MA-3(3) Prevent Unauthorized Removal
Control enhancement of MA-3 Maintenance Tools
Control
Prevent the removal of maintenance equipment containing organizational information by:
Verifying that there is no organizational information contained on the equipment;
Sanitizing or destroying the equipment;
Retaining the equipment within the facility; or
Obtaining an exemption from [Assignment: personnel or roles] explicitly authorizing removal of the equipment from the facility.
Discussion
Organizational information includes all information owned by organizations and any information provided to organizations for which the organizations serve as information stewards.
Related controls
Need MA-3(3) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.