MA-3: Maintenance Tools
Control Family:
CSF v1.1 References:
PF v1.0 References:
Threats Addressed:
Previous Version:
- NIST Special Publication 800-53 Revision 4:
- MA-3: Maintenance Tools
Control Statement
- Approve, control, and monitor the use of system maintenance tools; and
- Review previously approved system maintenance tools [Assignment: organization-defined frequency].
Supplemental Guidance
Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues associated with maintenance tools that are not within system authorization boundaries and are used specifically for diagnostic and repair actions on organizational systems. Organizations have flexibility in determining roles for the approval of maintenance tools and how that approval is documented. A periodic review of maintenance tools facilitates the withdrawal of approval for outdated, unsupported, irrelevant, or no-longer-used tools. Maintenance tools can include hardware, software, and firmware items and may be pre-installed, brought in with maintenance personnel on media, cloud-based, or downloaded from a website. Such tools can be vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and subsequently into systems. Maintenance tools can include hardware and software diagnostic test equipment and packet sniffers. The hardware and software components that support maintenance and are a part of the system (including the software implementing utilities such as "ping," "ls," "ipconfig," or the hardware and software implementing the monitoring port of an Ethernet switch) are not addressed by maintenance tools.
Control Enhancements
MA-3(1): Inspect Tools
Baseline(s):
- Moderate
- High
Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.
MA-3(2): Inspect Media
Baseline(s):
- Moderate
- High
Check media containing diagnostic and test programs for malicious code before the media are used in the system.
MA-3(3): Prevent Unauthorized Removal
Baseline(s):
- Moderate
- High
Prevent the removal of maintenance equipment containing organizational information by: Verifying that there is no organizational information contained on the equipment; Sanitizing or destroying the equipment; Retaining the equipment within the facility; or Obtaining an exemption from [Assignment: organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility.
MA-3(4): Restricted Tool Use
Baseline(s):
Restrict the use of maintenance tools to authorized personnel only.
MA-3(5): Execution with Privilege
Baseline(s):
Monitor the use of maintenance tools that execute with increased privilege.
MA-3(6): Software Updates and Patches
Baseline(s):
Inspect maintenance tools to ensure the latest software updates and patches are installed.