MA-1 Policy and procedures for maintenance
Requires a maintenance policy with supporting procedures to be developed, approved, disseminated to defined personnel, owned by a named official, and reviewed and updated on a defined frequency and after defined events.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Approved maintenance policy with scope, approver and date · Policy repository / GRC workspace
- Evidence the maintenance policy reached the personnel or roles it defines · Policy repository / GRC workspace
- Written designation of the official accountable for the maintenance policy and procedures · Policy repository / GRC workspace
- Procedures covering scheduled maintenance, tools, remote maintenance and personnel · Policy repository / GRC workspace
- Review record for the maintenance policy and procedures against the defined frequency and triggering events · Policy repository / GRC workspace
First move
Common gaps auditors find
- Policy addresses hardware maintenance only and ignores remote vendor support sessions
- Cloud and managed service maintenance treated as out of scope with no substitute controls
- No review cadence defined for the maintenance policy, so it silently ages
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIR-9 Information Spillage Response. Respond to information spills by: Assigning [organization-defined] with responsibility for responding to information spills; Identifying the specific information involved in the system contamination; Alerting [organization-defined] of the information spill using a · MA-2 Controlled maintenance