LLMResponse MA.L2-3.7.6.a

1. Evidence Types and Assessment Approaches for Practice MA.L2-3.7.6

Based on my analysis of the CMMC Level 2 Assessment Guide and the information provided about practice MA.L2-3.7.6 (Maintenance Personnel), I can provide recommendations on evidence types and assessment approaches for the objective: "[a] maintenance personnel without required access authorization are supervised during maintenance activities."

Ranking of Evidence Types

From most to least valuable for demonstrating compliance with this assessment objective:

1. **Physical Review** - This provides the strongest evidence as it allows direct observation of supervision practices during maintenance activities.

2. **Artifacts** - These provide tangible proof that supervision procedures are followed, such as maintenance logs with supervisor signatures, temporary account creation records, or escort logs.

3. **Documents** - Written policies and procedures that define supervision requirements provide the foundation for compliance but need to be supported by evidence of implementation.

4. **Screen Share** - While useful for some aspects, screen sharing has limited value for this objective as it primarily demonstrates the technical rather than physical supervision aspects.

Prioritization of Assessment Approaches

I recommend prioritizing assessment approaches in this order:

1. **Interview** - Interviews with IT security personnel and system administrators who manage maintenance activities provide crucial context about supervision practices and how temporary access is managed.

2. **Examine** - Review of documents and artifacts such as:

  - Maintenance supervision procedures
  - Visitor logs showing escort assignments
  - Temporary account creation and deactivation records
  - Service provider contracts with supervision requirements
  - Maintenance records with supervisor signatures

3. **Test** - While valuable, testing comes last as it's more resource-intensive and should be targeted based on interview and examination findings. Testing might include:

  - Observing the process of creating temporary accounts for maintenance personnel
  - Verifying that access permissions are properly restricted
  - Confirming account expiration mechanisms function as intended

Implementation Recommendation

To demonstrate compliance with this assessment objective, I recommend:

1. Develop and document a formal procedure for supervising unauthorized maintenance personnel 2. Create standardized forms for documenting supervision activities 3. Implement a process for creating temporary accounts with appropriate restrictions and automatic expiration 4. Train staff responsible for supervision on proper procedures 5. Maintain logs of all maintenance activities including details of supervision provided

These measures will create both the procedural framework and the evidence trail needed to demonstrate compliance with MA.L2-3.7.6's supervision requirements during assessment.