Navigate

MA-2

MA-2: Controlled Maintenance

The organization:

MA-2a.: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;

MA-2b.: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;

MA-2c.: Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;

MA-2d.: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;

MA-2e.: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and

MA-2f.: Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.

Supplemental

This control addresses the information security aspects of the information system maintenance program and applies to all types of maintenance to any system component (including applications) conducted by any local or nonlocal entity (e.g., in-contract, warranty, in-house, software maintenance agreement). System maintenance also includes those components not directly associated with information processing and/or data/information retention such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes, for example: (i) date and time of maintenance; (ii) name of individuals or group performing the maintenance; (iii) name of escort, if necessary; (iv) a description of the maintenance performed; and (v) information system components/equipment removed or replaced (including identification numbers, if applicable). The level of detail included in maintenance records can be informed by the security categories of organizational information systems. Organizations consider supply chain issues associated with replacement components for information systems.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to MA-2.

Control	Description
CM-3	The organization: CM-3a.: Determines the types of changes to the information system that are configuration-controlled; CM-3b.: Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses; CM-3c.: Documents configuration change decisions associated with the information system; CM-3d.: Implements approved configuration-controlled changes to the information system; CM-3e.: Retains records of configuration-controlled changes to the information system for [Assignment: organization-defined time period]; CM-3f.: Audits and reviews activities associated with configuration-controlled changes to the information system; and CM-3g.: Coordinates and provides oversight for configuration change control activities through [Assignment: organization-defined configuration change control element (e.g., committee, board)] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined configuration change conditions]].
CM-4	The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
MA-4	The organization: MA-4a.: Approves and monitors nonlocal maintenance and diagnostic activities; MA-4b.: Allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system; MA-4c.: Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions; MA-4d.: Maintains records for nonlocal maintenance and diagnostic activities; and MA-4e.: Terminates session and network connections when nonlocal maintenance is completed.
MP-6	The organization: MP-6a.: Sanitizes [Assignment: organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and MP-6b.: Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
PE-16	The organization authorizes, monitors, and controls [Assignment: organization-defined types of information system components] entering and exiting the facility and maintains records of those items.
SA-12	The organization protects against supply chain threats to the information system, system component, or information system service by employing [Assignment: organization-defined security safeguards] as part of a comprehensive, defense-in-breadth information security strategy.
SI-2	The organization: SI-2a.: Identifies, reports, and corrects information system flaws; SI-2b.: Tests software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; SI-2c.: Installs security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates; and SI-2d.: Incorporates flaw remediation into the organizational configuration management process.

Enhancements

The controls below (if any) add on to the requirements of MA-2.

Control	Description
MA-2 (1)	[Withdrawn: Incorporated into MA-2].
MA-2 (2)	The organization: MA-2 (2)(a): Employs automated mechanisms to schedule, conduct, and document maintenance and repairs; and MA-2 (2)(b): Produces up-to date, accurate, and complete records of all maintenance and repair actions requested, scheduled, in process, and completed.

Related CCIs

The CCIs below are tied to MA-2.

CCI	Definition
CCI-000859	The organization approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location.
CCI-000860	The organization requires that organization-defined personnel or roles explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.
CCI-000861	The organization sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs.
CCI-000862	The organization checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions.
CCI-002866	The organization schedules maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002867	The organization performs maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002868	The organization documents maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002869	The organization reviews records of maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002870	The organization schedules repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002871	The organization performs repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002872	The organization documents repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002873	The organization reviews records of repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002874	The organization defines the personnel or roles who can explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.
CCI-002875	The organization includes organization-defined maintenance-related information in organizational maintenance records.
CCI-002876	The organization defines the maintenance-related information to include in organizational maintenance records.