MA-5(1)—Maintenance Personnel
PBMM (P2)
Secret (P2)
Operational
>Control Description
MAINTENANCE PERSONNEL | INDIVIDUALS WITHOUT APPROPRIATE ACCESS (a) The organization implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not Canadian citizens, that include the following requirements: - Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified; - Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the information system are sanitized and all non-volatile storage media are removed or physically disconnected from the system and secured; and (b) The organization develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.
>Supplemental Guidance
This control enhancement denies individuals who lack appropriate security clearances (i.e., individuals who do not possess security clearances or possess security clearances at a lower level than required) or who are not Canadian citizens, visual and electronic access to any Classified or Protected information contained on organizational information systems. Procedures for the use of maintenance personnel can be documented in security plans for the information systems. Related controls: MP-6, PL-2.
Ask AI
Configure your API key to use AI features.