Maintenance (MA)¶

MA.L2-3.7.1 – Perform Maintenance¶

Perform maintenance on organizational systems.

Assessment Objectives¶

Source: NIST SP 800-171A, p. 38.

Determine if:

• [a] system maintenance is performed.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, p. 38.

Examine: [SELECT FROM: System maintenance policy; procedures addressing controlled system maintenance; maintenance records; manufacturer or vendor maintenance specifications; equipment sanitization records; media sanitization records; system security plan; other relevant documents or records].

Interview: [SELECT FROM: Personnel with system maintenance responsibilities; personnel with information security responsibilities; personnel responsible for media sanitization; system or network administrators].

Test: [SELECT FROM: Organizational processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for systems; organizational processes for sanitizing system components; mechanisms supporting or implementing controlled maintenance; mechanisms implementing sanitization of system components].

Discussion¶

Source: NIST SP 800-171 Rev. 2, p. 27.

This requirement addresses the information security aspects of the system maintenance program and applies to all types of maintenance to any system component (including hardware, firmware, applications) conducted by any local or nonlocal entity. System maintenance also includes those components not directly associated with information processing and data or information retention such as scanners, copiers, and printers.

Further Discussion¶

One common form of computer security maintenance is regular patching of discovered vulnerabilities in software and operating systems, though there are others that require attention. System maintenance includes:

• corrective maintenance (e.g., repairing problems with the technology);
• preventative maintenance (e.g., updates to prevent potential problems);
• adaptive maintenance (e.g., changes to the operative environment); and
• perfective maintenance (e.g., improve operations).

Examples¶

• You are responsible for maintenance activities on your company’s machines. This includes regular planned maintenance, unscheduled maintenance, reconfigurations when required, and damage repairs [a]. You know that failing to conduct maintenance activities can impact system security and availability, so you ensure that maintenance is regularly performed. You track all maintenance performed to assist with troubleshooting later if needed.

Potential Assessment Considerations¶

• Are systems, devices, and supporting systems maintained per manufacturer recommendations or company defined schedules [a]?

Key References¶

• NIST SP 800-171 Rev. 2 3.7.1

MA.L2-3.7.2 – System Maintenance Control¶

Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

Assessment Objectives¶

Source: NIST SP 800-171A, p. 38.

Determine if:

• [a] tools used to conduct system maintenance are controlled;
• [b] techniques used to conduct system maintenance are controlled;
• [c] mechanisms used to conduct system maintenance are controlled; and
• [d] personnel used to conduct system maintenance are controlled.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, p. 38.

Examine: [SELECT FROM: System maintenance policy; procedures addressing system maintenance tools and media; maintenance records; system maintenance tools and associated documentation; maintenance tool inspection records; system security plan; other relevant documents or records].

Interview: [SELECT FROM: Personnel with system maintenance responsibilities; personnel with information security responsibilities].

Test: [SELECT FROM: Organizational processes for approving, controlling, and monitoring maintenance tools; mechanisms supporting or implementing approval, control, and monitoring of maintenance tools; organizational processes for inspecting maintenance tools; mechanisms supporting or implementing inspection of maintenance tools; organizational process for inspecting media for malicious code; mechanisms supporting or implementing inspection of media used for maintenance].

Discussion¶

Source: NIST SP 800-171 Rev. 2, pp. 27-28.

This requirement addresses security-related issues with maintenance tools that are not within the organizational system boundaries that process, store, or transmit CUI, but are used specifically for diagnostic and repair actions on those systems. Organizations have flexibility in determining the controls in place for maintenance tools, but can include approving, controlling, and monitoring the use of such tools. Maintenance tools are potential vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and into organizational systems. Maintenance tools can include hardware, software, and firmware items, for example, hardware and software diagnostic test equipment and hardware and software packet sniffers.

Further Discussion¶

Tools used to perform maintenance must remain secure so they do not introduce viruses or other malware into your system. Controlling your maintenance techniques prevents intentional or unintentional harm to your network and systems. Additionally, the personnel responsible for maintenance activities should be supervised considering their elevated privilege on company assets.

Examples¶

• You are responsible for maintenance activities on your company’s machines. To avoid introducing additional vulnerability into the systems you are maintaining, you make sure that all maintenance tools are approved and their usage is monitored and controlled [a,b]. You ensure the tools are kept current and up-to-date [a]. You and your backup are the only people authorized to use these tools and perform system maintenance [d].

Potential Assessment Considerations¶

• Are physical or logical access controls used to limit access to maintenance tools to authorized personnel [a]?
• Are physical or logical access controls used to limit access to system documentation and organizational maintenance process documentation to authorized personnel [b]?
• Are physical or logical access controls used to limit access to automated mechanisms (e.g., automated scripts, scheduled jobs) to authorized personnel [c]?
• Are physical or logical access controls used to limit access to the system entry points that enable maintenance (e.g., administrative portals, local and remote console access, and physical equipment panels) to authorized personnel [d]?

Key References¶

• NIST SP 800-171 Rev. 2 3.7.2

MA.L2-3.7.3 – Equipment Sanitization¶

Ensure equipment removed for off-site maintenance is sanitized of any CUI.

