Level 5 CMMC - CMMC Practices

MA.3.115  

Reference: CMMC 1.02

Family: MA

Level Introduced: 3

Practice:
Ensure equipment removed for off-site maintenance is sanitized of any CUI.

CMMC Clarification:
Sanitization is a process that makes access to data infeasible on media such as a hard drive. The process may overwrite the entire media with a fixed pattern such as binary zeros. In addition to clearing the data an organization could purge (e.g., degaussing, secure erasing, or disassembling) the data, or even destroy the media (e.g., incinerating, shredding, or pulverizing). By performing one of these activities the data is extremely hard to recover, thus ensuring its confidentiality.

If additional guidance on which specific sanitization actions should be taken on any specific type of media, consider reviewing the description of the Purge actions given in NIST SP 800-88 Revision 1 - Guidelines for Media Sanitization.

Example
You manage the IT equipment that is used for your organization. A recent Department of Defense (DoD) project has been using a storage array for DoD Controlled Unclassified Information (CUI). Recently the array has experienced disk issues. After troubleshooting with the vendor they recommend several drives be replaced in the array. Knowing the drives may have CUI information you plan to run software on the drives using software that performs a wipe pattern that removes any data and device protection across the entire drive. Once all the drives have been wiped you document the action and ship the faulty drives to the vendor.

3.7.3

Ensure equipment removed for off-site maintenance is sanitized of any CUI.

Discussion:
This requirement addresses the information security aspects of system maintenance that are performed off-site and applies to all types of maintenance to any system component (including applications) conducted by a local or nonlocal entity (e.g., in-contract, warranty, in- house, software maintenance agreement).

[SP 800-88] provides guidance on media sanitization.

Source: NIST Special Publication 800-171 Rev. 2

MA-2

CONTROLLED MAINTENANCE

Description:
The organization:
    a. Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
    b. Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;
    c. Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;
    d. Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;
    e. Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and
    f. Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.

Supplemental Guidance:
This control addresses the information security aspects of the information system maintenance program and applies to all types of maintenance to any system component (including applications) conducted by any local or nonlocal entity (e.g., in-contract, warranty, in-house, software maintenance agreement). System maintenance also includes those components not directly associated with information processing and/or data/information retention such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes, for example: (i) date and time of maintenance; (ii) name of individuals or group performing the maintenance; (iii) name of escort, if necessary; (iv) a description of the maintenance performed; and (v) information system components/equipment removed or replaced (including identification numbers, if applicable). The level of detail included in maintenance records can be informed by the security categories of organizational information systems. Organizations consider supply chain issues associated with replacement components for information systems. Related controls: CM-3, CM-4, MA-4, MP-6, PE-16, SA-12, SI-2.

Source: NIST Special Publication 800-53 Rev. 4

Source: CMMC v1.02