MA-3(1)

Requirement

Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.

Discussion

Maintenance tools can be directly brought into a facility by maintenance personnel or downloaded from a vendor's website. If, upon inspection of the maintenance tools, organizations determine that the tools have been modified in an improper manner or the tools contain malicious code, the incident is handled consistent with organizational policies and procedures for incident handling.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; maintenance tool inspection records; maintenance records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for inspecting maintenance tools; mechanisms supporting and/or implementing the inspection of maintenance tools].

ID	Assessment Objectives
MA-03(01)	maintenance tools used by maintenance personnel are inspected for improper or unauthorized modifications.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!