Assessment Objectives¶

Source: NIST SP 800-171A, p. 39.

Determine if:

• [a] equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, p. 39.

Examine: [SELECT FROM: System maintenance policy; procedures addressing controlled system maintenance; maintenance records; manufacturer or vendor maintenance specifications; equipment sanitization records; media sanitization records; system security plan; other relevant documents or records].

Interview: [SELECT FROM: Personnel with system maintenance responsibilities; personnel with information security responsibilities; personnel responsible for media sanitization; system or network administrators].

Test: [SELECT FROM: Organizational processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for systems; organizational processes for sanitizing system components; mechanisms supporting or implementing controlled maintenance; mechanisms implementing sanitization of system components].

Discussion¶

Source: NIST SP 800-171 Rev. 2, p. 28.

This requirement addresses the information security aspects of system maintenance that are performed off-site and applies to all types of maintenance to any system component (including applications) conducted by a local or nonlocal entity (e.g., in-contract, warranty, in-house, software maintenance agreement). NIST SP 800-88 provides guidance on media sanitization.

Further Discussion¶

Sanitization is a process that makes access to data infeasible on media such as a hard drive. The process may overwrite the entire media with a fixed pattern such as binary zeros. In addition to clearing the data an organization could purge (e.g., degaussing, secure erasing, or disassembling) the data, or even destroy the media (e.g., incinerating, shredding, or pulverizing). Performing one of these activities ensures that the data is extremely hard to recover, thus ensuring its confidentiality. For additional guidance on which specific sanitization actions should be taken on any specific type of media, review the description of the Purge actions given in NIST SP 800-88 Revision 1 – Guidelines for Media Sanitization.

Examples¶

• You manage your organization’s IT equipment. A recent DoD project has been using a storage array to house CUI. Recently, the array has experienced disk issues. After troubleshooting with the vendor, they recommend several drives be replaced in the array. Knowing the drives may contain CUI, you reference NIST 800-88 Rev. 1 and determine a strategy you can implement on the defective equipment – processing the drives with a degaussing unit [a]. Once all the drives have been wiped, you document the action and ship the faulty drives to the vendor.

Potential Assessment Considerations¶

• Is there a process for sanitizing (e.g., erasing, wiping, degaussing) equipment that was used to store, process, or transmit CUI before it is removed from the facility for off-site maintenance (e.g., manufacturer or contracted maintenance support) [a]?

Key References¶

• NIST SP 800-171 Rev. 2 3.7.3

MA.L2-3.7.4 – Media Inspection¶

Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

Assessment Objectives¶

Source: NIST SP 800-171A, p. 39.

Determine if:

• [a] media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, p. 39.

Examine: [SELECT FROM: System maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; maintenance records; system security plan; other relevant documents or records].

Interview: [SELECT FROM: Personnel with system maintenance responsibilities; personnel with information security responsibilities].

Test: [SELECT FROM: Organizational process for inspecting media for malicious code; mechanisms supporting or implementing inspection of media used for maintenance].

Discussion¶

Source: NIST SP 800-171 Rev. 2, p. 28.

If, upon inspection of media containing maintenance diagnostic and test programs, organizations determine that the media contain malicious code, the incident is handled consistent with incident handling policies and procedures.

Further Discussion¶

As part of troubleshooting, a vendor may provide a diagnostic application to install on a system. As this is executable code, there is a chance that the file is corrupt or infected with malicious code. Implement procedures to scan any files prior to installation. The same level of scrutiny must be made as with any file a staff member may download. This requirement, MA.L2-3.7.4, extends both SI.L2-3.14.2 and SI.L2-3.14.4. SI.L2-3.14.2 and SI.L2-3.14.4 require the implementation and updating of mechanisms to protect systems from malicious code, and MA.L2-3.7.4 extends this requirement to diagnostic and testing tools.

Examples¶

• You have recently been experiencing performance issues on one of your servers. After troubleshooting for much of the morning, the vendor has asked to install a utility that will collect more data from the server. The file is stored on the vendor’s FTP server. The support technician gives you the FTP site so you can anonymously download the utility file. You also ask him for a hash of the utility file. As you download the file to your local computer, you realize it is compressed. You unzip the file and perform a manual antivirus scan, which reports no issues [a]. To verify the utility file has not been altered, you run an application to see that the hash from the vendor matches.

Potential Assessment Considerations¶

• Are media containing diagnostic and test programs (e.g., downloaded or copied utilities or tools from manufacturer, third-party, or in-house support teams) checked for malicious code (e.g., using antivirus or antimalware scans) before the media are used on organizational systems [a]?

Key References¶

• NIST SP 800-171 Rev. 2 3.7.4

MA.L2-3.7.5 – Nonlocal Maintenance¶

Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.

Assessment Objectives¶

Source: NIST SP 800-171A, pp. 39-40.

Determine if:

• [a] multifactor authentication is used to establish nonlocal maintenance sessions via external network connections; and
• [b] nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, pp. 39-40.

