Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

ma-6

timely maintenance

assessment objective:

Determine if the organization:

ma-6[1]

defines information system components for which maintenance support and/or spare parts are to be obtained;

ma-6[2]

defines the time period within which maintenance support and/or spare parts are to be obtained after a failure;

ma-6[3]

ma-6[3][a]

obtains maintenance support for organization-defined information system components within the organization-defined time period of failure; and/or

ma-6[3][b]

obtains spare parts for organization-defined information system components within the organization-defined time period of failure.

potential assessment methods and objects:

Examine: [select from: Information system maintenance policy; procedures addressing information system maintenance; service provider contracts; service-level agreements; inventory and availability of spare parts; security plan; other relevant documents or records].

Interview: [select from: Organizational personnel with information system maintenance responsibilities; organizational personnel with acquisition responsibilities; organizational personnel with information security responsibilities; system/network administrators].

Test: [select from: Organizational processes for ensuring timely maintenance].