [organization-defined maintenance-related information] in organizational maintenance records.

Control

Description

MA-2

The organization:

a: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;

b: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;

c: Requires that [organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;

d: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;

e: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and

f: Includes [organization-defined maintenance-related information] in organizational maintenance records.