MA-5 (1) MA-5 (1) (a) High High High The organization The system is not (2) conducting the considered a HIGH inspection/assessment Therefore, this obtains and examines the AP is not applicable. documented process to ensure the organization being inspected/assessed sanitizes, removes, or physically disconnects all nonvolatile storage media from the system prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals. MA-5 (1) MA-5 (1) (b) High High High The organization The system is not conducting the considered a HIGH inspection/assessment level. Therefore, this obtains and examines the AP is not applicable. documented process to ensure the organization being inspected/assessed develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system. MA-5 (2) blank blank The organization NIST has not allocated MA-5 (2) conducting the this AP. Therefore, this inspection/assessment AP is not applicable. obtains and examines the documented process to ensure the organization being inspected/assessed ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system.
MA-5 (1) MA-5 (1) (a) (2) High High High The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed sanitizes, removes, or physically disconnects all nonvolatile storage media from the system prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals. The system is not considered a HIGH Therefore, this AP is not applicable. MA-5 (1) MA-5 (1) (b) High High High The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system. The system is not considered a HIGH level. Therefore, this AP is not applicable. MA-5 (2) MA-5 (2) blank blank The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system. NIST has not allocated this AP. Therefore, this AP is not applicable.
RMF_Information-System-Maintenance-Plan.docx