MA-2 Controlled Maintenance

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	1 (1 in a baseline)

Related controls: CM-2, CM-3, CM-4, CM-5, CM-8, MA-4, MP-6, PE-16, SI-2, SR-3, SR-4, SR-11

Control statement

• a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
• b. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
• c. Require that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
• d. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: organization-defined information];
• e. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
• f. Include the following information in organizational maintenance records: [Assignment: organization-defined information].

NIST discussion

Controlling system maintenance addresses the information security aspects of the system maintenance program and applies to all types of maintenance to system components conducted by local or nonlocal entities. Maintenance includes peripherals such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes the date and time of maintenance, a description of the maintenance performed, names of the individuals or group performing the maintenance, name of the escort, and system components or equipment that are removed or replaced. Organizations consider supply chain-related risks associated with replacement components for systems.

Control enhancements

MA-2(2) Automated Maintenance Activities

Baselines: High

• (a) Schedule, conduct, and document maintenance, repair, and replacement actions for the system using [Assignment: organization-defined automated mechanisms] ; and
• (b) Produce up-to date, accurate, and complete records of all maintenance, repair, and replacement actions requested, scheduled, in process, and completed.

Discussion and assessment objectives for MA-2(2)

The use of automated mechanisms to manage and control system maintenance programs and activities helps to ensure the generation of timely, accurate, complete, and consistent maintenance records.

Determine if:

• MA-02(02)(a)
  • MA-02(02)(a)[01] [Assignment: organization-defined automated mechanisms] are used to schedule maintenance, repair, and replacement actions for the system;
  • MA-02(02)(a)[02] [Assignment: organization-defined automated mechanisms] are used to conduct maintenance, repair, and replacement actions for the system;
  • MA-02(02)(a)[03] [Assignment: organization-defined automated mechanisms] are used to document maintenance, repair, and replacement actions for the system;
• MA-02(02)(b)
  • MA-02(02)(b)[01] up-to date, accurate, and complete records of all maintenance actions requested, scheduled, in process, and completed are produced.
  • MA-02(02)(b)[02] up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed are produced.
  • MA-02(02)(b)[03] up-to date, accurate, and complete records of all replacement actions requested, scheduled, in process, and completed are produced.

Examine: Maintenance policy; procedures addressing controlled system maintenance; automated mechanisms supporting system maintenance activities; system configuration settings and associated documentation; maintenance records; system security plan; other relevant documents or records.

Interview: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities; system/network administrators.

Test: Automated mechanisms supporting and/or implementing controlled maintenance; automated mechanisms supporting and/or implementing the production of records of maintenance and repair actions.

Withdrawn enhancements: MA-2(1).

Assessment objectives (SP 800-53A)

Objectives and methods for MA-2

Determine if:

• MA-02a.
  • MA-02a.[01] maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements;
  • MA-02a.[02] maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements;
  • MA-02a.[03] records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements;
• MA-02b.
  • MA-02b.[01] all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved;
  • MA-02b.[02] all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored;
• MA-02c. [Assignment: organization-defined personnel or roles] is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
• MA-02d. equipment is sanitized to remove [Assignment: organization-defined information] from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement;
• MA-02e. all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair, or replacement actions;
• MA-02f. [Assignment: organization-defined information] is included in organizational maintenance records.

Examine: Maintenance policy; procedures addressing controlled system maintenance; maintenance records; manufacturer/vendor maintenance specifications; equipment sanitization records; media sanitization records; system security plan; other relevant documents or records.

Interview: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities; organizational personnel responsible for media sanitization; system/network administrators.

Test: Organizational processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for the system; organizational processes for sanitizing system components; mechanisms supporting and/or implementing controlled maintenance; mechanisms implementing the sanitization of system components.

Policy statement

• The System owner shall schedule maintenance, repair and replacement of system components in accordance with manufacturer or vendor specifications and organizational requirements. (MA-2a)
• The System owner shall document each maintenance, repair and replacement activity in the system’s maintenance records. (MA-2a)
• The System owner shall review the maintenance records at least quarterly against the maintenance schedule and the system’s change records. (MA-2a)
• The System owner shall approve each maintenance activity before it starts, whether it is performed on site or remotely and whether components are serviced on site or removed to another location. (MA-2b)
• The System owner shall ensure each maintenance activity is monitored while it is performed, by an escort or by review of the session and its records. (MA-2b)
• Maintenance that changes the system’s configuration shall also follow the change control process (CM-3). (MA-2b)
• The System owner shall require Fill in: personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs Typical: the system owner to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair or replacement. (MA-2c)
• The System owner shall ensure equipment is sanitized to remove Fill in: information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement Typical: all organizational information, including personally identifiable information, credentials and cryptographic keys from associated media before it is removed from organizational facilities for off-site maintenance, repair or replacement. (MA-2d)
• Where storage media cannot be sanitized, such as a failed drive, the System owner shall keep the media within the organization and sanitize or destroy them there, rather than release them. (MA-2d)
• After each maintenance, repair or replacement action, the System owner shall check all potentially impacted controls to verify that they are still functioning properly. (MA-2e)
• The System owner shall include Fill in: information to be included in organizational maintenance records Typical: the date and time, the system and component, a description of the maintenance performed, the names and organization of the individuals performing it, the escort’s name, the components or equipment removed or replaced, the approval, and the result of the post-maintenance control check in the organization’s maintenance records. (MA-2f)

