MA-3: Maintenance Tools
Control Family:
CSF v1.1 References:
PF v1.0 References:
Threats Addressed:
Next Version:
- NIST Special Publication 800-53 Revision 5.2.0:
- MA-3: Maintenance Tools
Control Statement
The organization approves, controls, and monitors information system maintenance tools.
Supplemental Guidance
This control addresses security-related issues associated with maintenance tools used specifically for diagnostic and repair actions on organizational information systems. Maintenance tools can include hardware, software, and firmware items. Maintenance tools are potential vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and subsequently into organizational information systems. Maintenance tools can include, for example, hardware/software diagnostic test equipment and hardware/software packet sniffers. This control does not cover hardware/software components that may support information system maintenance, yet are a part of the system, for example, the software implementing "ping," "ls," "ipconfig," or the hardware and software implementing the monitoring port of an Ethernet switch.
Control Enhancements
MA-3(1): Inspect Tools
Baseline(s):
- Moderate
- High
The organization inspects the maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.
MA-3(2): Inspect Media
Baseline(s):
- Moderate
- High
The organization checks media containing diagnostic and test programs for malicious code before the media are used in the information system.
MA-3(3): Prevent Unauthorized Removal
Baseline(s):
- High
The organization prevents the unauthorized removal of maintenance equipment containing organizational information by: Verifying that there is no organizational information contained on the equipment; Sanitizing or destroying the equipment; Retaining the equipment within the facility; or Obtaining an exemption from [Assignment: organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility.
MA-3(4): Restricted Tool Use
Baseline(s):
The information system restricts the use of maintenance tools to authorized personnel only.