Maintenance Management

Maintenance Management A. Each agency must establish and maintain procedures and processes for performing maintenance on agency IT systems. 1. Ensure all potentially impacted security controls are still functioning properly following maintenance, repair, or replacement actions. 2. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location. B. Each agency must approve, control, and monitor the use of system maintenance tools. C. Each agency must ensure equipment removed for off-site maintenance is sanitized of any sensitive or confidential information. D. Each agency must assess media containing diagnostic and test programs for malicious code before the media are used in agency IT systems. E. Each agency must require multifactor authentication to establish maintenance sessions via external (nonlocal) network connections and terminate such connections when maintenance session is complete. F. Each agency must supervise the maintenance activities of maintenance personnel without required access authorization.