CMMC Practice Number: MA.L2-3.7.2
CMMC Level: 2 CMMC Domain: Maintenance (MA)
Practice Summary:
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
Contents:
CMMC Practice Implementation |
Assessment Objectives
Determine if:
[a] tools used to conduct system maintenance are controlled;
[b] techniques used to conduct system maintenance are controlled;
[c] mechanisms used to conduct system maintenance are controlled; and
[d] personnel used to conduct system maintenance are controlled.
Practice Clarification (DOD, CMU)
Tools used to perform maintenance must remain secure so they do not introduce viruses or other malware into your system [a]. Controlling your maintenance techniques prevents intentional or unintentional harm to your network and systems. Additionally, the personnel responsible for maintenance activities should be supervised considering their elevated privilege on company assets [d].
Example
You are responsible for maintenance activities on your company’s machines. To avoid introducing additional vulnerability into the systems you are maintaining, you make sure that all maintenance tools are approved and their usage is monitored and controlled [a,b]. You ensure the tools are kept current and up-to-date [a]. You and your backup are the only people authorized to use these tools and perform system maintenance [d].
Potential Assessment Considerations
• Are physical or logical access controls used to limit access to maintenance tools to authorized personnel [a]?
• Are physical or logical access controls used to limit access to system documentation and organizational maintenance process documentation to authorized personnel [b]?
• Are physical or logical access controls used to limit access to automated mechanisms (e.g., automated scripts, scheduled jobs) to authorized personnel [c]?
• Are physical or logical access controls used to limit access to the system entry points that enable maintenance (e.g., administrative portals, local and remote console access, and physical equipment panels) to authorized personnel [d]?
Where To Look
- System maintenance policy;
- procedures addressing system maintenance tools and media;
- maintenance records;
- system maintenance tools and associated documentation;
- maintenance tool inspection records;
- system security plan;
- other relevant documents or records.
Who To Talk To
- Personnel with system maintenance responsibilities;
- personnel with information security responsibilities.
Perform Test On
- Organizational processes for approving, controlling, and monitoring maintenance tools;
- mechanisms supporting or implementing approval, control, and monitoring of maintenance tools;
- organizational processes for inspecting maintenance tools;
- mechanisms supporting or implementing inspection of maintenance tools;
- organizational process for inspecting media for malicious code;
- mechanisms supporting or implementing inspection of media used for maintenance.
Additional Information
This requirement seeks to manage issues that can arise from the misuse of tools, techniques, and mechanisms that are used for IT system maintenance. Diagnostic tools and software can introduce malware into company systems if not managed properly.
Employees with IT maintenance responsibilities can behave in a malicious manner if not supervised and managed effectively.
Controls may include lists of authorized tools, authorized employees, and authorized techniques and mechanisms. Any such maintenance must occur within the context of other information systems controls in place.
CMMC Practice Background and References (DOD, CMU) |
Practice Discussion:
This requirement addresses security-related issues with maintenance tools that are not within the organizational system boundaries that process, store, or transmit CUI, but are used specifically for diagnostic and repair actions on those systems. Organizations have flexibility in determining the controls in place for maintenance tools, but can include approving, controlling, and monitoring the use of such tools. Maintenance tools are potential vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and into organizational systems. Maintenance tools can include hardware, software, and firmware items, for example, hardware and software diagnostic test equipment and hardware and software packet sniffers.
CMMC References:
· NIST SP 800-171 Rev 1 3.7.2
· NIST CSF v1.2 PR.MA-1
· CERT RMM v1.2 TM:SG5.SP2
· NIST SP 800-53 Rev 4 MA-3