CCI-004187

Implementation Guidance

Determine if previously approved system maintenance tools are reviewed [MA-03_ODP; frequency at which to review previously approved system maintenance tools is defined].

Validation Procedures

Examine: [SELECT FROM: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; maintenance records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for approving, controlling, and monitoring maintenance tools; mechanisms supporting and/or implementing the approval, control, and/or monitoring of maintenance tools].