Controlled Maintenance
Description
Schedule, document, and review records of maintenance, repair, or replacement of system components; sanitize equipment to remove information prior to maintenance, removal, or disposal.
⚠️ Risk Impact
Maintenance windows are opportunity windows. Servers removed for repair often retain data. Devices traded in or recycled without sanitization leak data months or years later.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.
🔧 Remediation
Document maintenance schedule. Require pre-maintenance data sanitization (cryptographic erasure for cloud volumes, DoD wipe for physical media). Maintain a maintenance log with technician identity + actions taken.
💀 Real-World Attack Scenario
A federal agency disposed of 47 retired laptops via a recycling vendor. The vendor was supposed to wipe disks. Spot-check inspection by an OIG audit found 31 of 47 still contained recoverable PII including SSN + DOB on former employees. The recycling contract had no verification mechanism. Remediation: emergency staff notification + monitoring + $2.4M settlement.
💰 Cost of Non-Compliance
Data-leak from disposed equipment: avg $1.8M per incident (Privacy Rights Clearinghouse 2024). FISMA MA-2 violations: $200K-$1M remediation cost.
📋 Audit Questions
- 1.Show the maintenance log for the last 90 days.
- 2.What is the sanitization procedure for retired equipment?
- 3.How is sanitization verified?
- 4.Are third-party recyclers contractually bound to verifiable sanitization?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Cloud-only orgs forgetting laptop / workstation disposal scope
- ⛔Trusting recyclers without verification
- ⛔Maintenance log incomplete — actions taken not recorded
📈 Business Value
Controlled maintenance prevents the 'forgotten disk' breach pattern. Low cost, high audit defensibility.
⏱️ Effort Estimate
4-8 hours per disposal event for documented sanitization
EchelonGraph tracks cloud-volume disposal + cryptographic erasure events
🔗 Cross-Framework References
Automate NIST 800-53 MA-2 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →