Task 2 RMF_Information System Maintenance Plan.docx

{COMMAND}

{SYSTEM NAME} {ACRONYM}

System Version: {VERSION} eMASS# {EMASS#}

Confidentiality: {CONFIDENTIALITY} Integrity: {INTEGRITY} Availability: {AVAILABILITY}

Department of the {SERVICE}

{LOGO}

Information System Maintenance Plan Document Version: 1.0.0

{DATE}

Prepared by: {ORGANIZATION}

DISTRIBUTION IS LIMITED TO U.S. GOVERNMENT AGENCIES AND THEIR CONTRACTORS.

OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO: {ORGANIZATION}

Change Record

Table of Contents

FOR OFFICIAL USE ONLY

{ACRONYM} {DATE}

INFORMATION SYSTEM MAINTENANCE PLAN

Template developed by:

http://www.i-assure.com FOR OFFICIAL USE ONLY

1.0 OVERVIEW

Information systems must have security controls in place to protect the maintenance activities that enable the system to function correctly. Maintenance activities include diagnosing and correcting hardware, firmware, and software problems; loading, maintaining, and updating software, device drivers, configuration settings, etc., and maintaining a historical record of system changes. Such activities may be conducted in-house or by individuals communicating through an external, non-organization controlled network (e.g., the Internet) further exposing systems to attack.

This plan ensures that {ACRONYM} maintenance, diagnostic, and repair activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location, are managed and monitored to preserve the confidentiality, integrity, and availability of {ACRONYM} information system resources.

This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in Appendix A, “Detailed Compliance Matrix”.

Table 1 - SP-800-53v4 Compliance Matrix

{ACRONYM} shall ensure all maintenance, diagnostic, and repair activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location, are managed and monitored to preserve the confidentiality, integrity, and availability of {ACRONYM}’s information systems.

2.2 Scope

This Information System Maintenance Plan applies to {ACRONYM} and its components.

b) Ensure that personnel performing maintenance on the information system have required access authorizations

c) Explicitly approve the removal of information system or system components from organizational facilities for off-site maintenance or repairs

b) Sanitize equipment prior to offsite maintenance

c) Checks security controls following maintenance

d) Maintain system maintenance records

e) Maintain a list of authorized maintenance personnel including third-party maintenance providers.

f) Inspect all maintenance tools brought into a facility by maintenance personnel for obvious improper modifications

g) Check all diagnostic and test program media for malicious code before use

b) Checks security controls following maintenance

c) Ensure that personnel performing maintenance on the information system have required access authorizations

d) Maintain a list of authorized maintenance personnel including third-party maintenance providers.

e) Inspect all maintenance tools brought into a facility by maintenance personnel for obvious improper modifications

f) Check all diagnostic and test program media for malicious code before use

Table 2 - Roles and Responsibilities

2.4 Coordination

The System Owner is responsible for coordinating all maintenance activities within the {ACRONYM} and with any external, third-party vendors. In addition, the System Owner will ensure coordination with other internal entities such as the Configuration Control Board.

Preventive maintenance is used to ensure maximum reliability of data center equipment by providing systematic inspections, detection and correction of incipient failures, either before they occur or before they develop into major defects that result in costly downtime. Preventive maintenance can include activities such as inspections, tests, measurements, adjustments, parts replacement, and general housekeeping practices.

3.1.2 Controlled Maintenance

Controlled maintenance is performed on an information system or components (software or hardware) which are scheduled and performed in accordance with manufacturer, vendor or agency specifications.

3.1.3 Corrective Maintenance

Corrective maintenance occurs when a system abruptly fails or generates an error condition a corrective maintenance task is performed to repair or replace failed components (software or hardware) so the system can be restored to an operational condition as soon as possible. Corrective maintenance may be performed by in-house personnel or outside vendors under a service agreement.

