Navigate

MA-6

MA-6: Timely Maintenance

The organization obtains maintenance support and/or spare parts for [Assignment: organization-defined information system components] within [Assignment: organization-defined time period] of failure.

Supplemental

Organizations specify the information system components that result in increased risk to organizational operations and assets, individuals, other organizations, or the Nation when the functionality provided by those components is not operational. Organizational actions to obtain maintenance support typically include having appropriate contracts in place.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	moderate

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to MA-6.

Control	Description
CM-8	The organization: CM-8a.: Develops and documents an inventory of information system components that: CM-8a.1.: Accurately reflects the current information system; CM-8a.2.: Includes all components within the authorization boundary of the information system; CM-8a.3.: Is at the level of granularity deemed necessary for tracking and reporting; and CM-8a.4.: Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]; and CM-8b.: Reviews and updates the information system component inventory [Assignment: organization-defined frequency].
CP-2	The organization: CP-2a.: Develops a contingency plan for the information system that: CP-2a.1.: Identifies essential missions and business functions and associated contingency requirements; CP-2a.2.: Provides recovery objectives, restoration priorities, and metrics; CP-2a.3.: Addresses contingency roles, responsibilities, assigned individuals with contact information; CP-2a.4.: Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure; CP-2a.5.: Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and CP-2a.6.: Is reviewed and approved by [Assignment: organization-defined personnel or roles]; CP-2b.: Distributes copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; CP-2c.: Coordinates contingency planning activities with incident handling activities; CP-2d.: Reviews the contingency plan for the information system [Assignment: organization-defined frequency]; CP-2e.: Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; CP-2f.: Communicates contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and CP-2g.: Protects the contingency plan from unauthorized disclosure and modification.
CP-7	The organization: CP-7a.: Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined information system operations] for essential missions/business functions within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable; CP-7b.: Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and CP-7c.: Ensures that the alternate processing site provides information security safeguards equivalent to those of the primary site.
SA-14	The organization identifies critical information system components and functions by performing a criticality analysis for [Assignment: organization-defined information systems, information system components, or information system services] at [Assignment: organization-defined decision points in the system development life cycle].
SA-15	The organization: SA-15a.: Requires the developer of the information system, system component, or information system service to follow a documented development process that: SA-15a.1.: Explicitly addresses security requirements; SA-15a.2.: Identifies the standards and tools used in the development process; SA-15a.3.: Documents the specific tool options and tool configurations used in the development process; and SA-15a.4.: Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and SA-15b.: Reviews the development process, standards, tools, and tool options/configurations [Assignment: organization-defined frequency] to determine if the process, standards, tools, and tool options/configurations selected and employed can satisfy [Assignment: organization-defined security requirements].

Enhancements

The controls below (if any) add on to the requirements of MA-6.

Control	Description
MA-6 (1)	The organization performs preventive maintenance on [Assignment: organization-defined information system components] at [Assignment: organization-defined time intervals].
MA-6 (2)	The organization performs predictive maintenance on [Assignment: organization-defined information system components] at [Assignment: organization-defined time intervals].
MA-6 (3)	The organization employs automated mechanisms to transfer predictive maintenance data to a computerized maintenance management system.

Related CCIs

The CCIs below are tied to MA-6.

CCI	Definition
CCI-000903	The organization obtains maintenance support and/or spare parts for organization-defined information system components within an organization-defined time period of failure.
CCI-002896	The organization defines the information system components for which it obtains maintenance support and/or spare parts.
CCI-002897	The organization defines a time period for obtaining maintenance support and/or spare parts for organization-defined information system components after a failure.