MA-3 (1) Maintenance Tools | Inspect Tools (M) (H)

NIST 800-53 (r4) Control:

The organization inspects the maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.

NIST 800-53 (r4) Supplemental Guidance:

If, upon inspection of maintenance tools, organizations determine that the tools have been modified in an improper/unauthorized manner or contain malicious code, the incident is handled consistent with organizational policies and procedures for incident handling. Related control: SI-7.

References: NIST Special Publication 800-88.

NIST 800-53 (r5) Discussion:

Maintenance tools can be directly brought into a facility by maintenance personnel or downloaded from a vendor’s website. If, upon inspection of the maintenance tools, organizations determine that the tools have been modified in an improper manner or the tools contain malicious code, the incident is handled consistent with organizational policies and procedures for incident handling.

38North Guidance:

Meets Minimum Requirement:

• There are procedures in place to inspect maintenance tools for improper or unauthorized modifications

• There are procedures in place for handling the incident if modification is detected

• There is evidence that shows the procedures have been consistently followed, and who is responsible for inspecting the tools

Best Practice:

• TBD

Unofficial FedRAMP Guidance: None

Assessment Evidence:

• Procedures for inspecting maintenance tools

• Artifacts/evidence to show that the procedures have been followed in the past, with relevant information (e.g. determination and actions taken if a modification was detected)

CSP Implementation Tips:

• Amazon Web Services (AWS): Fully Inherited

• Microsoft Azure: Fully Inherited

• Google Cloud Platform: Fully Inherited