Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 16 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 1 of 4 

5.16 Maintenance (MA)1 

1. Has the Tribe or TGRA developed, documented, 

and disseminated to organizational personnel with 

system maintenance responsibilities an agencylevel maintenance policy that addresses purpose, 

scope, roles, responsibilities, management 

commitment, coordination among organizational 

entities, and compliance; and is consistent with 

applicable laws, executive orders, directives, 

regulations, policies, standards, and guidelines? 

Does the Tribe or TGRA have procedures to 

facilitate the implementation of the maintenance 

policy and the associated maintenance controls? 

____ 

____ 

____ 

____ 

____ 

____ 

MA-1, a.1(a)(b), 2 

MA-1, a.2 

2. Based on inquiry and record examination, has the 

Tribe or TGRA designated an individual with 

security responsibilities to manage the 

development, documentation, and dissemination 

of the maintenance policy and procedures? 

Does the Tribe or TGRA review and update the 

current maintenance policy annually and 

following any security incidents involving 

unauthorized access to Criminal Justice 

Information (CJI)/ Criminal History Record 

Information (CHRI) or systems used to process, 

store, or transmit CJI / CHRI? 

Does the Tribe or TGRA review and update the 

current maintenance procedures annually and 

following any security incidents involving 

unauthorized access to CJI / CHRI or systems 

used to process, store, or transmit CJI / CHRI? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

MA-1, b 

MA-1, c.1 

MA-1, c.1.2 

 

1

 These requirements are sanctionable for audit beginning October 1, 2024. 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 16 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 2 of 4 

3. Has the Tribe or TGRA scheduled, documented, 

and reviewed records of maintenance, repair, and 

replacement on system components in accordance 

with manufacturer or vendor specifications and/or 

organizational requirements? 

Has the Tribe or TGRA approved and monitored 

all maintenance activities, whether performed on 

site or remotely and whether the system or system 

components are serviced on site or removed to 

another location? 

Has the Tribe or TGRA required that 

organizational personnel with information security 

and privacy responsibilities explicitly approve the 

removal of the system or system components from 

organizational facilities for off-site maintenance, 

repair, or replacement? 

Does the Tribe or TGRA sanitize equipment to 

remove information from associated media prior 

to removal from organizational facilities for offsite maintenance, repair, replacement, or 

destruction? 

Does the Tribe or TGRA check all potentially 

impacted controls to verify that the controls are 

still functioning properly following maintenance, 

repair, or replacement actions? 

Based on records examination, is the following 

information in the Tribe’s or TGRA’s 

maintenance records: 

 Component name? 

 Component serial number? 

 Date/time of maintenance? 

 Maintenance performed? 

 Name(s) of entity performing maintenance 

including escort if required? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

MA-2, a 

MA-2, b 

MA-2, c 

MA-2, d 

MA-2, e 

MA-2, f.1 

MA-2, f.2 

MA-2, f.3 

MA-2, f.4 

MA-2, f.5 

4. Based on inquiry and record examination, has the 

Tribe or TGRA approved, controlled, and 

monitored the use of system maintenance tools? 

And has the Tribe or TGRA reviewed previously 

approved system maintenance tools prior to each 

use? ____ ____ ____ MA-3 a, b 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 16 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 3 of 4 

5. Based on inquiry and record examination, has the 

Tribe or TGRA inspected the maintenance tools 

used by maintenance personnel for improper or 

unauthorized modifications? ____ ____ ____ MA-3 (1) 

6. Based on inquiry and record examination, does 

the Tribe or TGRA check media containing 

diagnostic and test programs for malicious code 

before the media are used in the system? ____ ____ ____ MA-3 (2) 

7. Based on inquiry and record examination, does 

the Tribe or TGRA prevent the removal of 

maintenance equipment containing organizational 

information by: 

 Verifying that there is no organizational 

information contained on the equipment? 

 Sanitizing or destroying the equipment? 

 Retaining the equipment within the 

facility? 

 Obtaining an exemption from 

organizational personnel with system 

maintenance responsibilities explicitly 

authorizing removal of the equipment from 

the facility? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

MA-3 (3), a 

MA-3 (3), b 

MA-3 (3), c 

MA-3 (3), d 

8. Based on inquiry and record examination, does 

the Tribe or TGRA: 

 Approve and monitor nonlocal 

maintenance and diagnostic activities? 

 Allow the use of nonlocal maintenance 

and diagnostic tools only as consistent 

with organizational policy and 

documented in the security plan for the 

system? 

 Employ strong authentication in the 

establishment of nonlocal maintenance and 

diagnostic sessions? 

 Maintain records for nonlocal maintenance 

and diagnostic activities? 

 Terminate session and network 

connections when nonlocal maintenance is 

completed? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

MA-4, a 

MA-4, b 

MA-4, c 

MA-4, d 

MA-4, e 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 16 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 4 of 4 

9. Based on inquiry and record examination, has the 

Tribe or TGRA: 

 Established a process for maintenance 

personnel authorization and maintained a 

list of authorized maintenance 

organizations or personnel? 

 Verified that non-escorted personnel 

performing maintenance on the system 

possess the required access authorizations? 

 Designated organizational personnel with 

required access authorizations and 

technical competence to supervise the 

maintenance activities of personnel who 

do not possess the required access 

authorization? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

MA 5, a 

MA 5, b 

MA 5, c 

10. Based on inquiry and record examination, has the 

Tribe or TGRA obtained maintenance support 

and/or spare parts for critical system components 

that process, store, and transmit CJI / CHRI within 

agency-defined recovery time and recovery point 

objectives of failure? ____ ____ ____ MA-6