MA-3 Maintenance Tools

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Moderate, High	Organization	6 (3 in a baseline)

Related controls: MA-2, PE-16

Control statement

a. Approve, control, and monitor the use of system maintenance tools; and
b. Review previously approved system maintenance tools [Assignment: organization-defined frequency].

NIST discussion

Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues associated with maintenance tools that are not within system authorization boundaries and are used specifically for diagnostic and repair actions on organizational systems. Organizations have flexibility in determining roles for the approval of maintenance tools and how that approval is documented. A periodic review of maintenance tools facilitates the withdrawal of approval for outdated, unsupported, irrelevant, or no-longer-used tools. Maintenance tools can include hardware, software, and firmware items and may be pre-installed, brought in with maintenance personnel on media, cloud-based, or downloaded from a website. Such tools can be vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and subsequently into systems. Maintenance tools can include hardware and software diagnostic test equipment and packet sniffers. The hardware and software components that support maintenance and are a part of the system (including the software implementing utilities such as “ping,” “ls,” “ipconfig,” or the hardware and software implementing the monitoring port of an Ethernet switch) are not addressed by maintenance tools.

Control enhancements

MA-3(1) Inspect Tools

Baselines: Moderate, High

Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.

Discussion and assessment objectives for MA-3(1)

Maintenance tools can be directly brought into a facility by maintenance personnel or downloaded from a vendor’s website. If, upon inspection of the maintenance tools, organizations determine that the tools have been modified in an improper manner or the tools contain malicious code, the incident is handled consistent with organizational policies and procedures for incident handling.

Determine if maintenance tools used by maintenance personnel are inspected for improper or unauthorized modifications.

Examine: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; maintenance tool inspection records; maintenance records; system security plan; other relevant documents or records.

Interview: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for inspecting maintenance tools; mechanisms supporting and/or implementing the inspection of maintenance tools.

MA-3(2) Inspect Media

Baselines: Moderate, High

Check media containing diagnostic and test programs for malicious code before the media are used in the system.

Discussion and assessment objectives for MA-3(2)

If, upon inspection of media containing maintenance, diagnostic, and test programs, organizations determine that the media contains malicious code, the incident is handled consistent with organizational incident handling policies and procedures.

Determine if media containing diagnostic and test programs are checked for malicious code before the media are used in the system.

Examine: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; maintenance records; system security plan; other relevant documents or records.

Interview: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities.

Test: Organizational process for inspecting media for malicious code; mechanisms supporting and/or implementing the inspection of media used for maintenance.

MA-3(3) Prevent Unauthorized Removal

Baselines: Moderate, High

Prevent the removal of maintenance equipment containing organizational information by:

(a) Verifying that there is no organizational information contained on the equipment;
(b) Sanitizing or destroying the equipment;
(c) Retaining the equipment within the facility; or
(d) Obtaining an exemption from [Assignment: organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility.

Discussion and assessment objectives for MA-3(3)

Organizational information includes all information owned by organizations and any information provided to organizations for which the organizations serve as information stewards.

Determine if:

MA-03(03)(a) the removal of maintenance equipment containing organizational information is prevented by verifying that there is no organizational information contained on the equipment; or
MA-03(03)(b) the removal of maintenance equipment containing organizational information is prevented by sanitizing or destroying the equipment; or
MA-03(03)(c) the removal of maintenance equipment containing organizational information is prevented by retaining the equipment within the facility; or
MA-03(03)(d) the removal of maintenance equipment containing organizational information is prevented by obtaining an exemption from [Assignment: organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility.

Examine: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; maintenance records; equipment sanitization records; media sanitization records; exemptions for equipment removal; system security plan; other relevant documents or records.

Interview: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities; organizational personnel responsible for media sanitization.

Test: Organizational process for preventing unauthorized removal of information; mechanisms supporting media sanitization or destruction of equipment; mechanisms supporting verification of media sanitization.

MA-3(4) Restricted Tool Use

Baselines: Not in a baseline

Restrict the use of maintenance tools to authorized personnel only.

Discussion and assessment objectives for MA-3(4)

Restricting the use of maintenance tools to only authorized personnel applies to systems that are used to carry out maintenance functions.

Determine if the use of maintenance tools is restricted to authorized personnel only.

