CMMC 1.0 Practice MA.2.112 Requirement:
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
CMMC 1.0 MA.2.112 Requirement Explanation:
Unapproved tools may be malicious and can damage your environment. Only use tools approved by your company to conduct maintenance.
Example CMMC 1.0 MA.2.112 Implementation:
Establish a list of approved maintenance tools. This can be specified in your IT standard operating procedures. Examples of maintenance tools include network packet sniffers and software used to deploy updates to your systems. Only allow your system admins to use approved tools. Unapproved tools may be malicious and can damage your environment.
CMMC 1.0 MA.2.112 Scenario(s):
- Scenario 1:
Alice, a system administrator wants to update the drivers on an employees Dell laptop. She decides to use a "driver update" tool she found online. After using the tool she documents it in a ticket. The IT manager notices that Alice didn't use the approved driver update tool from Dell. He warns Alice to only use approved maintenance tools.
- Scenario 2:
Joe is a security analyst and needs to capture packets on his network. The approved tool for capturing packets is WireShark however Joe decides to use another too. Joe's manager discovers that Joe has used an approved tool and warns him not to do so going forward.
Quick & Simple
Discover Our Cybersecurity Compliance Solutions:
Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you
NIST SP 800-171 & CMMC Compliance
Become compliant, provide compliance services, or verify partner compliance with NIST SP 800-171 and CMMC requirements.
HIPAA Compliance
Become compliant, provide compliance services, or verify partner compliance with HIPAA security rule requirements.
FAR 52.204-21 Compliance
Become compliant, provide compliance services, or verify partner compliance with FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems requirements.
ISO 27001 Compliance
Become compliant, provide compliance services, or verify partner compliance with ISO 27001 requirements.