MA-4(5)

Requirement
1. Require the approval of each nonlocal maintenance session by [Assignment: organization-defined personnel or roles]; and
2. Notify the following personnel or roles of the date and time of planned nonlocal maintenance: [Assignment: organization-defined personnel or roles].

Discussion

Notification may be performed by maintenance personnel. Approval of nonlocal maintenance is accomplished by personnel with sufficient information security and system knowledge to determine the appropriateness of the proposed maintenance.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Maintenance policy; procedures addressing nonlocal system maintenance; notifications supporting nonlocal maintenance sessions; maintenance records; audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system maintenance responsibilities; organizational personnel with notification responsibilities; organizational personnel with approval responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for approving and notifying personnel regarding nonlocal maintenance; mechanisms supporting the notification and approval of nonlocal maintenance].

ID	Assessment Objectives
MA-04(05)(b)	<MA-04(05)_ODP[02] personnel and roles> is/are notified of the date and time of planned nonlocal maintenance.
MA-04(05)(a)	the approval of each nonlocal maintenance session is required by <MA-04(05)_ODP[01] personnel or roles>;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!