ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > Discussion

MA-3 Maintenance Tools - Discussion
Family: Maintenance (MA)

Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues associated with maintenance tools that are not within system authorization boundaries and are used specifically for diagnostic and repair actions on organizational systems. Organizations have flexibility in determining roles for the approval of maintenance tools and how that approval is documented. A periodic review of maintenance tools facilitates the withdrawal of approval for outdated, unsupported, irrelevant, or no-longer-used tools. Maintenance tools can include hardware, software, and firmware items and may be pre-installed, brought in with maintenance personnel on media, cloud-based, or downloaded from a website. Such tools can be vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and subsequently into systems. Maintenance tools can include hardware and software diagnostic test equipment and packet sniffers. The hardware and software components that support maintenance and are a part of the system (including the software implementing utilities such as "ping," "ls," "ipconfig," or the hardware and software implementing the monitoring port of an Ethernet switch) are not addressed by maintenance tools.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(1) > Discussion

MA-3(1) Inspect Tools - Discussion
Family: Maintenance (MA) > MA-3 Maintenance Tools

Maintenance tools can be directly brought into a facility by maintenance personnel or downloaded from a vendor's website. If, upon inspection of the maintenance tools, organizations determine that the tools have been modified in an improper manner or the tools contain malicious code, the incident is handled consistent with organizational policies and procedures for incident handling.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(1)

MA-3(1) Maintenance Tools | Inspect Tools
Family: Maintenance (MA) > MA-3 Maintenance Tools

Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(2) > Discussion

MA-3(2) Inspect Media - Discussion
Family: Maintenance (MA) > MA-3 Maintenance Tools

If, upon inspection of media containing maintenance, diagnostic, and test programs, organizations determine that the media contains malicious code, the incident is handled consistent with organizational incident handling policies and procedures.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(2)

MA-3(2) Maintenance Tools | Inspect Media
Family: Maintenance (MA) > MA-3 Maintenance Tools

Check media containing diagnostic and test programs for malicious code before the media are used in the system.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(3) > Discussion

MA-3(3) Prevent Unauthorized Removal - Discussion
Family: Maintenance (MA) > MA-3 Maintenance Tools

Organizational information includes all information owned by organizations and any information provided to organizations for which the organizations serve as information stewards.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(3)

MA-3(3) Maintenance Tools | Prevent Unauthorized Removal
Family: Maintenance (MA) > MA-3 Maintenance Tools

Prevent the removal of maintenance equipment containing organizational information by:
(a) Verifying that there is no organizational information contained on the equipment;
(b) Sanitizing or destroying the equipment;
(c) Retaining the equipment within the facility; or
(d) Obtaining an exemption from [Assignment: organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(4) > Discussion

MA-3(4) Restricted Tool Use - Discussion
Family: Maintenance (MA) > MA-3 Maintenance Tools

Restricting the use of maintenance tools to only authorized personnel applies to systems that are used to carry out maintenance functions.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(4)

MA-3(4) Maintenance Tools | Restricted Tool Use
Family: Maintenance (MA) > MA-3 Maintenance Tools

Restrict the use of maintenance tools to authorized personnel only.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(5) > Discussion

MA-3(5) Execution with Privilege - Discussion
Family: Maintenance (MA) > MA-3 Maintenance Tools

Maintenance tools that execute with increased system privilege can result in unauthorized access to organizational information and assets that would otherwise be inaccessible.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(5)

MA-3(5) Maintenance Tools | Execution with Privilege
Family: Maintenance (MA) > MA-3 Maintenance Tools

Monitor the use of maintenance tools that execute with increased privilege.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(6) > Discussion

MA-3(6) Software Updates and Patches - Discussion
Family: Maintenance (MA) > MA-3 Maintenance Tools

Maintenance tools using outdated and/or unpatched software can provide a threat vector for adversaries and result in a significant vulnerability for organizations.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3 > MA-3(6)

MA-3(6) Maintenance Tools | Software Updates and Patches
Family: Maintenance (MA) > MA-3 Maintenance Tools

Inspect maintenance tools to ensure the latest software updates and patches are installed.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4

MA-4 Nonlocal Maintenance
Family: Maintenance (MA)

a. Approve and monitor nonlocal maintenance and diagnostic activities;
b. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;
c. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;
d. Maintain records for nonlocal maintenance and diagnostic activities; and
e. Terminate session and network connections when nonlocal maintenance is completed.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > Discussion

MA-4 Nonlocal Maintenance - Discussion
Family: Maintenance (MA)

Nonlocal maintenance and diagnostic activities are conducted by individuals who communicate through either an external or internal network. Local maintenance and diagnostic activities are carried out by individuals who are physically present at the system location and not communicating across a network connection. Authentication techniques used to establish nonlocal maintenance and diagnostic sessions reflect the network access requirements in [IA-2](#ia-2) . Strong authentication requires authenticators that are resistant to replay attacks and employ multi-factor authentication. Strong authenticators include PKI where certificates are stored on a token protected by a password, passphrase, or biometric. Enforcing requirements in [MA-4](#ma-4) is accomplished, in part, by other controls. [SP 800-63B](#e59c5a7c-8b1f-49ca-8de0-6ee0882180ce) provides additional guidance on strong authentication and authenticators.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(1) > Discussion

