Navigate

CCI-002895

CCI-002895 Definition

Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if organizational personnel with required access authorizations and technical competence is/are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Validation Procedures

Examine: [SELECT FROM: Maintenance policy; procedures addressing maintenance personnel; service provider contracts; service-level agreements; list of authorized personnel; maintenance records; access control records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for authorizing and managing maintenance personnel; mechanisms supporting and/or implementing authorization of maintenance personnel].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002895.

Control	Description
MA-5	a: Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel; b: Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and c: Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Control

Description

MA-5

a: Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;

b: Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and

c: Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.