Examine: [SELECT FROM: System maintenance policy; procedures addressing nonlocal system maintenance; system security plan; system design documentation; system configuration settings and associated documentation; maintenance records; diagnostic records; other relevant documents or records].

Interview: [SELECT FROM: Personnel with system maintenance responsibilities; personnel with information security responsibilities; system or network administrators].

Test: [SELECT FROM: Organizational processes for managing nonlocal maintenance; mechanisms implementing, supporting, and managing nonlocal maintenance; mechanisms for strong authentication of nonlocal maintenance diagnostic sessions; mechanisms for terminating nonlocal maintenance sessions and network connections].

Discussion¶

Source: NIST SP 800-171 Rev. 2, p. 28.

Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through an external network. The authentication techniques employed in the establishment of these nonlocal maintenance and diagnostic sessions reflect the network access requirements in IA.L2-3.5.3.

Further Discussion¶

Nonlocal maintenance activities must use multifactor authentication. Multifactor authentication requires at least two factors, such as:

• something you know (e.g., password, personal identification number [PIN]);
• something you have (e.g., cryptographic identification device, token); or
• something you are (e.g., biometric fingerprint or facial scan).

Requiring two or more factors to prove your identity increases the security of the connection. Nonlocal maintenance activities are activities conducted from external network connections such as over the internet. After nonlocal maintenance activities are complete, shut down the external network connection. This requirement, MA.L2-3.7.5 specifies the addition of multifactor authentication for remote maintenance sessions and complements five other requirements dealing with remote access (AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.13, AC.L2-3.1.15, and IA.L2-3.5.3):

• AC.L2-3.1.12 requires the control of remote access sessions.
• AC.L2-3.1.14 limits remote access to specific access control points.
• AC.L2-3.1.13 requires the use of cryptographic mechanisms when enabling remote sessions.
• AC.L2-3.1.15 requires authorization for privileged commands executed during a remote session.
• Finally, IA.L2-3.5.3 requires multifactor authentication for network access to non-privileged accounts.

Examples¶

• You are responsible for maintaining your company’s firewall. In order to conduct maintenance while working remotely, you connect to the firewall’s management interface and log in using administrator credentials. The firewall then sends a verification request to the multifactor authentication app on your smartphone [a]. You need both of these things to prove your identity [a]. After you respond to the multifactor challenge, you have access to the maintenance interface. When you finish your activities, you shut down the remote connection by logging out and quitting your web browser [b].

Potential Assessment Considerations¶

• Is multifactor authentication required prior to maintenance of a system when connecting remotely from outside the system boundary [a]?
• Are personnel required to manually terminate remote maintenance sessions established via external network connections when maintenance is complete, or are connections terminated automatically through system session management mechanisms [b]?

Key References¶

• NIST SP 800-171 Rev. 2 3.7.5

MA.L2-3.7.6 – Maintenance Personnel¶

Supervise the maintenance activities of maintenance personnel without required access authorization.

Assessment Objectives¶

Source: NIST SP 800-171A, p. 40.

Determine if:

• [a] maintenance personnel without required access authorization are supervised during maintenance activities.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, p. 40.

Examine: [SELECT FROM: System maintenance policy; procedures addressing maintenance personnel; service provider contracts; service-level agreements; list of authorized personnel; maintenance records; access control records; system security plan; other relevant documents or records].

Interview: [SELECT FROM: Personnel with system maintenance responsibilities; personnel with information security responsibilities].

Test: [SELECT FROM: Organizational processes for authorizing and managing maintenance personnel; mechanisms supporting or implementing authorization of maintenance personnel].

Discussion¶

Source: NIST SP 800-171 Rev. 2, p. 28.

This requirement applies to individuals who are performing hardware or software maintenance on organizational systems, while PE.L2-3.10.1 addresses physical access for individuals whose maintenance duties place them within the physical protection perimeter of the systems (e.g., custodial staff, physical plant maintenance personnel). Individuals not previously identified as authorized maintenance personnel, such as information technology manufacturers, vendors, consultants, and systems integrators, may require privileged access to organizational systems, for example, when required to conduct maintenance activities with little or no notice. Organizations may choose to issue temporary credentials to these individuals based on organizational risk assessments. Temporary credentials may be for one-time use or for very limited time periods.

Further Discussion¶

Individuals without proper permissions must be supervised while conducting maintenance on organizational machines. Consider creating temporary accounts with short-term expiration periods rather than regular user accounts. Additionally, limit the permissions and access these accounts have to the most restrictive settings possible.

Examples¶

• One of your software providers has to come on-site to update the software on your company’s computers. You give the individual a temporary logon and password that expires in 12 hours and is limited to accessing only the computers necessary to complete the work [a]. This gives the technician access long enough to perform the update. You monitor the individual’s physical and network activity while the maintenance is taking place [a] and revoke access when the job is done.

Potential Assessment Considerations¶

• Are there processes for escorting and supervising maintenance personnel without required access authorization (e.g., vendor support personnel, short-term maintenance contractors) during system maintenance [a]?

Key References¶

• NIST SP 800-171 Rev. 2 3.7.6