CCI-002900

The organization defines time intervals at which to perform preventive maintenance on organization-defined information system components.

Implementation Guidance

The organization being inspected/assessed defines and documents time intervals to perform preventive maintenance on organization-defined information system components. Time periods must be determined based on methods of determining what preventive (or other) failure management policies to apply include, for example, original equipment manufacturer (OEM) recommendations, statistical failure records, requirements of codes, legislation, or regulations within a jurisdiction, expert opinion, maintenance that has already been conducted on similar equipment, or measured values and performance indications. DoD has determined the time intervals are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented time intervals to ensure the organization being inspected/assessed defines time intervals to perform preventive maintenance on organization-defined information system components. DoD has determined the time intervals are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated System Security Plan (SSP) or equal that details the required frequency for preventive maintenance

The controls below (if any) were marked by NIST as being related to CCI-002900.