Maintenance

The Maintenance family in NIST 800-171 Rev 2 focuses on ensuring that organizations perform appropriate and secure maintenance on information systems while protecting Controlled Unclassified Information (CUI). This includes managing the maintenance of both physical and virtual components, whether performed on-site or remotely, in a way that prevents unauthorized access or tampering during maintenance activities.

Key Maintenance Requirements in NIST 800-171 Rev 2:

The Maintenance family contains four security requirements that focus on controlling and securing maintenance activities, ensuring that personnel performing maintenance are authorized, and protecting CUI during maintenance.

1. Perform Maintenance on Organizational Systems (3.7.1)

Basic Requirement: Organizations must perform regular and necessary maintenance on their information systems to ensure continued operation and security.

Key Focus:

Conduct scheduled maintenance to ensure systems are updated, patched, and operating efficiently.

Ensure that all maintenance activities are documented, including the purpose and duration of the maintenance.

Maintenance activities should be aligned with security policies to prevent vulnerabilities from being introduced.

Example: Regularly applying security patches and firmware updates to servers, network devices, and workstations.

2. Restrict Maintenance to Authorized Personnel (3.7.2)

Derived Requirement: Only authorized personnel must be allowed to perform maintenance on information systems.

Key Focus:

Ensure that individuals performing maintenance have the necessary authorization and security clearances.

Verify the identity of maintenance personnel before allowing access to sensitive systems.

External personnel (e.g., contractors or vendors) performing maintenance must be carefully vetted and authorized, and their activities should be supervised when necessary.

Example: Requiring that maintenance staff log in using unique credentials and only allowing maintenance by individuals with specific access permissions.

3. Supervise Maintenance Activities (3.7.3)

Derived Requirement: Organizations must supervise maintenance activities when they are performed by external or third-party personnel who are not typically authorized for full access to the system.

Key Focus:

Supervising maintenance performed by vendors, contractors, or external service providers to ensure they do not have unauthorized access to CUI or critical system components.

Implement strict oversight, such as accompanying external personnel during on-site maintenance or monitoring remote maintenance activities in real time.

Supervision ensures that any anomalies during maintenance are caught and corrected before they pose a risk to security.

Example: Having an IT staff member present to monitor external contractors performing system upgrades on critical servers that store CUI.

4. Perform Maintenance Remotely Only with Approval and Protection (3.7.4)

Derived Requirement: Remote maintenance should only be performed with explicit approval and must be conducted securely to protect sensitive information.

Key Focus:

Ensure that remote maintenance sessions are authorized and logged.

Implement strong security controls, such as encryption, multi-factor authentication (MFA), and secure remote access tools, to protect CUI during remote maintenance activities.

After the remote maintenance session is complete, ensure that any remote connections are securely terminated, and access permissions are revoked as appropriate.

Example: Using a secure VPN connection and MFA to allow an authorized vendor to perform remote diagnostics on a system, and ensuring the connection is terminated immediately after the work is done.

Importance of the Maintenance Family in Cybersecurity:

Prevents Unauthorized Access: By restricting maintenance to authorized personnel and supervising third-party maintenance activities, organizations reduce the risk of unauthorized access to critical systems and CUI.

Maintains System Integrity: Regular maintenance ensures that systems remain operational and secure, allowing organizations to stay updated with the latest security patches, firmware updates, and software upgrades that help protect against vulnerabilities.

Minimizes Risk During Maintenance: Maintenance activities can introduce risks if performed improperly. Implementing controls to manage these activities helps prevent accidental or intentional security lapses, such as the introduction of malware or the misconfiguration of systems.

Ensures Secure Remote Maintenance: Remote maintenance is a common necessity but also a security risk. By ensuring that remote maintenance is approved, supervised, and protected, organizations can minimize the chance of remote access being abused by attackers.

Protects CUI During System Upkeep: Since maintenance often requires access to sensitive systems, it’s critical that security controls remain intact during maintenance to prevent CUI from being exposed, modified, or stolen.

Best Practices for Maintenance Activities:

Document Maintenance Procedures: Create clear, documented procedures for both routine and emergency maintenance. This documentation should outline the steps to be taken, the personnel involved, and the security measures required.

Vet and Authorize Personnel: Ensure that anyone performing maintenance (internal staff or external contractors) is fully vetted and has the necessary permissions. Always verify the identity of maintenance personnel before granting access.

Use Secure Tools for Remote Maintenance: When allowing remote maintenance, use secure access methods like encrypted VPNs, MFA, and role-based access control to limit access to only what is necessary.

Monitor Maintenance Activities: Implement monitoring and logging of all maintenance activities, especially those performed remotely or by third parties. Review these logs to ensure that no unauthorized activities occurred during maintenance.

Supervise External Personnel: When maintenance is performed by external personnel (e.g., contractors, vendors), ensure that they are supervised at all times or have their activities logged for later review. For highly sensitive systems, consider physically accompanying the external party during maintenance.

Secure Termination of Access: After maintenance is completed, ensure that any temporary accounts, remote connections, or elevated privileges used during the maintenance are revoked or terminated to avoid lingering security risks.

Summary:

The Maintenance family in NIST 800-171 Rev 2 is critical for ensuring that maintenance activities on information systems, particularly those containing CUI, are performed securely and by authorized personnel. By establishing clear procedures, restricting access, supervising external personnel, and ensuring secure remote maintenance, organizations can protect their systems and sensitive data from unauthorized access, tampering, and accidental exposure during routine or emergency maintenance activities. These controls help ensure that systems remain operational, secure, and compliant with security requirements.