MA-2—Controlled Maintenance

Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;

Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;

Require that ⚙organization-defined personnel or roles explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;

Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: ⚙organization-defined information;

Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and

Include the following information in organizational maintenance records: ⚙organization-defined information.