Navigate

CCI-002876

CCI-002876 Definition

Defines the information to include in organizational maintenance records.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed defines and documents the maintenance-related information to include in organizational maintenance records. DoD has determined the maintenance-related information is not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented maintenance-related information to ensure the organization being inspected/assessed defines the maintenance-related information to include in organizational maintenance records. DoD has determined the maintenance-related information is not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated maintenance procedures describing the maintenance information to be included in a maintenance record.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002876.

Control	Description
MA-2	The organization: a: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location; c: Requires that [organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs; d: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs; e: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and f: Includes [organization-defined maintenance-related information] in organizational maintenance records.

Control

Description

MA-2

The organization:

a: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;

b: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;

c: Requires that [organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;

d: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;

e: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and

f: Includes [organization-defined maintenance-related information] in organizational maintenance records.