Examine: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; list of personnel authorized to use maintenance tools; maintenance tool usage records; maintenance records; system security plan; other relevant documents or records.

Interview: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for restricting the use of maintenance tools; mechanisms supporting and/or implementing the restricted use of maintenance tools.

MA-3(5) Execution with Privilege

Baselines: Not in a baseline

Monitor the use of maintenance tools that execute with increased privilege.

Discussion and assessment objectives for MA-3(5)

Maintenance tools that execute with increased system privilege can result in unauthorized access to organizational information and assets that would otherwise be inaccessible.

Determine if the use of maintenance tools that execute with increased privilege is monitored.

Interview: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for restricting the use of maintenance tools; organizational process for monitoring maintenance tools and maintenance tool usage; mechanisms monitoring the use of maintenance tools.

MA-3(6) Software Updates and Patches

Baselines: Not in a baseline

Inspect maintenance tools to ensure the latest software updates and patches are installed.

Discussion and assessment objectives for MA-3(6)

Maintenance tools using outdated and/or unpatched software can provide a threat vector for adversaries and result in a significant vulnerability for organizations.

Determine if maintenance tools are inspected to ensure that the latest software updates and patches are installed.

Interview: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for inspecting maintenance tools; organizational processes for maintenance tools updates; mechanisms supporting and/or implementing the inspection of maintenance tools; mechanisms supporting and/or implementing maintenance tool updates..

Assessment objectives (SP 800-53A)

Objectives and methods for MA-3

Determine if:

MA-03a.
- MA-03a.[01] the use of system maintenance tools is approved;
- MA-03a.[02] the use of system maintenance tools is controlled;
- MA-03a.[03] the use of system maintenance tools is monitored;
MA-03b. previously approved system maintenance tools are reviewed [Assignment: organization-defined frequency].

Interview: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for approving, controlling, and monitoring maintenance tools; mechanisms supporting and/or implementing the approval, control, and/or monitoring of maintenance tools.

Policy statement

The System owner shall approve each maintenance tool before it is used on the system, and record it on the system’s approved maintenance tools list. (MA-3a)
The System owner shall control the use of maintenance tools, so that only approved tools are used, only by authorized maintenance personnel. (MA-3a)
The System owner shall monitor the use of maintenance tools, through escort or session supervision and the audit records of privileged tool use (AU-2). (MA-3a)
The System owner shall review previously approved system maintenance tools Fill in: frequency at which to review previously approved system maintenance tools Typical: at least annually, and withdraw approval for tools that are outdated, unsupported, no longer needed or no longer used. (MA-3b)

MA-3(1) Inspect tools

The System owner shall ensure the maintenance tools that maintenance personnel bring into the facility or download are inspected for improper or unauthorized modifications before each use on the system. (MA-3(1))
Personnel shall report a tool found to be modified improperly, or to contain malicious code, as a security incident under the incident response plan (IR-6). (MA-3(1))

MA-3(2) Inspect media

The System owner shall ensure media containing diagnostic and test programs are checked for malicious code before the media are used in the system. (MA-3(2))
Personnel shall report malicious code found on such media as a security incident under the incident response plan (IR-6), and the media shall not be used. (MA-3(2))

MA-3(3) Prevent unauthorized removal

The System owner shall prevent the removal of maintenance equipment containing organizational information from the facility by verifying that there is no organizational information on the equipment, sanitizing or destroying the equipment, retaining the equipment within the facility, or obtaining a written exemption from Fill in: personnel or roles who can authorize removal of equipment from the facility Typical: the Chief Information Security Officer explicitly authorizing its removal. (MA-3(3))
The System owner shall record in the maintenance records which of these four measures was used for each piece of maintenance equipment. (MA-3(3))
Maintenance contracts shall allow the organization to keep, sanitize or destroy maintenance equipment or its storage media that contain organizational information. (MA-3(3))

Federal systems

Under 32 CFR 2002.14(f)(2), agencies that destroy controlled unclassified information (CUI), including in electronic form, must make it unreadable, indecipherable and irrecoverable. They must use any destruction method specifically required by law, regulation or Government-wide policy for that CUI; otherwise they must use the destruction guidance in NIST SP 800-53 and SP 800-88, or a method approved for classified national security information under 32 CFR 2001.47. As of September 2026.

