Repairs and upkeep done without opening a door to the information. 6 requirements, 3.7.1 to 3.7.6, 2 of them worth 5 points.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
Keep computers, network equipment and software maintained, with updates and repairs done on a schedule.
Usually applies to: Computers, phones, network equipment, printers and copiers, and software in scope.
Official wording: “Perform maintenance on organizational systems.”
Control the tools and the people that do maintenance: who your IT helper is, which remote tools they use and what they can reach.
Usually applies to: Your IT company or technician, and the tools they use: remote-support software, diagnostic tools and administrator accounts.
Official wording: “Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.”
Before a computer or phone goes out for repair, securely wipe any DoD shipment information from it, or take out the drive.
Usually applies to: Computers, phones, tablets and copiers sent out for repair or warranty service.
Official wording: “Ensure equipment removed for off-site maintenance is sanitized of any CUI.”
Scan any USB drive or disc a technician brings before it is used on your systems.
Usually applies to: USB drives, discs and diagnostic tools a technician brings in.
Official wording: “Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.”
Remote maintenance over the internet requires multifactor sign-in, and the connection is closed when the work is done.
Usually applies to: Remote support sessions by your IT company or a vendor's support desk.
Official wording: “Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.”
A technician who has not been approved for access, such as a copier repair person, is supervised while working on your systems.
Usually applies to: Copier, phone-system and other repair technicians who work in your office without approved access.
Official wording: “Supervise the maintenance activities of maintenance personnel without required access authorization.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