MA-4(1) Logging and Review - Discussion
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

Audit logging for nonlocal maintenance is enforced by [AU-2](#au-2) . Audit events are defined in [AU-2a](#au-2_smt.a).
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(1)

MA-4(1) Nonlocal Maintenance | Logging and Review
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

(a) Log [Assignment: organization-defined organization-defined audit events] for nonlocal maintenance and diagnostic sessions; and
(b) Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(3) > Discussion

MA-4(3) Comparable Security and Sanitization - Discussion
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

Comparable security capability on systems, diagnostic tools, and equipment providing maintenance services implies that the implemented controls on those systems, tools, and equipment are at least as comprehensive as the controls on the system being serviced.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(3)

MA-4(3) Nonlocal Maintenance | Comparable Security and Sanitization
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

(a) Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; or
(b) Remove the component to be serviced from the system prior to nonlocal maintenance or diagnostic services; sanitize the component (for organizational information); and after the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(4) > Discussion

MA-4(4) Authentication and Separation of Maintenance Sessions - Discussion
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

Communications paths can be logically separated using encryption.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(4)

MA-4(4) Nonlocal Maintenance | Authentication and Separation of Maintenance Sessions
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

Protect nonlocal maintenance sessions by:
(a) Employing [Assignment: organization-defined authenticators that are replay resistant] ; and
(b) Separating the maintenance sessions from other network sessions with the system by either:
(1) Physically separated communications paths; or
(2) Logically separated communications paths.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(5) > Discussion

MA-4(5) Approvals and Notifications - Discussion
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

Notification may be performed by maintenance personnel. Approval of nonlocal maintenance is accomplished by personnel with sufficient information security and system knowledge to determine the appropriateness of the proposed maintenance.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(5)

MA-4(5) Nonlocal Maintenance | Approvals and Notifications
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

(a) Require the approval of each nonlocal maintenance session by [Assignment: organization-defined personnel or roles] ; and
(b) Notify the following personnel or roles of the date and time of planned nonlocal maintenance: [Assignment: organization-defined personnel and roles].
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(6) > Discussion

MA-4(6) Cryptographic Protection - Discussion
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

Failure to protect nonlocal maintenance and diagnostic communications can result in unauthorized individuals gaining access to organizational information. Unauthorized access during remote maintenance sessions can result in a variety of hostile actions, including malicious code insertion, unauthorized changes to system parameters, and exfiltration of organizational information. Such actions can result in the loss or degradation of mission or business capabilities.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(6)

MA-4(6) Nonlocal Maintenance | Cryptographic Protection
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

Implement the following cryptographic mechanisms to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications: [Assignment: organization-defined cryptographic mechanisms].
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(7) > Discussion

MA-4(7) Disconnect Verification - Discussion
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

Verifying the termination of a connection once maintenance is completed ensures that connections established during nonlocal maintenance and diagnostic sessions have been terminated and are no longer available for use.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-4 > MA-4(7)

MA-4(7) Nonlocal Maintenance | Disconnect Verification
Family: Maintenance (MA) > MA-4 Nonlocal Maintenance

Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5

MA-5 Maintenance Personnel
Family: Maintenance (MA)

a. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
b. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and
c. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5 > Discussion

MA-5 Maintenance Personnel - Discussion
Family: Maintenance (MA)

Maintenance personnel refers to individuals who perform hardware or software maintenance on organizational systems, while [PE-2](#pe-2) addresses physical access for individuals whose maintenance duties place them within the physical protection perimeter of the systems. Technical competence of supervising individuals relates to the maintenance performed on the systems, while having required access authorizations refers to maintenance on and near the systems. Individuals not previously identified as authorized maintenance personnel-such as information technology manufacturers, vendors, systems integrators, and consultants-may require privileged access to organizational systems, such as when they are required to conduct maintenance activities with little or no notice. Based on organizational assessments of risk, organizations may issue temporary credentials to these individuals. Temporary credentials may be for one-time use or for very limited time periods.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5 > MA-5(1) > Discussion

MA-5(1) Individuals Without Appropriate Access - Discussion
Family: Maintenance (MA) > MA-5 Maintenance Personnel

Procedures for individuals who lack appropriate security clearances or who are not U.S. citizens are intended to deny visual and electronic access to classified or controlled unclassified information contained on organizational systems. Procedures for the use of maintenance personnel can be documented in security plans for the systems.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5 > MA-5(1)

MA-5(1) Maintenance Personnel | Individuals Without Appropriate Access
Family: Maintenance (MA) > MA-5 Maintenance Personnel

