3.7.3: Ensure equipment removed for off-site maintenance is sanitized of any CUI

Control Family:

Maintenance

Control Type:

Derived

CSF v1.1 References:

Discussion

This requirement addresses the information security aspects of system maintenance that are performed off-site and applies to all types of maintenance to any system component (including applications) conducted by a local or nonlocal entity (e.g., in-contract, warranty, in- house, software maintenance agreement).

[SP 800-88] provides guidance on media sanitization.