800-53 · MA Maintenance
MA-2
Controlled Maintenance
Official texta. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
b. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
c. Require that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
d. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: organization-defined information];
e. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
f. Include the following information in organizational maintenance records: [Assignment: organization-defined information].NIST SP 800-53 Rev 5.2 control statement (public domain)
b. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
c. Require that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
d. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: organization-defined information];
e. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
f. Include the following information in organizational maintenance records: [Assignment: organization-defined information].NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| ISO 27001 | A.7.10A.7.13A.8.10 | Storage media; Equipment maintenance… | Crosswalk | NIST SP 800-53 → ISO 27001 mapping8 loosely related (not mappings)A.5.9 Inventory of information and other associated assets Only shares CSF ID.AM-08: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF ID.AM-08: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF ID.AM-08: related, not a mapping |
| CIS v8.1 | CIS 1.1CIS 3.5CIS 1.2CIS 1.3 | Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data… | No mapping. Only shares CSF ID.AM-08: related, not a mapping+5 more loosely related (not mappings)CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads | |
| SOC 2 | CC6.1 | Logical access security over information assets | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| PCI DSS | 6.2.16.2.26.2.36.2.3.1 | Bespoke and custom software developed securely; Developers trained in secure software development… | No mapping. Only shares CSF ID.AM-08: related, not a mapping+5 more loosely related (not mappings)6.2.4 Coding techniques prevent common software attacks Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads | |
| CMMC | MA.L2-3.7.1MA.L2-3.7.2MA.L2-3.7.3 | Perform Maintenance; System Maintenance Control… | Crosswalk | NIST SP 800-171r2 Appendix D2 loosely related (not mappings) |
| HIPAA | §164.310(a)(2)(iv) | Maintenance Records | Crosswalk | NIST HIPAA → SP 800-53 crosswalk13 loosely related (not mappings)§164.308(b)(4) Written Contract or Other Arrangement Only shares CSF ID.AM-08: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF ID.AM-08: related, not a mapping §164.314(b)(2)(i) Group Health Plan Implementation Specification Only shares CSF ID.AM-08: related, not a mapping …and 5 more in the downloads |
| GDPR | Art.30(1) | Records of processing activities | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| NIS2 | 6.212.4 | Secure development life cycle; Asset inventory | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| DORA | Art.8(1)Art.8(4)Art.8(6) | Identification; Identification… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| CPS 234 | Para 20 | Classify information assets by criticality and sensitivity | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF ID.AM-08: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.