3.2 Maintenance Tools

Information system maintenance tools carried into a facility by personnel for usage on {ACRONYM} systems must be checked for obvious improper modifications. Media containing diagnostics software must be scanned for malicious code (e.g. virus, malware, Trojan) before the media is utilized as part of maintenance and repair activities.

3.3 Verification of Security Features

After maintenance is performed, the system will be assessed utilizing the Assured Compliance Assessment Solution (ACAS), DISA Security Technical Implementation Guide (STIG) and Security Content Automation Protocol (SCAP) tools to determine if maintenance activities introduced any vulnerabilities. Specific attention will be given to new account creation, modified groups and introduction of new remote access capabilities. The maintenance activity is not considered complete until this action is performed.

3.4 Sanitization

The Media Protection Plan will be followed to ensure a process that renders access to target data on the media infeasible for a given level of effort.

4.0 NONLOCAL MAINTENANCE

Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network; either an external network (e.g., the Internet) or an internal network.

Does {ACRONYM} perform nonlocal maintenance?

☐ No

☐ Yes

If yes, complete Sections 4.1 – 4.6 If no, replace the test in Sections 4.1 – 4.6 with, “N/A – nonlocal maintenance is not performed.”

4.1 Audit

The ISSO will ensure that auditing is set per STIG requirements and the security event log is reviewed immediately after maintenance is performed.

Does {ACRONYM} implement auditing per the STIG and is it reviewed after maintenance is performed?

☐ No

☐ Yes

4.2 Authentication

Any non-local system maintenance must be approved by the system owner and employ strong identification and authentication techniques in the establishment of non-local maintenance and diagnostic sessions. If password-based authentication is used during remote maintenance of {ACRONYM} systems, passwords must be changed following each remote maintenance service.

Does {ACRONYM} approve nonlocal maintenance?

☐ No

☐ Yes

If yes, are strong passwords utilized?

☐ No

☐ Yes

If yes, are passwords changed after maintenance is performed?

☐ No

☐ Yes

4.3 Authorization

Maintenance personnel must either have the required access authorizations or be supervised by designated {ACRONYM} personnel with the required access authorizations. Individuals supervising maintenance personnel must be technically competent in order to supervise information system maintenance.

Do maintenance have required access, or supervised?

☐ No

☐ Yes

If yes, are supervisors technically competent?

☐ No

☐ Yes

4.4 Records

All nonlocal maintenance will be documented utilizing the form provided in Enclosure 2, “Authorized Third Party Maintenance Personnel” and Enclosure 4, “Maintenance Log”.

Do maintenance records exist?

☐ No

☐ Yes

4.5 Connectivity

In the event remote connectivity is used to perform maintenance, the enclave boundary defense will be specifically configured to allow only the authorized external IP Address inbound connectivity. Credentials will only be given for the asset on which maintenance is performed. Immediately after maintenance is performed, all remote access will be terminated. All access will be implemented utilizing technologies that meet FIP 140-2 encryption requirements.

Is remote connectivity used to establish nonlocal maintenance sessions?

☐ No

☐ Yes

If yes, are only authorized IP Addresses permitted?

☐ No

☐ Yes

If yes, is FIPS 140-2 encryption used to establish remote sessions?

☐ No

☐ Yes

If yes, are sessions terminated after maintenance is completed?

☐ No

☐ Yes

4.6 Sanitization

{ACRONYM} information assets or system components must not be moved off-site from facilities for maintenance or repairs without approval from the system owner. Prior to removal from facilities for off-site maintenance or repairs equipment must be sanitized to remove all information from associated media. Following any maintenance activity security controls must be checked to verify functionality.

Are {ACRONYM} assets or components moved offsite for maintenance or repairs?

☐ No

☐ Yes

If yes, did the {ACRONYM} authorize the repairs?

☐ No

☐ Yes

If yes, was all information sanitized prior to shipping?

