CCI-000871

Prevent the unauthorized removal of maintenance equipment containing organizational information by: (a) verifying that there is no organizational information contained on the equipment; (b) sanitizing or destroying the equipment; (c) retaining the equipment within the facility; or (d) obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.

Implementation Guidance

Determine if the removal of maintenance equipment containing organizational information is prevented by obtaining an exemption from [MA-03(03)_ODP; personnel or roles who can authorize removal of equipment from the facility is/are defined] explicitly authorizing removal of the equipment from the facility.

Validation Procedures

Examine: [SELECT FROM: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; maintenance records; equipment sanitization records; media sanitization records; exemptions for equipment removal; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities; organizational personnel responsible for media sanitization]. Test: [SELECT FROM: Organizational process for preventing unauthorized removal of information; mechanisms supporting media sanitization or destruction of equipment; mechanisms supporting verification of media sanitization].

The controls below (if any) were marked by NIST as being related to CCI-000871.