(a) Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:
(1) Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified; and
(2) Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and
(b) Develop and implement [Assignment: organization-defined alternate controls] in the event a system component cannot be sanitized, removed, or disconnected from the system.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5 > MA-5(2) > Discussion

MA-5(2) Security Clearances for Classified Systems - Discussion
Family: Maintenance (MA) > MA-5 Maintenance Personnel

Personnel who conduct maintenance on organizational systems may be exposed to classified information during the course of their maintenance activities. To mitigate the inherent risk of such exposure, organizations use maintenance personnel that are cleared (i.e., possess security clearances) to the classification level of the information stored on the system.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5 > MA-5(2)

MA-5(2) Maintenance Personnel | Security Clearances for Classified Systems
Family: Maintenance (MA) > MA-5 Maintenance Personnel

Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for compartments of information on the system.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5 > MA-5(3) > Discussion

MA-5(3) Citizenship Requirements for Classified Systems - Discussion
Family: Maintenance (MA) > MA-5 Maintenance Personnel

Personnel who conduct maintenance on organizational systems may be exposed to classified information during the course of their maintenance activities. If access to classified information on organizational systems is restricted to U.S. citizens, the same restriction is applied to personnel performing maintenance on those systems.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5 > MA-5(3)

MA-5(3) Maintenance Personnel | Citizenship Requirements for Classified Systems
Family: Maintenance (MA) > MA-5 Maintenance Personnel

Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5 > MA-5(4) > Discussion

MA-5(4) Foreign Nationals - Discussion
Family: Maintenance (MA) > MA-5 Maintenance Personnel

Personnel who conduct maintenance and diagnostic activities on organizational systems may be exposed to classified information. If non-U.S. citizens are permitted to perform maintenance and diagnostics activities on classified systems, then additional vetting is required to ensure agreements and restrictions are not being violated.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5 > MA-5(4)

MA-5(4) Maintenance Personnel | Foreign Nationals
Family: Maintenance (MA) > MA-5 Maintenance Personnel

Ensure that:
(a) Foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments; and
(b) Approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5 > MA-5(5) > Discussion

MA-5(5) Non-system Maintenance - Discussion
Family: Maintenance (MA) > MA-5 Maintenance Personnel

Personnel who perform maintenance activities in other capacities not directly related to the system include physical plant personnel and custodial personnel.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-5 > MA-5(5)

MA-5(5) Maintenance Personnel | Non-system Maintenance
Family: Maintenance (MA) > MA-5 Maintenance Personnel

Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorizations.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-6

MA-6 Timely Maintenance
Family: Maintenance (MA)

Obtain maintenance support and/or spare parts for [Assignment: organization-defined system components] within [Assignment: organization-defined time period] of failure.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-6 > Discussion

MA-6 Timely Maintenance - Discussion
Family: Maintenance (MA)

Organizations specify the system components that result in increased risk to organizational operations and assets, individuals, other organizations, or the Nation when the functionality provided by those components is not operational. Organizational actions to obtain maintenance support include having appropriate contracts in place.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-6 > MA-6(1) > Discussion

MA-6(1) Preventive Maintenance - Discussion
Family: Maintenance (MA) > MA-6 Timely Maintenance

Preventive maintenance includes proactive care and the servicing of system components to maintain organizational equipment and facilities in satisfactory operating condition. Such maintenance provides for the systematic inspection, tests, measurements, adjustments, parts replacement, detection, and correction of incipient failures either before they occur or before they develop into major defects. The primary goal of preventive maintenance is to avoid or mitigate the consequences of equipment failures. Preventive maintenance is designed to preserve and restore equipment reliability by replacing worn components before they fail. Methods of determining what preventive (or other) failure management policies to apply include original equipment manufacturer recommendations; statistical failure records; expert opinion; maintenance that has already been conducted on similar equipment; requirements of codes, laws, or regulations within a jurisdiction; or measured values and performance indications.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-6 > MA-6(1)

MA-6(1) Timely Maintenance | Preventive Maintenance
Family: Maintenance (MA) > MA-6 Timely Maintenance

Perform preventive maintenance on [Assignment: organization-defined system components] at [Assignment: organization-defined time intervals].
Security and Privacy Controls for Information Systems and Organizations
MA > MA-6 > MA-6(2) > Discussion

MA-6(2) Predictive Maintenance - Discussion
Family: Maintenance (MA) > MA-6 Timely Maintenance

Predictive maintenance evaluates the condition of equipment by performing periodic or continuous (online) equipment condition monitoring. The goal of predictive maintenance is to perform maintenance at a scheduled time when the maintenance activity is most cost-effective and before the equipment loses performance within a threshold. The predictive component of predictive maintenance stems from the objective of predicting the future trend of the equipment's condition. The predictive maintenance approach employs principles of statistical process control to determine at what point in the future maintenance activities will be appropriate. Most predictive maintenance inspections are performed while equipment is in service, thus minimizing disruption of normal system operations. Predictive maintenance can result in substantial cost savings and higher system reliability.