Requirement text: MA.3.116: Check media containing diagnostic and test programs for malicious code
before the media are used in organizational systems.
DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
If, upon inspection of media containing maintenance diagnostic and test programs,
organizations determine that the media contain malicious code, the incident is handled
consistent with incident handling policies and procedures.
CMMC CLARIFICATION
As part of troubleshooting a vendor may provide a diagnostic application to install on a
system. The vendor is using the application to help identify the cause of issues on the system.
As this is executable code there is a chance that the file is corrupt or infected with malicious
code. Implement procedures to scan any files prior to installation. The same level of scrutiny
must be made as with any file a staff member may download.
Example
You’ve recently been experiencing performance issues on one of your servers. After
troubleshooting for much of the morning the vendor has asked to install a utility that will
collect more data from the server. The file is stored on their FTP server. The support
technician gives you the FTP site so you can anonymously download the utility file. You also
ask him for a hash of the utility file. As you download the file to your local computer you
realize it is compressed. While you have anti-virus on your server you don’t want to cause
any issues that may further impact business operations. On your desktop you unzip the file.
Once the file is unzipped you open your local anti-virus and perform a manual scan of the
utility file. The scan reports no issues. To further verify the utility file has not been tampered
you run an application to see that the hash from the vendor matches.
References
• NIST SP 800-171 Rev 1 3.7.4
• NIST SP 800-53 Rev 4 MA-3(2)