Control Number Assessment Number CCI Confidentiality Integrity Availability Assessment Procedures Reference MA-1 MA-1 (a) High Moderate Low High Moderate Low High Moderate Low The being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system. Automatically compliant with this CCI because they are covered at the DoD level MA-1 MA-1 (a) High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system. Automatically compliant with this CCI because they are covered at the DoD level MA-1 MA-1 (a) (1) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented maintenance policy to ensure the organization inspected/assessed develops and documents a system maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
MA-1 MA-1 (b) (1) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of occurrence of reviews and update actions for the maintenance policy to ensure review is occurring every 5 years and updates are made as necessary. DoD has defined the frequency as every 5 years. MA-1 MA-1 (b) (1) High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as every 5 years. Automatically compliant with this CCI because they are covered at the DoD level MA-1 MA-1 (b) (2) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of occurrence of reviews and update actions for the maintenance procedures to ensure annual review and necessary updates are occurring. DoD has defined the frequency as annually. MA-1 MA-1 (b) (2) High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as annually. Automatically compliant with this CCI because they are covered at the DoD MA-2 (2) MA-2 (2) (a) High High High The organization conducting the inspection/assessment obtains and examines the documentation of automated mechanisms to ensure the organization inspected/assessed employs automated mechanisms to schedule, conduct, and document repairs. The system is not considered a HIGH level. Therefore, this AP is not applicable.
MA-2 MA-2 (a) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the record of maintenance to ensure the organization being inspected/assessed schedules maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements. MA-2 MA-2 (a) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of repairs to ensure the organization being inspected/assessed documents repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements. MA-2 MA-2 (a) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of maintenance to ensure the organization being inspected/assessed documents maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements. MA-2 MA-2 (a) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews records of repairs on information system components in accordance with manufacturer or vendor specifications and/or
MA-5 (1) MA-5 (1) (a) (2) High High High The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed sanitizes, removes, or physically disconnects all nonvolatile storage media from the system prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals. The system is not considered a HIGH Therefore, this AP is not applicable. MA-5 (1) MA-5 (1) (b) High High High The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system. The system is not considered a HIGH level. Therefore, this AP is not applicable. MA-5 (2) MA-5 (2) blank blank The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system. NIST has not allocated this AP. Therefore, this AP is not applicable.
MA-6 (3) MA-6 (3) blank blank blank The organization conducting the inspection/assessment obtains and examines documentation of automated mechanisms to ensure the organization being inspected/assessed employs automated mechanisms to transfer predictive maintenance data to a computerized maintenance management system. NIST has not allocated this AP. Therefore, this AP is not applicable. ENCLOSURE 1 – AUTHORIZED MAINTENANCE PERSONNEL AUTHORIZED MAINTENANCE PERSONNEL Name Company Contact Information Authorized Systems