Check Media for Malicious Code Before Use (MA.L2-3.7.4)

MA.L2-3.7.4 requires that any diagnostic and test program media — including bootable USB drives, diagnostic CDs, vendor-supplied firmware update tools, and hardware test utilities — be checked for malicious code before being introduced to any organizational system that processes, stores, or transmits CUI. Checking may take the form of anti-malware scanning using current signatures on a dedicated scanning workstation, or cryptographic hash verification against vendor-published values for media that cannot be scanned by a running OS (such as BIOS-level or bootable tools). The requirement originates in NIST SP 800-171 Rev 2 security requirement 3.7.4 and reflects the reality that maintenance media is a well-documented malware injection vector, especially when tools pass through multiple customer environments or are supplied by third-party technicians. Both organizational personnel performing in-house diagnostics and external maintenance personnel using their own tools are subject to this control. Written procedures, a designated scanning mechanism, and a maintenance log entry documenting the check are the minimum evidentiary expectations.