Navigate

MA-6

MA-6: Timely Maintenance

Obtain maintenance support and/or spare parts for [system components for which maintenance support and/or spare parts are obtained are defined;] within [time period within which maintenance support and/or spare parts are to be obtained after a failure are defined;] of failure.

Supplemental

Organizations specify the system components that result in increased risk to organizational operations and assets, individuals, other organizations, or the Nation when the functionality provided by those components is not operational. Organizational actions to obtain maintenance support include having appropriate contracts in place.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	moderate

Overlays
DAF Baseline

CSF Categories
PR.MA-1

Related Controls

The controls below (if any) were marked by NIST as being related to MA-6.

Control	Description
CM-8	a: Develop and document an inventory of system components that: 1: Accurately reflects the system; 2: Includes all components within the system; 3: Does not include duplicate accounting of components or components assigned to any other system; 4: Is at the level of granularity deemed necessary for tracking and reporting; and 5: Includes the following information to achieve system component accountability: [information deemed necessary to achieve effective system component accountability is defined;] ; and b: Review and update the system component inventory [frequency at which to review and update the system component inventory is defined;].
CP-2	a: Develop a contingency plan for the system that: 1: Identifies essential mission and business functions and associated contingency requirements; 2: Provides recovery objectives, restoration priorities, and metrics; 3: Addresses contingency roles, responsibilities, assigned individuals with contact information; 4: Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 5: Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented; 6: Addresses the sharing of contingency information; and 7: Is reviewed and approved by [one of ]; b: Distribute copies of the contingency plan to [one of ]; c: Coordinate contingency planning activities with incident handling activities; d: Review the contingency plan for the system [frequency of contingency plan review is defined;]; e: Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; f: Communicate contingency plan changes to [one of ]; g: Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and h: Protect the contingency plan from unauthorized disclosure and modification.
CP-7	a: Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [system operations for essential mission and business functions are defined;] for essential mission and business functions within [time period consistent with recovery time and recovery point objectives is defined;] when the primary processing capabilities are unavailable; b: Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and c: Provide controls at the alternate processing site that are equivalent to those at the primary site.
RA-7	Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.
SA-15	a: Require the developer of the system, system component, or system service to follow a documented development process that: 1: Explicitly addresses security and privacy requirements; 2: Identifies the standards and tools used in the development process; 3: Documents the specific tool options and tool configurations used in the development process; and 4: Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and b: Review the development process, standards, tools, tool options, and tool configurations [frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined;] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [one of ].
SI-13	a: Determine mean time to failure (MTTF) for the following system components in specific environments of operation: [system components for which mean time to failure (MTTF) should be determined are defined;] ; and b: Provide substitute system components and a means to exchange active and standby components in accordance with the following criteria: [mean time to failure (MTTF) substitution criteria to be used as a means to exchange active and standby components are defined;].
SR-2	a: Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [systems, system components, or system services for which a supply chain risk management plan is developed are defined;]; b: Review and update the supply chain risk management plan [the frequency at which to review and update the supply chain risk management plan is defined;] or as required, to address threat, organizational or environmental changes; and c: Protect the supply chain risk management plan from unauthorized disclosure and modification.
SR-3	a: Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined;] in coordination with [supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes is/are defined;]; b: Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [supply chain controls employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events are defined;] ; and c: Document the selected and implemented supply chain processes and controls in [one or more of "security and privacy plans"/"supply chain risk management plan"/"{{ insert: param, sr-03_odp.05 }} "].
SR-4	Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [systems, system components, and associated data that require valid provenance are defined;].

Enhancements

The controls below (if any) add on to the requirements of MA-6.

Control	Description
MA-6(1)	Perform preventive maintenance on [system components on which preventive maintenance is to be performed are defined;] at [time intervals within which preventive maintenance is to be performed on system components are defined;].
MA-6(2)	Perform predictive maintenance on [system components on which predictive maintenance is to be performed are defined;] at [time intervals within which predictive maintenance is to be performed are defined;].
MA-6(3)	Transfer predictive maintenance data to a maintenance management system using [automated mechanisms used to transfer predictive maintenance data to a maintenance management system are defined;].

Related CCIs

The CCIs below are tied to MA-6.

CCI	Definition
CCI-000903	Obtain maintenance support and/or spare parts for organization-defined system components within an organization-defined time period of failure.
CCI-002896	Defines the system components for which it obtains maintenance support and/or spare parts.
CCI-002897	Defines a time period for obtaining maintenance support and/or spare parts for organization-defined system components after a failure.