Rev. 3 maintenance requirements: control of maintenance tools and equipment that may hold CUI, nonlocal (remote) maintenance and authorization and supervision of maintenance personnel.
Approving, controlling and monitoring maintenance tools, scanning diagnostic media for malicious code before use, and keeping maintenance equipment that holds CUI from leaving unless it is cleared, sanitized or destroyed. Rev. 3 split Rev. 2's 3.7.2 between this requirement and 03.07.06.
Approving and monitoring maintenance and diagnostics performed over a network, using multi-factor and replay-resistant authentication for those sessions and ending connections when the work is complete.
Authorizing maintenance personnel, keeping a list of authorized maintenance organizations or people, verifying unescorted staff hold the required access authorizations and supervising those who do not.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.