CMMC Requirement MA.L2-3.7.6 – Maintenance Personnel: Supervise the maintenance activities of personnel without required access authorization.
Recommendations for implementing CMMC control MA.L2-3.7.6 This Blog provides tips on how to secure remote access. There are links within the document to additional articles. This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2. This link provides specific processes you can use, and how those strategies can be applied to some of the different types of vendor engagements you need to support. From the Department of Homeland Security, these are recommended practices for configuring and managing remote access for control systems covering various roles including vendors, field technicians, business partners (all of which may have differing requirements.) NIST resource that defines processes for maintenance personnel. Implementation guidance for CMMC control MA.L2-3.7.6
This requirement applies to individuals who are performing hardware or software maintenance on organizational systems, while PE.L1-3.10.1 addresses physical access for individuals whose maintenance duties place them within the physical protection perimeterof the systems (e.g., custodial staff, physical plant maintenance personnel). Individuals not previously identified as authorized maintenance personnel, such as information technology manufacturers, vendors, consultants, and systems integrators, may require privileged access to organizational systems, for example, when required to conduct maintenance activities with little or no notice. Organizations may choose to issue temporary credentials to these individuals based on organizational risk assessments. Temporary credentials may be for one-time use or for very limited time periods.
Further Discussion
Individuals without proper permissions must be supervised while conducting maintenance on organizational machines. Consider creating temporary accounts with short-term expiration periods rather than regular user accounts. Additionally, limit the permissions and access these accounts have to the most restrictive settings possible.