☐ No

☐ Yes

5.0 MAINTENANCE SUPPORT

Maintenance Support, including parts and spares is important to ensure the availability of the {ACRONYM} systems.

Are personnel available to support the information system within 24 hours of failure?

☐ No

☐ Yes

Are spares/parts available to support the information system within 24 hours of failure?

☐ No

☐ Yes System Components are listed in Enclosure 3, “Maintenance Support for System Components”

APPENDIX A – DETAILED COMPLIANCE MATRIX

The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations".

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the maintenance policy via the inspected organization's information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated to the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.

DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.

External Link

Moderate Low High Moderate Low High Moderate

The organization conducting the inspection/assessment examines the maintenance procedures via the inspected organization's information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated to the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.

DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.

External Link

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the Security Plan to ensure maintenance procedures are documented and are developed IAW maintenance policy provided in DoDI 8500.01..

Section 3

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of occurrence of reviews and update actions for the maintenance policy to ensure review is occurring every 5 years and updates are made as necessary.

DoD has defined the frequency as every 5 years.

Change Record

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as every 5 years.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of occurrence of reviews and update actions for the maintenance procedures to ensure annual review and necessary updates are occurring.

DoD has defined the frequency as annually.

Change Record

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Enclosure 4

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Enclosure 4

Moderate Low High Moderate Low High Moderate Low

Enclosure 4

Moderate Low High Moderate Low High Moderate Low

Enclosure 4

Moderate Low High Moderate Low High Moderate Low

Enclosure 4

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles who can explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.

DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.

Section 2.3

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines: 1. the organization's risk management strategy to ensure the personnel or roles defined in MA-2, CCI 2874 have been designated to approve the removal of the information system or system components;

2. and written records of approval for the removal of the information system or system components from organizational facilities for off-site maintenance or repairs to ensure the removal is explicitly approved.

Section 2.3

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented maintenance-related information to ensure the organization being inspected/assessed defines the maintenance-related information to include in organizational maintenance records.

DoD has determined the maintenance-related information is not appropriate to define at the Enterprise level.

Enclosure 4

Moderate Low High Moderate Low High Moderate Low

High Moderate Low

The organization conducting the inspection/assessment:

1. obtains and examines the Security Plan to ensure the list of approved maintenance tools is documented;

2. ensures only the approved maintenance tools are used within the system.

Section 3.2

High Moderate Low

The organization conducting the inspection/assessment:

1. obtains and examines the Security Plan to identify the list of approved maintenance tools;

2. ensures the organization being inspected/assessed controls the approved information system maintenance tools.

Section 3.2

High Moderate Low

The organization conducting the inspection/assessment obtains and examines:

1. the Security Plan to identify the list of approved maintenance tools; and

2. documented procedures to identify how the use of maintenance tools is monitored; and

3. reviews evidence that the monitoring is conducted IAW the documented procedures.

Section 3.2

High Moderate

High Moderate Low

Moderate

The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles who can provide an exemption that explicitly authorizes removal of equipment from the facility.

DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.

Section 2.3

For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2883.

NIST has not allocated this AP. Therefore, this AP is not applicable.

High Moderate

The organization conducting the inspection/assessment obtains and examines the documented audit events to ensure the organization being inspected/assessed defines the nonlocal maintenance and diagnostic session audit events to audit.

DoD has determined the audit events are not appropriate to define at the Enterprise level.

Section 4.1

High Moderate

The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to audit nonlocal maintenance and diagnostic sessions' organization-defined audit events.

For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2884.

Section 4.1

High Moderate

Enclosure 4

High Moderate

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines contracts and/or service level agreements for all non-local maintenance and diagnostic services to ensure that any IS used for those services is required to have security level at least as high as the security level implemented on the IS being serviced.

Alternatively, the organization conducting the inspection/assessment ensures the organization being inspected/assessed complies with MA-4 (3) CCIs 883 and 1631.

