Navigate

MA-2

MA-2: Controlled Maintenance

The organization:

a: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;

b: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;

c: Requires that [organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;

d: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;

e: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and

f: Includes [organization-defined maintenance-related information] in organizational maintenance records.

Supplemental

This control addresses the information security aspects of the information system maintenance program and applies to all types of maintenance to any system component (including applications) conducted by any local or nonlocal entity (e.g., in-contract, warranty, in-house, software maintenance agreement). System maintenance also includes those components not directly associated with information processing and/or data/information retention such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes, for example: (i) date and time of maintenance; (ii) name of individuals or group performing the maintenance; (iii) name of escort, if necessary; (iv) a description of the maintenance performed; and (v) information system components/equipment removed or replaced (including identification numbers, if applicable). The level of detail included in maintenance records can be informed by the security categories of organizational information systems. Organizations consider supply chain issues associated with replacement components for information systems.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
Privacy (PHI)

CSF Categories
PR.MA-1

Related Controls

The controls below (if any) were marked by NIST as being related to MA-2.

Control	Description
CM-3	The organization: a: Determines the types of changes to the information system that are configuration-controlled; b: Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses; c: Documents configuration change decisions associated with the information system; d: Implements approved configuration-controlled changes to the information system; e: Retains records of configuration-controlled changes to the information system for [organization-defined time period]; f: Audits and reviews activities associated with configuration-controlled changes to the information system; and g: Coordinates and provides oversight for configuration change control activities through [organization-defined configuration change control element (e.g., committee, board)] that convenes [one or more of {{ insert: param, cm-3_prm_4 }} / {{ insert: param, cm-3_prm_5 }} ].
CM-4	The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
MA-4	The organization: a: Approves and monitors nonlocal maintenance and diagnostic activities; b: Allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system; c: Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions; d: Maintains records for nonlocal maintenance and diagnostic activities; and e: Terminates session and network connections when nonlocal maintenance is completed.
MP-6	The organization: a: Sanitizes [organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [organization-defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and b: Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
PE-16	The organization authorizes, monitors, and controls [organization-defined types of information system components] entering and exiting the facility and maintains records of those items.
SA-12	The organization protects against supply chain threats to the information system, system component, or information system service by employing [organization-defined security safeguards] as part of a comprehensive, defense-in-breadth information security strategy.
SI-2	The organization: a: Identifies, reports, and corrects information system flaws; b: Tests software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c: Installs security-relevant software and firmware updates within [organization-defined time period] of the release of the updates; and d: Incorporates flaw remediation into the organizational configuration management process.

Enhancements

The controls below (if any) add on to the requirements of MA-2.

Control	Description
MA-2(1)
MA-2(2)	The organization: (a): Employs automated mechanisms to schedule, conduct, and document maintenance and repairs; and (b): Produces up-to date, accurate, and complete records of all maintenance and repair actions requested, scheduled, in process, and completed.

Related CCIs

The CCIs below are tied to MA-2.

CCI	Definition
CCI-000859	The organization approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location.
CCI-000860	Require that organization-defines personnel or roles explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement.
CCI-000861	Sanitize equipment to remove organization-defined information from associated media prior to removal from organizational facilities for off-site maintenance, repairs or replacement.
CCI-000862	Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair or replacement actions.
CCI-002866	Schedule maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002867	The organization performs maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002868	Document records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002869	Review records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002870	Schedule repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002871	The organization performs repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002872	Document repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002873	Review records of repairs on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002874	Defines the personnel or roles who can explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repairs or replacement.
CCI-002875	Include organization-defined information in organizational maintenance records.
CCI-002876	Defines the information to include in organizational maintenance records.