{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Secure Configuration & Change Management","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-CONFIG-07","description":"Schedule, approve, document, and review maintenance, repair, and replacement of systems and hardware in accordance with manufacturer specifications and organizational requirements, whether performed on site or off site. Sanitize equipment before off-site maintenance and verify security controls after maintenance is completed. Obtain maintenance support and spare parts within defined timeframes so hardware is maintained, replaced, or removed commensurate with risk.","details":{"control_category":"administrative","control_type":"preventive","domain":"Secure Configuration & Change Management","guidance":[],"members":[{"control_id":"MA-2","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"MA-6","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"MA-7","coverage":"partial","delta":"restricting or prohibiting field maintenance to designated trusted maintenance facilities","framework":"nist-800-53","relationship":"intersects_with"},{"control_id":"PR.PS-03","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"}],"statement":"Schedule, approve, document, and review maintenance, repair, and replacement of systems and hardware in accordance with manufacturer specifications and organizational requirements, whether performed on site or off site. Sanitize equipment before off-site maintenance and verify security controls after maintenance is completed. Obtain maintenance support and spare parts within defined timeframes so hardware is maintained, replaced, or removed commensurate with risk.","title":"Perform controlled, timely maintenance of systems and hardware","unified_id":"UC-CONFIG-07"},"id":"uc:UC-CONFIG-07","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-CONFIG-07","sourceIds":["nist-800-53","nist-csf-2"],"sourceUrl":null,"title":"UC-CONFIG-07 — Perform controlled, timely maintenance of systems and hardware","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1216a379c139308f56c556edf6e685faab6a12412afd46592fae134685d5cc1a","properties":{},"sourceDetailPath":"/data/v1/records/wf-c9-75fb1752.json","sourceId":"wf:C9","targetDetailPath":"/data/v1/records/uc-uc-config-07-db5cd0ea.json","targetId":"uc:UC-CONFIG-07","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:22c1986ce5ae7dbc14704725bed0fba51ab942286753a2fc84ec96948798d140","properties":{"rationale":"Timely maintenance and vendor support keep systems supportable and patchable, indirectly reducing unpatched-flaw exposure; patching is the operative control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-07-db5cd0ea.json","sourceId":"uc:UC-CONFIG-07","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2cb063175d43859ab6ccc39362d61110211e6a3c6db871790b2acad0e255e6e7","properties":{"control_id":"PR.PS-03","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-config-07-db5cd0ea.json","sourceId":"uc:UC-CONFIG-07","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-pr-ps-03-09ab017a.json","targetId":"ctrl:nist-csf-2:PR.PS-03","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:30d7441149c70b276958e33565cf0e038ea917d0bbc20393ce201c4fc7effc0f","properties":{"control_id":"MA-2","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-config-07-db5cd0ea.json","sourceId":"uc:UC-CONFIG-07","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-ma-2-02b88512.json","targetId":"ctrl:nist-800-53:MA-2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4e778aaaeeb31f8389d5b248631ec870302cd8a105bf47518f099eea131e720f","properties":{"rationale":"Scheduled, timely maintenance with support and spare parts within defined timeframes directly prevents loss of the ability to maintain or repair systems.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-config-07-db5cd0ea.json","sourceId":"uc:UC-CONFIG-07","targetDetailPath":"/data/v1/records/risk-tech-maintainability-breach-f075a363.json","targetId":"risk:tech-maintainability-breach","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:53afbe0d5e5440789829810cb06d10a75434da533a600fa4ee8e900cce736839","properties":{},"sourceDetailPath":"/data/v1/records/wf-c47-ef7838c6.json","sourceId":"wf:C47","targetDetailPath":"/data/v1/records/uc-uc-config-07-db5cd0ea.json","targetId":"uc:UC-CONFIG-07","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:77eaa3aa5a11dff97d25c23c1954aa66d28e61a85546292bb2d1c135f7b95dda","properties":{"control_id":"MA-6","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-config-07-db5cd0ea.json","sourceId":"uc:UC-CONFIG-07","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-ma-6-4d9904c7.json","targetId":"ctrl:nist-800-53:MA-6","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:deb0fc6960ca47f980550c2b676987e2954c2210b8a3db9fda87b9bb75236f54","properties":{"control_id":"MA-7","coverage":"partial","delta":"restricting or prohibiting field maintenance to designated trusted maintenance facilities","framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-config-07-db5cd0ea.json","sourceId":"uc:UC-CONFIG-07","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-ma-7-0e1ed9a2.json","targetId":"ctrl:nist-800-53:MA-7","type":"maps_to"}],"schemaVersion":1}