CCI-002894

Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to ensure that non-escorted personnel performing maintenance on the information system have required access authorizations. The organization must maintain a record of personnel performing maintenance on the information system.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of personnel performing maintenance on the information system to ensure the organization being inspected/assessed ensures that non-escorted personnel performing maintenance on the information system have required access authorizations.

Compelling Evidence

1.) Maintenance personnel VAR or other similar documentation

The controls below (if any) were marked by NIST as being related to CCI-002894.