Internal Use

System Maintenance Policy and Procedures

Dispel

Document Control

1. PURPOSE AND SCOPE

1.1 Purpose

The purpose of this policy and procedures document is to define how Dispel plans, authorizes, and conducts maintenance on in-scope systems in a way that preserves security, availability, and integrity.

1.2 Scope

This policy applies to:

• All maintenance activities on Dispel-managed production systems and supporting infrastructure.
• Use of maintenance tools, remote maintenance, and maintenance performed by internal staff or external parties.
• All Covered Persons authorized to perform or oversee system maintenance.

1.3 Regulatory and Framework Alignment

2. POLICY STATEMENTS

2.1 Management Commitment

Management Commitment Statement

Senior Management at Dispel is dedicated to the protection of our information assets, industrial control systems, and Protected Health Information (PHI). We assume full accountability for the effectiveness of our security program, ensuring it is integrated into all business processes and aligned with our strategic goals. To maintain compliance with ISO 27001, IEC 62443, HIPAA, and NIST 800-53, we formally commit to:

• Resource Provisioning: Providing the necessary financial, technical, and human resources to sustain a robust security posture.
• Risk-Based Governance: Approving security policies and overseeing a continuous risk management process that prioritizes both data privacy and operational safety.
• Operational Resilience: Supporting the security of industrial automation and control systems (IACS) to ensure safety and reliability.
• Continuous Oversight: Conducting regular management reviews to evaluate program performance, audit results, and opportunities for improvement.

2.2 Primary Policy Statement

Dispel SHALL perform system maintenance in a planned, authorized, and documented manner that minimizes disruption and security risk.

2.3 Secondary Policy Statement

• Maintenance tools and remote maintenance SHALL be controlled and monitored.
• Only authorized and appropriately vetted personnel SHALL perform maintenance on production systems.

3. REQUIREMENTS

3.1 Controlled Maintenance

Objective: Ensure system maintenance is performed under controlled conditions.

Mandatory Activities:

1. Maintenance activities SHALL be requested, approved, and documented before execution, except in emergencies.
2. Where customers are impacted, maintenance windows SHALL be coordinated and, where feasible, communicated in advance.
3. Maintenance activities SHALL be logged, including date, time, personnel, and actions taken.

Required Outputs:

• Maintenance requests and approvals.
• Maintenance activity logs.

Security Controls: NIST SP 800-53 MA-2.

3.2 Maintenance Tools and Remote Maintenance

Objective: Control the use of maintenance tools and remote maintenance access.

Mandatory Activities:

1. Maintenance tools (hardware, software, firmware) used on in-scope systems SHALL be authorized and inventoried.
2. Tools and associated media SHALL be inspected and sanitized as appropriate before use.
3. Remote maintenance activities SHALL:
   • Use secure communication channels.
   • Be enabled only for the duration necessary.
   • Be monitored and logged.

Required Outputs:

• Inventory of authorized maintenance tools.
• Logs of remote maintenance sessions.

Security Controls: NIST SP 800-53 MA-3, MA-4.

3.3 Maintenance Personnel and Timely Maintenance

Objective: Ensure maintenance personnel are authorized and maintenance is timely.

Mandatory Activities:

1. Only personnel with appropriate authorization and, where applicable, background checks SHALL perform maintenance on production systems.
2. When individuals without appropriate access must perform maintenance, they SHALL be escorted or supervised, and activities SHALL be logged.
3. Dispel SHALL ensure that required maintenance (e.g., patching, hardware servicing) is performed in a timely manner based on risk and vendor guidance.

Required Outputs:

• Records of maintenance personnel authorization.
• Schedules and records of maintenance activities.

Security Controls: NIST SP 800-53 MA-5, MA-6.

4. ROLES AND RESPONSIBILITIES

4.1 Policy Owner

Responsibilities:

• Owns this System Maintenance Policy and Procedures.
• Ensures alignment with configuration and change management policies.
• Coordinates periodic reviews and updates.

4.2 System Owners

Responsibilities:

• Approve maintenance activities for systems they own.
• Ensure maintenance windows and customer notifications (where applicable) are managed.
• Verify that maintenance outcomes are as expected.

4.3 Maintenance Personnel / Administrators

Responsibilities:

• Perform maintenance in accordance with approved procedures.
• Use authorized tools and channels.
• Record maintenance activities and escalate issues as needed.

5. PROCEDURES

5.1 Maintenance Lifecycle (High-Level)

6. MONITORING AND COMPLIANCE

6.1 Compliance Monitoring

Compliance with this policy SHALL be monitored through:

• Reviews of maintenance logs and approvals.
• Audits of remote maintenance controls and tool inventories.
• Incident reviews involving maintenance-related issues.

6.2 Metrics and Reporting

The following metrics SHALL be tracked and reported at least annually to the Policy Owner and senior management:

6.3 Non-Compliance Consequences

Failure to comply with this policy and procedures may result in:

• Increased risk of system failures or security incidents.
• Revocation or restriction of access for Covered Persons who repeatedly fail to follow maintenance procedures.
• Disciplinary action for employees and contractors, consistent with Dispel HR policies and applicable law.

7. EXCEPTIONS AND WAIVERS

7.1 Exception Process

Exceptions to this policy SHALL:

1. Be submitted in writing by the requesting party.
2. Identify the specific policy or procedural requirements for which an exception is sought.
3. Include justification and business impact.
4. Describe compensating controls or mitigation measures.
5. Define exception duration and remediation plan.

7.2 Exception Approval Authority

8. DEFINITIONS

Maintenance: Any activity intended to preserve or restore the functionality, performance, or security of a system or component.

Maintenance Tools: Hardware, software, or firmware used to perform maintenance on systems.

9. REFERENCES

9.1 Internal References

• Change Management Policy.
• System Configuration Management Policy and Procedures.
• System Planning Policy and Procedures.

9.2 External References

• NIST SP 800-53, MA family.
• ISO/IEC 27001 and related maintenance guidance.

10. DOCUMENT HISTORY

11. APPROVAL SIGNATURES

APPENDICES

Appendix A: Supporting Maintenance Procedures

This appendix may include:

• Standard operating procedures for planned and emergency maintenance.
• Checklists for remote maintenance setup and teardown.

Appendix B: Additional Guidance and Examples

This appendix may include:

• Example maintenance scenarios and lessons learned.
• References to industry best practices for system maintenance.