MA-3(4)

MA-3(4): Restricted Tool Use

Restrict the use of maintenance tools to authorized personnel only.

Restricting the use of maintenance tools to only authorized personnel applies to systems that are used to carry out maintenance functions.

Overlays
Int-A, Int-B, Int-C, Privacy (high), Privacy (moderate)

CSF Categories
None

The controls below (if any) were marked by NIST as being related to MA-3(4).

Control	Description
AC-3	Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-5	a: Identify and document [duties of individuals requiring separation are defined;] ; and b: Define system access authorizations to support separation of duties.
AC-6	Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

The controls below (if any) add on to the requirements of MA-3(4).

Control	Description
No controls

The CCIs below are tied to MA-3(4).

CCI	Definition
CCI-002883	Restrict the use of maintenance tools to authorized personnel only.