CCI-002893

Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorization.

Implementation Guidance

Determine if non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system have required access authorizations.

Validation Procedures

Examine: [SELECT FROM: Maintenance policy; procedures addressing maintenance personnel; system media protection policy; access control policy and procedures; physical and environmental protection policy and procedures; maintenance records; access control records; access authorizations; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system maintenance responsibilities; organizational personnel with personnel security responsibilities; organizational personnel with physical access control responsibilities; organizational personnel with information security responsibilities].

The controls below (if any) were marked by NIST as being related to CCI-002893.