Navigate

MA-4

MA-4: Nonlocal Maintenance

The organization:

a: Approves and monitors nonlocal maintenance and diagnostic activities;

b: Allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system;

c: Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions;

d: Maintains records for nonlocal maintenance and diagnostic activities; and

e: Terminates session and network connections when nonlocal maintenance is completed.

Supplemental

Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection. Authentication techniques used in the establishment of nonlocal maintenance and diagnostic sessions reflect the network access requirements in IA-2. Typically, strong authentication requires authenticators that are resistant to replay attacks and employ multifactor authentication. Strong authenticators include, for example, PKI where certificates are stored on a token protected by a password, passphrase, or biometric. Enforcing requirements in MA-4 is accomplished in part by other controls.

CIA Levels
Confidentiality	unknown
Integrity	high
Availability	unknown

Overlays
None

CSF Categories
PR.MA-2

Related Controls

The controls below (if any) were marked by NIST as being related to MA-4.

Control	Description
AC-2	The organization: a: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [organization-defined information system account types]; b: Assigns account managers for information system accounts; c: Establishes conditions for group and role membership; d: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; e: Requires approvals by [organization-defined personnel or roles] for requests to create information system accounts; f: Creates, enables, modifies, disables, and removes information system accounts in accordance with [organization-defined procedures or conditions]; g: Monitors the use of information system accounts; h: Notifies account managers: 1: When accounts are no longer required; 2: When users are terminated or transferred; and 3: When individual information system usage or need-to-know changes; i: Authorizes access to the information system based on: 1: A valid access authorization; 2: Intended system usage; and 3: Other attributes as required by the organization or associated missions/business functions; j: Reviews accounts for compliance with account management requirements [organization-defined frequency]; and k: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-6	The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
AC-17	The organization: a: Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b: Authorizes remote access to the information system prior to allowing such connections.
AU-2	The organization: a: Determines that the information system is capable of auditing the following events: [organization-defined auditable events]; b: Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; c: Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and d: Determines that the following events are to be audited within the information system: [organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].
AU-3	The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.
IA-2	The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
IA-4	The organization manages information system identifiers by: a: Receiving authorization from [organization-defined personnel or roles] to assign an individual, group, role, or device identifier; b: Selecting an identifier that identifies an individual, group, role, or device; c: Assigning the identifier to the intended individual, group, role, or device; d: Preventing reuse of identifiers for [organization-defined time period]; and e: Disabling the identifier after [organization-defined time period of inactivity].
IA-5	The organization manages information system authenticators by: a: Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator; b: Establishing initial authenticator content for authenticators defined by the organization; c: Ensuring that authenticators have sufficient strength of mechanism for their intended use; d: Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators; e: Changing default content of authenticators prior to information system installation; f: Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators; g: Changing/refreshing authenticators [organization-defined time period by authenticator type]; h: Protecting authenticator content from unauthorized disclosure and modification; i: Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and j: Changing authenticators for group/role accounts when membership to those accounts changes.
IA-8	The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).
MA-2	The organization: a: Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b: Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location; c: Requires that [organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs; d: Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs; e: Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and f: Includes [organization-defined maintenance-related information] in organizational maintenance records.
MA-5	The organization: a: Establishes a process for maintenance personnel authorization and maintains a list of authorized maintenance organizations or personnel; b: Ensures that non-escorted personnel performing maintenance on the information system have required access authorizations; and c: Designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
MP-6	The organization: a: Sanitizes [organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [organization-defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and b: Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
PL-2	The organization: a: Develops a security plan for the information system that: 1: Is consistent with the organization’s enterprise architecture; 2: Explicitly defines the authorization boundary for the system; 3: Describes the operational context of the information system in terms of missions and business processes; 4: Provides the security categorization of the information system including supporting rationale; 5: Describes the operational environment for the information system and relationships with or connections to other information systems; 6: Provides an overview of the security requirements for the system; 7: Identifies any relevant overlays, if applicable; 8: Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and 9: Is reviewed and approved by the authorizing official or designated representative prior to plan implementation; b: Distributes copies of the security plan and communicates subsequent changes to the plan to [organization-defined personnel or roles]; c: Reviews the security plan for the information system [organization-defined frequency]; d: Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and e: Protects the security plan from unauthorized disclosure and modification.
SC-7	The information system: a: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b: Implements subnetworks for publicly accessible system components that are [] separated from internal organizational networks; and c: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
SC-10	The information system terminates the network connection associated with a communications session at the end of the session or after [organization-defined time period] of inactivity.
SC-17	The organization issues public key certificates under an [organization-defined certificate policy] or obtains public key certificates from an approved service provider.

Enhancements

The controls below (if any) add on to the requirements of MA-4.

Control	Description
MA-4(1)	The organization: (a): Audits nonlocal maintenance and diagnostic sessions [organization-defined audit events]; and (b): Reviews the records of the maintenance and diagnostic sessions.
MA-4(2)	The organization documents in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.
MA-4(3)	The organization: (a): Requires that nonlocal maintenance and diagnostic services be performed from an information system that implements a security capability comparable to the capability implemented on the system being serviced; or (b): Removes the component to be serviced from the information system prior to nonlocal maintenance or diagnostic services, sanitizes the component (with regard to organizational information) before removal from organizational facilities, and after the service is performed, inspects and sanitizes the component (with regard to potentially malicious software) before reconnecting the component to the information system.
MA-4(4)	The organization protects nonlocal maintenance sessions by: (a): Employing [organization-defined authenticators that are replay resistant]; and (b): Separating the maintenance sessions from other network sessions with the information system by either: (1): Physically separated communications paths; or (2): Logically separated communications paths based upon encryption.
MA-4(5)	The organization: (a): Requires the approval of each nonlocal maintenance session by [organization-defined personnel or roles]; and (b): Notifies [organization-defined personnel or roles] of the date and time of planned nonlocal maintenance.
MA-4(6)	The information system implements cryptographic mechanisms to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications.
MA-4(7)	The information system implements remote disconnect verification at the termination of nonlocal maintenance and diagnostic sessions.

Related CCIs

The CCIs below are tied to MA-4.

CCI	Definition
CCI-000873	Approve nonlocal maintenance and diagnostic activities.
CCI-000874	Monitor nonlocal maintenance and diagnostic activities.
CCI-000876	Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system.
CCI-000877	Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.
CCI-000878	Maintain records for nonlocal maintenance and diagnostic activities.
CCI-000879	The organization terminates sessions and network connections when nonlocal maintenance is completed.