Navigate

MA-4(3)

MA-4(3): Comparable Security / Sanitization

The organization:

(a): Requires that nonlocal maintenance and diagnostic services be performed from an information system that implements a security capability comparable to the capability implemented on the system being serviced; or

(b): Removes the component to be serviced from the information system prior to nonlocal maintenance or diagnostic services, sanitizes the component (with regard to organizational information) before removal from organizational facilities, and after the service is performed, inspects and sanitizes the component (with regard to potentially malicious software) before reconnecting the component to the information system.

Supplemental

Comparable security capability on information systems, diagnostic tools, and equipment providing maintenance services implies that the implemented security controls on those systems, tools, and equipment are at least as comprehensive as the controls on the information system being serviced.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to MA-4(3).

Control	Description
MA-3	The organization approves, controls, and monitors information system maintenance tools.
SA-12	The organization protects against supply chain threats to the information system, system component, or information system service by employing [organization-defined security safeguards] as part of a comprehensive, defense-in-breadth information security strategy.
SI-3	The organization: a: Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; b: Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures; c: Configures malicious code protection mechanisms to: 1: Perform periodic scans of the information system [organization-defined frequency] and real-time scans of files from external sources at [one or more of endpoint/network entry/exit points] as the files are downloaded, opened, or executed in accordance with organizational security policy; and 2: [one or more of block malicious code/quarantine malicious code/send alert to administrator/ {{ insert: param, si-3_prm_4 }} ] in response to malicious code detection; and d: Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.
SI-7	The organization employs integrity verification tools to detect unauthorized changes to [organization-defined software, firmware, and information].

Enhancements

The controls below (if any) add on to the requirements of MA-4(3).

Control	Description
No controls

Related CCIs

The CCIs below are tied to MA-4(3).

CCI	Definition
CCI-000882	Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced.
CCI-000883	Remove the component to be serviced from the system prior to nonlocal maintenance or diagnostic services; sanitize the component (for organizational information).
CCI-001631	After the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system.