Where maintenance equipment containing CUI is destroyed to prevent its removal, the System owner shall destroy it by a method that 32 CFR 2002.14(f)(2) permits. (MA-3(3)(b))

From the Maintenance Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

MA-3 asks you to approve, control and monitor the tools used to maintain the system, and to review the approved tools on a set schedule. Maintenance tools are the diagnostic and repair tools that are not part of the system: hardware and software diagnostic test equipment, packet sniffers, and vendor utilities that are pre-installed, brought in on media, cloud-based or downloaded. NIST’s MA-3 discussion warns that they can carry malicious code into a facility and then into the system. It excludes utilities that are part of the system, such as ping, ls or ipconfig, or a switch’s monitoring port.

Common implementations. The system owner keeps an approved maintenance tools list, in the maintenance log or the configuration management database, naming each tool, its version and who owns it. Only approved tools are used, only by authorized maintenance personnel (MA-5). Use is monitored by escorting or supervising the person and through the audit records of privileged tool use (AU-2). A vendor’s software tool is checked against the vendor’s published hash or signature before each use, and diagnostic media are scanned on a workstation that is not connected to the system. The periodic review withdraws approval for tools that are outdated, unsupported, no longer needed or no longer used, which is the purpose NIST’s discussion gives it.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Review frequency for approved maintenance tools (b)	At least annually
Who can exempt maintenance equipment from the removal restrictions (MA-3(3)(d))	The Chief Information Security Officer

MA-3(1) and MA-3(2) have no parameters. In the Maintenance policy, the system owner approves each tool before it is used and records it on the approved list.

Evidence assessors ask for.

The approved maintenance tools list, with approvals and the date of the last review
Records showing tools were inspected before use, and media scanned (MA-3(1), MA-3(2))
For a sample of maintenance records, the tools used, checked against the approved list
Records of maintenance equipment that left the facility, showing which of the four MA-3(3) measures was used, and any written exemptions
Maintenance contract terms that let the organization keep, sanitize or destroy equipment or media holding its information

Inheritance. A central IT operations group may keep one approved tools list for common equipment, such as network diagnostic tools, and offer it as a common control. The system owns approving tools specific to its components and the vendor tools used on them, so MA-3 is usually a hybrid control. For a cloud service, the provider’s own maintenance tools are covered by its authorization or attestation.

Common findings.

No approved tools list, or one that does not include the vendor’s remote support utility.
Tools downloaded from the internet at the time of the repair, with no check of their integrity.
A vendor’s diagnostic laptop, which has held system data, leaving the building with no record of how it was handled.
An approved list never reviewed, still naming tools that are years out of support.

Enhancements in the Moderate baseline. MA-3(1) inspect tools, MA-3(2) inspect media and MA-3(3) prevent unauthorized removal, all also in High. MA-3(4), MA-3(5) and MA-3(6) are in no baseline.

MA-3(1) inspects the tools maintenance personnel bring in or download for improper or unauthorized modifications. For hardware, check its seals, serial number and condition; for software, check a hash or signature against the vendor’s published value. NIST’s discussion has a tool found modified, or containing malicious code, handled as an incident; the policy has it reported under the incident response plan (IR-6).
MA-3(2) checks media holding diagnostic and test programs for malicious code before they are used in the system, with the organization’s malicious code protection (SI-3). Infected media are reported as an incident and not used.
MA-3(3) keeps maintenance equipment that holds organizational information from leaving without one of four measures: verify it holds none, sanitize or destroy it, keep it in the facility, or get a written exemption from the Chief Information Security Officer. NIST’s discussion counts information the organization holds as a steward for others as organizational information. Sanitize as the media sanitization procedure in the Media Protection policy sets out (MP-6), record it in the media sanitization record, and put terms in the maintenance contract that let you keep, sanitize or destroy the equipment or its media.

Federal systems (as of September 2026). Under 32 CFR 2002.14(f)(2), agencies that destroy controlled unclassified information (CUI), including in electronic form, must make it unreadable, indecipherable and irrecoverable. They must use any destruction method specifically required by law, regulation or Government-wide policy for that CUI; otherwise, the destruction guidance in NIST SP 800-53 and SP 800-88, or a method approved for classified national security information under 32 CFR 2001.47. The MA-3(3) clause’s federal block requires that method when maintenance equipment holding CUI is destroyed to keep it from leaving.

Artifacts

Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.