Level 5 CMMC - CMMC Practices

MA.3.116  

Reference: CMMC 1.02

Family: MA

Level Introduced: 3

Practice:
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

CMMC Clarification:
As part of troubleshooting a vendor may provide a diagnostic application to install on a system. The vendor is using the application to help identify the cause of issues on the system. As this is executable code there is a chance that the file is corrupt or infected with malicious code. Implement procedures to scan any files prior to installation. The same level of scrutiny must be made as with any file a staff member may download.

Example
You’ve recently been experiencing performance issues on one of your servers. After troubleshooting for much of the morning the vendor has asked to install a utility that will collect more data from the server. The file is stored on their FTP server. The support technician gives you the FTP site so you can anonymously download the utility file. You also ask him for a hash of the utility file. As you download the file to your local computer you realize it is compressed. While you have anti-virus on your server you don’t want to cause any issues that may further impact business operations. On your desktop you unzip the file. Once the file is unzipped you open your local anti-virus and perform a manual scan of the utility file. The scan reports no issues. To further verify the utility file has not been tampered you run an application to see that the hash from the vendor matches.

3.7.4

Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

Discussion:
If, upon inspection of media containing maintenance diagnostic and test programs, organizations determine that the media contain malicious code, the incident is handled consistent with incident handling policies and procedures.

Source: NIST Special Publication 800-171 Rev. 2

MA-3 (2)

MAINTENANCE TOOLS | INSPECT MEDIA

Description:
The organization checks media containing diagnostic and test programs for malicious code before the media are used in the information system.

Supplemental Guidance:
If, upon inspection of media containing maintenance diagnostic and test programs, organizations determine that the media contain malicious code, the incident is handled consistent with organizational incident handling policies and procedures. Related control: SI-3.

Source: NIST Special Publication 800-53 Rev. 4

Source: CMMC v1.02