MA-3(2)

Requirement

Check media containing diagnostic and test programs for malicious code before the media are used in the system.

Discussion

If, upon inspection of media containing maintenance, diagnostic, and test programs, organizations determine that the media contains malicious code, the incident is handled consistent with organizational incident handling policies and procedures.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; maintenance records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational process for inspecting media for malicious code; mechanisms supporting and/or implementing the inspection of media used for maintenance].

ID	Assessment Objectives
MA-03(02)	media containing diagnostic and test programs are checked for malicious code before the media are used in the system.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!