MA.L2-3.7.5 Nonlocal Maintenance
Authenticate nonlocal maintenance sessions opened across external networks using multiple factors, and close those sessions once the maintenance work finishes.
3
artefacts
1
held by a system
1
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Multifactor configuration for nonlocal maintenance access · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Records of maintenance session establishment and termination · HR system / LMS
governing documentDocuments that govern the control
- Procedure requiring termination at completion · HR system / LMS
First move
Start with the 1 of 3 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Vendor maintenance accounts exempt from multifactor
- Sessions left open after work completes
- Termination relies on the vendor rather than the organization
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetMA.L2-3.7.4 Media Inspection · MA.L2-3.7.6 Maintenance Personnel