MNT-02.1: Automated Maintenance Activities
Automated mechanisms exist to schedule, conduct and document maintenance and repairs.
Control Question: Does the organization use automated mechanisms to schedule, conduct and document maintenance and repairs?
General (8)
| Framework | Mapping Values |
|---|---|
| GovRAMP High | MA-02(02) |
| NIST 800-53 R4 | MA-2(2) |
| NIST 800-53 R4 (high) | MA-2(2) |
| NIST 800-53 R5 (source) | MA-2(2) |
| NIST 800-53B R5 (high) (source) | MA-2(2) |
| NIST 800-82 R3 HIGH OT Overlay | MA-2(2) |
| NIST 800-161 R1 | MA-2(2) |
| NIST 800-161 R1 Level 3 | MA-2(2) |
US (4)
| Framework | Mapping Values |
|---|---|
| US FedRAMP R4 | MA-2(2) |
| US FedRAMP R4 (high) | MA-2(2) |
| US FedRAMP R5 (source) | MA-2(2) |
| US FedRAMP R5 (high) (source) | MA-2(2) |
Capability Maturity Model
Level 0 — Not Performed
There is no evidence of a capability to schedule, conduct and document maintenance and repairs.
Level 1 — Performed Informally
C|P-CMM1 is N/A, since a structured process is required to schedule, conduct and document maintenance and repairs.
Level 2 — Planned & Tracked
C|P-CMM2 is N/A, since a well-defined process is required to schedule, conduct and document maintenance and repairs.
Level 3 — Well Defined
Maintenance (MNT) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- IT/cybersecurity personnel develop and disseminate formal practices to implement enterprise-wide capability to conduct secure and timely technology asset-specific maintenance operations, including preventative and reactionary maintenance operations.
- Technology asset-related maintenance operations are centralized in terms of change management and governance. Local/regional practices fall under the broader enterprise-wide technology asset maintenance program.
- Facilities management uses an enterprise-wide process to facilitate the secure and timely implementation of non-IT maintenance operations, including preventative and reactionary maintenance operations. Local/regional practices fall under the broader enterprise-wide facilities management program.
- A Change Control Board (CCB), or similar function, centrally manages the process of IT and non-IT maintenance operations to reduce the chance of business interruptions from maintenance operations.
- Maintenance controls are primarily administrative in nature (e.g., policies & standards) to manage change control processes associated with maintenance operations, but are assisted by technology-based tools to report on maintenance status (e.g., missing patches, outdated software versions, etc.).
Level 4 — Quantitatively Controlled
See C|P-CMM3. There are no defined C|P-CMM4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to schedule, conduct and document maintenance and repairs.
Level 5 — Continuously Improving
See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to schedule, conduct and document maintenance and repairs.
Assessment Objectives
- MNT-02.1_A01 automated mechanisms used to schedule maintenance, repair and replacement actions for the system, application and/or service are defined.
- MNT-02.1_A02 automated mechanisms used to conduct maintenance, repair and replacement actions for the system, application and/or service are defined.
- MNT-02.1_A03 automated mechanisms used to document maintenance, repair and replacement actions for the system, application and/or service are defined.
- MNT-02.1_A04 automated mechanisms are used to schedule maintenance, repair and replacement actions for the system, application and/or service.
- MNT-02.1_A05 automated mechanisms are used to conduct maintenance, repair and replacement actions for the system, application and/or service.
- MNT-02.1_A06 automated mechanisms are used to document maintenance, repair and replacement actions for the system, application and/or service.
- MNT-02.1_A07 up-to-date, accurate and complete records of all maintenance actions requested, scheduled, in process and completed are produced.
- MNT-02.1_A08 up-to-date, accurate and complete records of all repair actions requested, scheduled, in process and completed are produced.
- MNT-02.1_A09 up-to-date, accurate and complete records of all replacement actions requested, scheduled, in process and completed are produced.