Description:
This requirement applies to individuals who are performing hardware or software maintenance on organizational systems, while 3.0. addresses physical access for individuals whose maintenance duties place them within the physical protection perimeter of the systems (e.g., custodial staff, physical plant maintenance personnel). Individuals not previously identified as authorized maintenance personnel, such as information technology manufacturers, vendors, consultants, and systems integrators, may require privileged access to organizational systems, for example, when required to conduct maintenance activities with little or no notice. Organizations may choose to issue temporary credentials to these individuals based on organizational risk assessments. Temporary credentials may be for one-time use or for very limited time periods.
Priority: High
Category: Maintenance
Services Associated with AWS:
- AWS CloudTrail, AWS CloudWatch, AWS Security Hub
Objective Evidence:
- Administrative: documented policies, standards & procedures
- Administrative: supporting documentation of role-based security training being performed
- Administrative: supporting documentation of professional competence by individual(s) performing maintenance roles
- Administrative: supporting documentation to demonstrate how Role-Based Physical Access Control (PAC) is implemented to control maintenance personnel access
- Administrative: supporting documentation to demonstrate how Third-Party Service Providers (TSP) are controlled while on-premise
- Administrative: supporting documentation of visitor access logs
- Technical: screenshot of Configuration Management Database (CMDB) ticket
Possible Technology Considerations :
- Session Recording (logging)
- Physical Access Control (PAC)
What needs to be answered :
Are all activities of maintenance personnel (who do not normally have access to a system) monitored? Has the company defined approved methods for supervision?
- Supervise Maintenance Activities of Authorized Personnel
Description: This check ensures that organizations have appropriate supervision and oversight of maintenance activities conducted by authorized personnel. It is important to monitor and supervise maintenance activities to ensure that they are performed in accordance with established procedures and to mitigate the risk of unauthorized actions or access. Supervision may include direct observation, periodic reviews, or other methods of monitoring maintenance activities.
More Details:
No unauthorized maintenance personnel used to conduct system maintenance.