id: "MA-07" title: "Field Maintenance" family: "MA" family_name: "Maintenance" sort_id: "ma-07" priority: "P2" implementation_level: "organization"
Statement
Restrict or prohibit field maintenance on {{ insert: param, ma-07_odp.01 }} to {{ insert: param, ma-07_odp.02 }}.
Guidance
Field maintenance is the type of maintenance conducted on a system or system component after the system or component has been deployed to a specific site (i.e., operational environment). In certain instances, field maintenance (i.e., local maintenance at the site) may not be executed with the same degree of rigor or with the same quality control checks as depot maintenance. For critical systems designated as such by the organization, it may be necessary to restrict or prohibit field maintenance at the local site and require that such maintenance be conducted in trusted facilities with additional controls.
Assessment Objective
field maintenance on {{ insert: param, ma-07_odp.01 }} are restricted or prohibited to {{ insert: param, ma-07_odp.02 }}.
Maintenance policy
procedures addressing field maintenance
system design documentation
system configuration settings and associated documentation
maintenance records
diagnostic records
system security plan
other relevant documents or records.
Organizational personnel with system maintenance responsibilities
organizational personnel with information security responsibilities
system/network administrators
Organizational processes for managing field maintenance
mechanisms implementing, supporting, and/or managing field maintenance
mechanisms for strong authentication of field maintenance diagnostic sessions
mechanisms for terminating field maintenance sessions and network connections