The organization: MA-2a.
Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements; MA-2b.
Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location; MA-2c.
Requires that Assignment: organization-defined personnel or roles explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs; MA-2d.
Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs; MA-2e.
Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and MA-2f.
Includes Assignment: organization-defined maintenance-related information in organizational maintenance records.