Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

ma-6(1)

timely maintenance  | preventive maintenance

assessment objective:

Determine if the organization:

ma-6(1)[1]

defines information system components on which preventive maintenance is to be performed;

ma-6(1)[2]

defines time intervals within which preventive maintenance is to be performed on organization-defined information system components; and

ma-6(1)[3]

performs preventive maintenance on organization-defined information system components at organization-defined time intervals.

potential assessment methods and objects:

Examine: [select from: Information system maintenance policy; procedures addressing information system maintenance; service provider contracts; service-level agreements; security plan; maintenance records; list of system components requiring preventive maintenance; other relevant documents or records].

Interview: [select from: Organizational personnel with information system maintenance responsibilities; organizational personnel with information security responsibilities; system/network administrators].

Test: [select from: Organizational processes for preventive maintenance; automated mechanisms supporting and/or implementing preventive maintenance].