NIST 800-171 3.7 Maintenance
Maintenance covers how systems are serviced and repaired: scheduled maintenance, controlled tools and technicians, sanitized equipment leaving for repair, checked diagnostic media, protected remote maintenance and supervised visitors.
6 requirementsup to 18 SPRS points2 can go on a CMMC POA&M
The 6 Maintenance requirements
- 3.7.1 System MaintenanceMA.L2-3.7.1Perform maintenance on organizational systems.
- 3.7.2 Maintenance ToolsMA.L2-3.7.2Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
- 3.7.3 Off-Site MaintenanceMA.L2-3.7.3Ensure equipment removed for off-site maintenance is sanitized of any CUI.
- 3.7.4 Diagnostic Media ChecksMA.L2-3.7.4Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
- 3.7.5 Nonlocal MaintenanceMA.L2-3.7.5Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
- 3.7.6 Maintenance PersonnelMA.L2-3.7.6Supervise the maintenance activities of maintenance personnel without required access authorization.
Maintenance: points and the CMMC POA&M
- Q-01
How many SPRS points can the Maintenance family cost?
Up to 18 of the 313 points a score can lose: 2 worth 5 points, 2 worth 3 and 2 worth 1.
- Q-02
Which Maintenance requirements can go on a CMMC POA&M?
2 of the 6: 3.7.3 and 3.7.6, worth 1 point each. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.
Know the family. Keep the evidence for every requirement in it.
- Published
- Last updated
- Unchanged since publication