PR.PS-03: Hardware is maintained, replaced, and removed commensurate with risk

Info icon.

Subcategory is new to this version of the framework and incorporates the following items from the previous version: PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition, PR.MA-1: Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

3rd: 3rd Party Risk

Ex1: Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities

Ex2: Define and implement plans for hardware end-of-life maintenance support and obsolescence

Ex3: Perform hardware disposal in a secure, responsible, and auditable manner

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

SC-51: Hardware-based Protection

Employ hardware-based, write-protect for [Assignment: organization-defined system firmware components] ; and Implement specific procedures for [Assignment: organization-defined authorized individuals] to manually disable hardware write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.

Cloud Controls Matrix v4.0

DCS-01: Off-Site Equipment Disposal Policy and Procedures

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the secure disposal of equipment used outside the organization's premises. If the equipment is not physically destroyed a data destruction procedure that renders recovery of information impossible must be applied. Review and update the policies and procedures at least annually.

DSP-02: Secure Disposal

Apply industry accepted methods for the secure disposal of data from storage media such that data is not recoverable by any forensic means.

TVM-03: Vulnerability Remediation Schedule

Define, implement and evaluate processes, procedures and technical measures to enable both scheduled and emergency responses to vulnerability identifications, based on the identified risk.

Critical Security Controls Version 8.1

1.2: Address Unauthorized Assets

Ensure that a process exists to address unauthorized assets on a weekly basis. The enterprise may choose to remove the asset from the network, deny the asset from connecting remotely to the network, or quarantine the asset.