Navigate

MA-3

MA-3: Maintenance Tools

The organization approves, controls, and monitors information system maintenance tools.

Supplemental

This control addresses security-related issues associated with maintenance tools used specifically for diagnostic and repair actions on organizational information systems. Maintenance tools can include hardware, software, and firmware items. Maintenance tools are potential vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and subsequently into organizational information systems. Maintenance tools can include, for example, hardware/software diagnostic test equipment and hardware/software packet sniffers. This control does not cover hardware/software components that may support information system maintenance, yet are a part of the system, for example, the software implementing “ping,” “ls,” “ipconfig, or the hardware and software implementing the monitoring port of an Ethernet switch.

CIA Levels
Confidentiality	unknown
Integrity	high
Availability	unknown

Overlays
None

CSF Categories
PR.MA-1

Related Controls

The controls below (if any) were marked by NIST as being related to MA-3.

Control	Description
MA-2	The organization: a: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location; c: Requires that [organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs; d: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs; e: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and f: Includes [organization-defined maintenance-related information] in organizational maintenance records.
MA-5	The organization: a: Establishes a process for maintenance personnel authorization and maintains a list of authorized maintenance organizations or personnel; b: Ensures that non-escorted personnel performing maintenance on the information system have required access authorizations; and c: Designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
MP-6	The organization: a: Sanitizes [organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [organization-defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and b: Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

Enhancements

The controls below (if any) add on to the requirements of MA-3.

Control	Description
MA-3(1)	The organization inspects the maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.
MA-3(2)	The organization checks media containing diagnostic and test programs for malicious code before the media are used in the information system.
MA-3(3)	The organization prevents the unauthorized removal of maintenance equipment containing organizational information by: (a): Verifying that there is no organizational information contained on the equipment; (b): Sanitizing or destroying the equipment; (c): Retaining the equipment within the facility; or (d): Obtaining an exemption from [organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility.
MA-3(4)	The information system restricts the use of maintenance tools to authorized personnel only.

Related CCIs

The CCIs below are tied to MA-3.

CCI	Definition
CCI-000865	Approve the use of system maintenance tools.
CCI-000866	Control the use of system maintenance tools.
CCI-000867	Monitor the use of system maintenance tools.