MA-5(5)

Requirement

Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorizations.

Discussion

Personnel who perform maintenance activities in other capacities not directly related to the system include physical plant personnel and custodial personnel.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Maintenance policy; procedures addressing maintenance personnel; system media protection policy; access control policy and procedures; physical and environmental protection policy and procedures; maintenance records; access control records; access authorizations; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system maintenance responsibilities; organizational personnel with personnel security responsibilities; organizational personnel with physical access control responsibilities; organizational personnel with information security responsibilities].

ID	Assessment Objectives
MA-05(05)	non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system have required access authorizations.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!