External Link

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines maintenance procedures for all non-local maintenance and diagnostic services to ensure that the organization being inspected/assessed sanitizes components before removal from organizational facilities.

Alternatively, the organization conducting the inspection/assessment ensures the organization being inspected/assessed complies with MA-4 (3) CCI 882.

Section 4.6

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines maintenance procedures for all non-local maintenance and diagnostic services to ensure that the organization being inspected/assessed sanitizes and inspects serviced components prior to reusing them on any information system.

Alternatively, the organization conducting the inspection/assessment ensures the organization being inspected/assessed complies with MA-4 (3) CCI 882.

Section 3.4 Section 4.6

DoD has determined the authenticators are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 884.

NIST has not allocated this AP. Therefore, this AP is not applicable.

For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1632.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has defined the personnel or roles as the ISSO.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has defined the personnel or roles as the ISSO.

Automatically compliant with this CCI because they are covered at the DoD level

DoD has defined the personnel or roles as the user base which could be impacted by the maintenance event.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has defined the personnel or roles as the user base which could be impacted by the maintenance event.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.

For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2890.

Section 4.5

Moderate Low High Moderate Low

The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 3123.

Tier-4

High Moderate Low

The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement remote disconnect verification at the termination of nonlocal maintenance and diagnostic sessions.

For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2891.

Section 4.5

High Moderate Low

The organization conducting the inspection/assessment obtains and examines:

1. the Security Plan to ensure the procedures for approving non-local maintenance and diagnostic activities are documented; and

2. records approving non-local maintenance and diagnostic activities.

Enclosure 2

High Moderate Low

The organization conducting the inspection/assessment obtains and examines:

1. the Security Plan to identify the authorized non-local maintenance and diagnostic activities; and

2. documented procedures to identify how the use of non-local maintenance and diagnostic activities are monitored; and

3. reviews evidence that the monitoring is conducted IAW the documented procedures.

Section 4 Enclosure 2

High Moderate Low

The organization conducting the inspection/assessment obtains and examines:

1. the Security Plan to ensure non-local maintenance and diagnostic tools have been identified; and

2. maintenance records to ensure only those tools allowed are used IAW MA-4, CCI 873.

Section 4 Enclosure 2

High Moderate Low

The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.

For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 877.

Section 4.2

High Moderate Low

Enclosure 4

High Moderate Low

Section 4.5

Moderate Low High Moderate Low High Moderate Low

Enclosure 2

Moderate Low High Moderate Low High Moderate Low

Enclosure 2

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

High

The organization conducting the inspection/assessment obtains evidence that maintenance support is available for information system components defined in MA-6, CCI 2896 and that the support will be provided within 24 hours (Low and Moderate Availability) or immediately upon failure for (High Availability).

Evidence can include maintenance support contracts, inventories of spare parts, etc.

DoD has defined the time period as within 24 hours (Low and Moderate Availability) or immediately upon failure for (High Availability).

Section 5

High

The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components for which it obtains maintenance support and/or spare parts.

DoD has determined the information system components are not appropriate to define at the Enterprise level.

Section 5

High

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the time period as within 24 hours (Low and Moderate Availability) or immediately upon failure for (High Availability).

Automatically compliant with this CCI because they are covered at the DoD level

DoD has determined the information system components are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the time intervals are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the information system components are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the time intervals are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

ENCLOSURE 1 – AUTHORIZED MAINTENANCE PERSONNEL

AUTHORIZED MAINTENANCE PERSONNEL

Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text.

ENCLOSURE 2 – AUTHORIZED THIRD PARTY MAINTENANCE PERSONNEL

AUTHORIZED THIRD PARTY MAINTENANCE PERSONNEL

Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text.

ENCLOSURE 3 – MAINTENANCE SUPPORT FOR SYSTEM COMPONENTS

{ACRONYM}

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

Choose an item. Choose an item.

ENCLOSURE 4 – MAINTENANCE LOG