MA-3(4)

Requirement

Restrict the use of maintenance tools to authorized personnel only.

Discussion

Restricting the use of maintenance tools to only authorized personnel applies to systems that are used to carry out maintenance functions.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; list of personnel authorized to use maintenance tools; maintenance tool usage records; maintenance records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for restricting the use of maintenance tools; mechanisms supporting and/or implementing the restricted use of maintenance tools].

CMMC Training

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!