CCI-000871

The organization prevents the unauthorized removal of maintenance equipment containing organizational information by: (a) verifying that there is no organizational information contained on the equipment; (b) sanitizing or destroying the equipment; (c) retaining the equipment within the facility; or (d) obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to take one of the following actions before authorizing removal of information equipment from the facility: 1. verify there is no organizational information contained on maintenance equipment; 2. Sanitize or destroy the equipment; 3. Retain the equipment within the facility; or 4. Obtain an exemption from personnel or roles defined in MA-3 (3), CCI 2882 explicitly authorizing removal of the equipment from the facility. The organization must maintain a record of maintenance equipment removal and actions taken.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process and record of maintenance equipment removal to ensure the organization being inspected/assessed takes one of the four actions listed in the implementation guidance.

Compelling Evidence

1.) Policy that states how unauthorized removal of maintenance equipment is prevented

The controls below (if any) were marked by NIST as being related to CCI-000871.