Navigate

CCI-000860

CCI-000860 Definition

Require that organization-defines personnel or roles explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed documents within their risk management strategy personnel or roles defined in MA-2, CCI 2874 who must explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs. The organization must maintain written records of approval for the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines: 1. the organization's risk management strategy to ensure the personnel or roles defined in MA-2, CCI 2874 have been designated to approve the removal of the information system or system components; 2. and written records of approval for the removal of the information system or system components from organizational facilities for off-site maintenance or repairs to ensure the removal is explicitly approved.

Compelling Evidence

1.) List of components or parts that were replaced for the most recent service 2.) Approvals for any components or parts that were removed for off-site maintenance or repairs

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000860.

Control	Description
MA-2	The organization: a: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location; c: Requires that [organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs; d: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs; e: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and f: Includes [organization-defined maintenance-related information] in organizational maintenance records.

Control

Description

MA-2

The organization:

a: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;

b: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;

c: Requires that [organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;

d: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;

e: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and

f: Includes [organization-defined maintenance-related information] in organizational maintenance records.