Regular maintenance of a PAS deployment is accomplished using BOSH and Ops Manager. Approval for maintenance activities and the associated record-keeping requirements are the responsibility of the deployer. Handling procedures for proper custody or hardware will vary based on the IaaS, and are the responsibility of the deployer. Appropriate procedures for sanitization of persistent storage volumes are IaaS-specific, and will vary based on, e.g., whether the PAS deployment is part of a public or private cloud deployment.
This control addresses the information security aspects of the information system maintenance program and applies to all types of maintenance to any system component (including applications) conducted by any local or nonlocal entity (e.g., in-contract, warranty, in-house, software maintenance agreement). System maintenance also includes those components not directly associated with information processing and/or data/information retention such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes, for example: (i) date and time of maintenance; (ii) name of individuals or group performing the maintenance; (iii) name of escort, if necessary; (iv) a description of the maintenance performed; and (v) information system components/equipment removed or replaced (including identification numbers, if applicable). The level of detail included in maintenance records can be informed by the security categories of organizational information systems. Organizations consider supply chain issues associated with replacement components for information systems.