Navigate

CCI-002895

CCI-002895 Definition

Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed defines and documents organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines documented organizational personnel to ensure the organization being inspected/assessed designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Compelling Evidence

1.) Documentation that designates personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002895.

Control	Description
MA-5	The organization: a: Establishes a process for maintenance personnel authorization and maintains a list of authorized maintenance organizations or personnel; b: Ensures that non-escorted personnel performing maintenance on the information system have required access authorizations; and c: Designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Control

Description

MA-5

The organization:

a: Establishes a process for maintenance personnel authorization and maintains a list of authorized maintenance organizations or personnel;

b: Ensures that non-escorted personnel performing maintenance on the information system have required access authorizations; and

c: Designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.