MA-2(2) Automated maintenance activities

• The System owner shall schedule maintenance, repair and replacement actions for the system using Fill in: automated mechanisms used to schedule maintenance, repair, and replacement actions for the system Typical: the organization’s IT service management system. (MA-2(2)(a))
• The System owner shall conduct maintenance, repair and replacement actions for the system using Fill in: automated mechanisms used to conduct maintenance, repair, and replacement actions for the system Typical: the endpoint and configuration management tools that deploy updates, firmware and configuration changes, where the action can be automated. (MA-2(2)(a))
• The System owner shall document maintenance, repair and replacement actions for the system using Fill in: automated mechanisms used to document maintenance, repair, and replacement actions for the system Typical: the organization’s IT service management system, fed by the endpoint and configuration management tools. (MA-2(2)(a))
• The System owner shall ensure those mechanisms produce up-to-date, accurate and complete records of all maintenance, repair and replacement actions requested, scheduled, in process and completed. (MA-2(2)(b))

From the Maintenance Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

MA-2 asks you to run maintenance as a controlled process: scheduled, approved, monitored and recorded, with a check afterward that the controls still work. It covers every kind of maintenance, repair and replacement, on site or remote, by your staff or a vendor. NIST’s MA-2 discussion includes peripherals such as scanners, copiers and printers, which are easy to leave out.

Common implementations. Scheduled maintenance follows the manufacturer’s or vendor’s specifications and is booked in an IT service management system or a maintenance calendar. Each activity gets a record in the maintenance log, or in the service management system with the same fields. The system owner approves each activity before it starts. Maintenance that changes the configuration also goes through change control (CM-3), and its security impact analysis (CM-4) tells you which controls to check afterward. A person monitors each activity, by escorting on-site work or by supervising a remote session.

Before a component leaves the facility for repair, the system owner approves its removal and its media are sanitized. Follow the media sanitization procedure that the Media Protection policy requires (MP-6) and NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025, final; as of September 2026). A failed drive that cannot be sanitized stays with the organization and is sanitized or destroyed there, as the Maintenance policy requires. Where the vendor offers a media retention option, put it in the maintenance contract, so a warranty replacement does not require returning the failed drive. Record each sanitization in the media sanitization record, and its record ID in the maintenance log’s “Removed or replaced” field.

NIST’s discussion also asks you to consider supply chain risk in replacement components. The MA-2 clause’s guidance suggests buying them from the original manufacturer or its authorized channel, or from a source the supply chain risk management plan allows.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Who approves removal for off-site maintenance, repair or replacement (c)	The system owner
Information removed from media before off-site maintenance (d)	All organizational information, including personally identifiable information, credentials and cryptographic keys
Information included in maintenance records (f)	The date and time, the system and component, a description of the maintenance performed, the names and organization of the individuals performing it, the escort’s name, the components or equipment removed or replaced, the approval, and the result of the post-maintenance control check
Automated mechanisms to schedule maintenance (MA-2(2), High)	The organization’s IT service management system
Automated mechanisms to conduct maintenance (MA-2(2), High)	The endpoint and configuration management tools that deploy updates, firmware and configuration changes
Automated mechanisms to document maintenance (MA-2(2), High)	The organization’s IT service management system, fed by the endpoint and configuration management tools

The record contents are the list in NIST’s MA-2 discussion, plus the approval (MA-2b) and the control check (MA-2e). In the Maintenance policy, the system owner also reviews the maintenance records at least quarterly against the maintenance schedule and the system’s change records.

Evidence assessors ask for.

• The maintenance schedule, and the manufacturer or vendor specifications it follows
• The maintenance records for a period, with a sample traced to their approvals and to the change records
• Removal approvals and sanitization records for components sent off site
• The post-maintenance control checks for the sampled activities
• Records of the quarterly review of the maintenance records
• Maintenance records for printers, copiers and other peripherals, not only servers

Inheritance. For cloud services, the provider maintains its own infrastructure, and its authorization package or attestation covers MA-2 for those components. On premises, a central IT operations group or facilities team often runs maintenance as a common control. The system still owns approving and recording maintenance on its components and checking its controls afterward, so MA-2 is usually a hybrid control.

Common findings.

• Maintenance done with no record, often discovered through firmware versions or replaced parts that the log does not show.
• Records that miss the escort, the approval or the post-maintenance check.
• A failed drive sent back to the vendor under warranty without sanitization.
• Printers and multifunction devices with internal storage serviced or returned at lease end without their storage being sanitized.
• Maintenance that changed the configuration but never went through change control.

Enhancements in the Moderate baseline. MA-2 has no enhancements in the Moderate baseline. High adds MA-2(2) automated maintenance activities. MA-2(1) is withdrawn.

• MA-2(2) uses automated mechanisms to schedule, conduct and document maintenance, so the records are timely, accurate, complete and consistent, as NIST’s discussion puts it. The records cover work requested, scheduled and in process, not only completed work. The maintenance log notes that a service management system holding the log’s fields is how MA-2(2) is usually met.

Artifacts

• Maintenance Decision Worksheet
• Maintenance Log
• Maintenance Policy
• Media Sanitization Record