MA.L2-3.7.4  

Reference: CMMC 2.0

Family: MA

Level Introduced: 2

Title: Media Inspection

Practice:
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

CMMC Clarification:
As part of troubleshooting a vendor may provide a diagnostic application to install on a system. The vendor is using the application to help identify the cause of issues on the system. As this is executable code there is a chance that the file is corrupt or infected with malicious code. Implement procedures to scan any files prior to installation. The same level of scrutiny must be made as with any file a staff member may download.

Example
You've recently been experiencing performance issues on one of your servers. After troubleshooting for much of the morning the vendor has asked to install a utility that will collect more data from the server. The file is stored on their FTP server. The support technician gives you the FTP site so you can anonymously download the utility file. You also ask him for a hash of the utility file. As you download the file to your local computer you realize it is compressed. While you have anti-virus on your server you don't want to cause any issues that may further impact business operations. On your desktop you unzip the file. Once the file is unzipped you open your local anti-virus and perform a manual scan of the utility file. The scan reports no issues. To further verify the utility file has not been tampered you run an application to see that the hash from the vendor matches.

Source: CMMC v2.0