Interview a sample of organizational personnel with information system maintenance responsibilitiesfor further evidence that the mechanisms and configurations are being applied. MA-4 (2) Examine security plan for evidence that the plan includes policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections for the information system. MA-5 Examine information system maintenance policy, procedures addressing maintenance personnel, security plan, or other relevant documents for the process established for maintenance personnel authorization. Interview a sample of organizational personnel with information system maintenance responsibilitiesfor further evidence of a maintenance process. Examine maintenance authorizations associated with the process for a list of authorized maintenance organizations or personnel. Examine the maintenance process for the measures to be employed to ensure that personnel performing maintenance on the information system have the required access authorizations. Examine the process for non-escorted maintenance personnel who do not possess the required access authorizations to perform information system maintenance without supervision. Examine the process for the designated organizational personnel with required access authorizations and technical competence deemed necessary to supervise information system maintenance performed by the designated maintenance personnel. Examine access authorizations for a sample of maintenance personnel identified in maintenance records for the information system for evidence that the measures are being applied to ensure personnel performing maintenance on the information system have the required access authorizations. Examine maintenance records for information system maintenance performed by maintenance personnel for evidence that the designated organizational personnel supervise information system maintenance when maintenance personnel do not possess the required access authorizations. Interview a sample of organizational personnel with information system maintenance responsibilitiesfor further evidence that the measures are being applied to ensure personnel performing maintenance on the information system have the required access authorizations. Interview a sample of organizational personnelfor further evidence that these individuals have the required access authorizations and technical competence deemed necessary to supervise information system maintenance performed by the maintenance personnel.
Interview a sample of organizational personnel with information system maintenance responsibilitiesfor further evidence that the mechanisms and configurations are being applied. MA-4 (2) Examine security plan for evidence that the plan includes policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections for the information system. MA-5 Examine information system maintenance policy, procedures addressing maintenance personnel, security plan, or other relevant documents for the process established for maintenance personnel authorization. Interview a sample of organizational personnel with information system maintenance responsibilitiesfor further evidence of a maintenance process. Examine maintenance authorizations associated with the process for a list of authorized maintenance organizations or personnel. Examine the maintenance process for the measures to be employed to ensure that personnel performing maintenance on the information system have the required access authorizations. Examine the process for non-escorted maintenance personnel who do not possess the required access authorizations to perform information system maintenance without supervision. Examine the process for the designated organizational personnel with required access authorizations and technical competence deemed necessary to supervise information system maintenance performed by the designated maintenance personnel. Examine access authorizations for a sample of maintenance personnel identified in maintenance records for the information system for evidence that the measures are being applied to ensure personnel performing maintenance on the information system have the required access authorizations. Examine maintenance records for information system maintenance performed by maintenance personnel for evidence that the designated organizational personnel supervise information system maintenance when maintenance personnel do not possess the required access authorizations. Interview a sample of organizational personnel with information system maintenance responsibilitiesfor further evidence that the measures are being applied to ensure personnel performing maintenance on the information system have the required access authorizations. Interview a sample of organizational personnelfor further evidence that these individuals have the required access authorizations and technical competence deemed necessary to supervise information system maintenance performed by the maintenance personnel.
FedRAMP-Test-Cases-v2.0.1.docx