id: "MA-04(03)" title: "Comparable Security and Sanitization" family: "MA" family_name: "Maintenance" sort_id: "ma-04.03" priority: "P2" implementation_level: "organization" parent: "MA-04" enhancement: True
Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; or
Remove the component to be serviced from the system prior to nonlocal maintenance or diagnostic services; sanitize the component (for organizational information); and after the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system.
Guidance
Comparable security capability on systems, diagnostic tools, and equipment providing maintenance services implies that the implemented controls on those systems, tools, and equipment are at least as comprehensive as the controls on the system being serviced.
Assessment Objective: nonlocal maintenance services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced;
Assessment Objective: nonlocal diagnostic services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; or
Assessment Objective: the component to be serviced is removed from the system prior to nonlocal maintenance or diagnostic services;
Assessment Objective: the component to be serviced is sanitized (for organizational information);
Assessment Objective: the component is inspected and sanitized (for potentially malicious software) after the service is performed and before reconnecting the component to the system.
Maintenance policy
procedures addressing nonlocal system maintenance
service provider contracts and/or service-level agreements
maintenance records
inspection records
audit records
equipment sanitization records
media sanitization records
system security plan
other relevant documents or records
Organizational personnel with system maintenance responsibilities
system maintenance provider
organizational personnel with information security responsibilities
organizational personnel responsible for media sanitization
system/network administrators
Organizational processes for comparable security and sanitization for nonlocal maintenance
organizational processes for the removal, sanitization, and inspection of components serviced via nonlocal maintenance
mechanisms supporting and/or implementing component sanitization and inspection