CCI-000883

The organization removes the component to be serviced from the information system and prior to nonlocal maintenance or diagnostic services, sanitizes the component (with regard to organizational information) before removal from organizational facilities.

Implementation Guidance

The organization being inspected/assessed removes the component to be serviced from the information system and prior to non-local maintenance or diagnostic services, sanitizes the component (with regard to organizational information) before removal from organizational facilities. Alternatively, the organization being inspected/assessed complies with MA-4 (3) CCI 882.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines maintenance procedures for all non-local maintenance and diagnostic services to ensure that the organization being inspected/assessed sanitizes components before removal from organizational facilities. Alternatively, the organization conducting the inspection/assessment ensures the organization being inspected/assessed complies with MA-4 (3) CCI 882.

Compelling Evidence

1.) Policy that states information system component being removed from the facility for maintenance and digital services is sanitized of organizational information prior to removal

The controls below (if any) were marked by NIST as being related to CCI-000883.