# Maintenance Log

**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/maintenance-log/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

| System | System owner | Log owner | Last updated | Updated by |
| --- | --- | --- | --- | --- |
| [Fill in: system name and identifier] | [Fill in: name and title] | [Fill in: maintenance coordinator or system administrator] | [Fill in: date] | [Fill in: name and title] |

## 1. How to use this log

- Schedule maintenance, repair and replacement as the manufacturer or vendor specifies and as organizational requirements add, and record each activity in the register (MA-2a).
- Get the system owner's approval before each activity starts, and record who monitored it (MA-2b).
- Include [Fill in: information to be included in organizational maintenance records. Typical: the date and time, the system and component, a description of the maintenance performed, the names and organization of the individuals performing it, the escort's name, the components or equipment removed or replaced, the approval, and the result of the post-maintenance control check] in each record (MA-2f).
- Record in the register the change request for any maintenance that changes the system's configuration (MA-2b, CM-3).
- Before a component leaves the facility for off-site maintenance, repair or replacement, get the explicit approval of [Fill in: personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs. Typical: the system owner] (MA-2c), and sanitize its media to remove [Fill in: information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement. Typical: all organizational information, including personally identifiable information, credentials and cryptographic keys] (MA-2d). Record the sanitization record's ID. Keep storage media that cannot be sanitized, such as a failed drive, rather than sending them.
- After each activity, check the potentially impacted controls and record the result (MA-2e).
- The system owner reviews the register at least quarterly against the maintenance schedule and change records, and records the review in section 5 (MA-2a).
- Keep the log for [Fill in: retention period from the organization's records retention schedule].

| Field | What to record |
| --- | --- |
| Record ID | A unique ID for the activity |
| Start and end | Date and time the activity started and ended |
| Component | The system component or equipment serviced, with its inventory ID (CM-8) |
| Type | Scheduled, repair, replacement or diagnostic |
| Location | On site, nonlocal, or off site (removed from the facility) |
| Description | What was done, and why |
| Performed by | Names and organization of the individuals who performed it, and whether each is on the authorized list in section 2 (MA-5) |
| Escort or supervisor | Name of the person who escorted or supervised, or "not required" for authorized, unescorted personnel (MA-5c) |
| Approved by | Name and date of the approval before the activity (MA-2b), and the change request ID if one applies (CM-3) |
| Tools and media | Tools used, from section 3, with the result of the tool inspection and the media scan (MA-3, MA-3(1), MA-3(2)) |
| Nonlocal session | For nonlocal maintenance: how the person connected and authenticated, and when the session and connections ended (MA-4) |
| Removed or replaced | Components or equipment removed or replaced, with serial numbers; for removal, who approved it and the sanitization record ID (MA-2c, MA-2d); for maintenance equipment, how its removal was handled (MA-3(3)) |
| Control check | Controls checked after the activity, by whom, and the result (MA-2e) |

## 2. Authorized maintenance organizations and personnel

- Only the organizations and people on this list may perform maintenance on the system without an escort, and only after their access authorizations are verified (MA-5a, MA-5b).
- The system owner approves each addition and reviews the list at least quarterly (MA-5a).
- Anyone not on the list works only under the supervision of a designated escort with the required access authorizations and technical competence, with temporary credentials valid for that maintenance period only (MA-5c).

| Organization | Person | Maintenance performed | Access authorizations verified (screening, access agreement) | Local, nonlocal or both | Approved by and date | Contract or agreement | Review date |
| --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: organization] | [Fill in: name] | [Fill in: components or services] | [Fill in: what was verified, and date] | [Fill in: type] | [Fill in: name and date] | [Fill in: reference] | [Fill in: date] |

## 3. Approved maintenance tools

- Only the tools on this list may be used to maintain the system, by authorized maintenance personnel (MA-3a).
- Tools brought in or downloaded by maintenance personnel are inspected for improper or unauthorized modifications before each use, and media with diagnostic or test programs are scanned for malicious code before use (MA-3(1), MA-3(2)). Report a modified tool or infected media as a security incident.
- Review this list [Fill in: frequency at which to review previously approved system maintenance tools. Typical: at least annually] and remove tools that are outdated, unsupported, no longer needed or no longer used (MA-3b).
- Maintenance equipment containing organizational information leaves the facility only after it is verified to hold none, is sanitized or destroyed, or under a written exemption from [Fill in: personnel or roles who can authorize removal of equipment from the facility. Typical: the Chief Information Security Officer]; otherwise it stays (MA-3(3)).

| Tool | Version | Type (hardware, software, firmware or cloud service) | Owner (organization or provider) | Used for | Nonlocal use documented in the system security plan | Approved by and date | Last review |
| --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: tool] | [Fill in: version] | [Fill in: type] | [Fill in: owner] | [Fill in: purpose] | [Fill in: yes, with the section, or not used remotely] | [Fill in: name and date] | [Fill in: date] |

## 4. Nonlocal maintenance

- Each nonlocal session is approved beforehand, monitored while it runs, and recorded in the register (MA-4a, MA-4d).
- Connections go through the organization's managed remote access service, with multi-factor, replay-resistant authentication, using only tools documented in the system security plan (MA-4b, MA-4c).
- Accounts that external maintenance providers use stay disabled except during an approved session (MA-4c).
- The session and network connections are ended when the maintenance is completed (MA-4e).
- For a High system, record for each provider the basis for concluding its maintenance system has comparable security; where it does not, remove, sanitize and afterward inspect the component instead (MA-4(3)).

### Federal systems

[OMB M-22-09](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf) (January 26, 2022) requires phishing-resistant multi-factor authentication for agency staff, contractors and partners, and [OMB M-19-17](https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf) (May 21, 2019), Section III, item 2, requires PIV credentials, where applicable in accordance with OPM requirements, as the primary means of authentication to Federal information systems by Federal employees and contractors; [OMB M-26-18](https://www.whitehouse.gov/wp-content/uploads/2026/08/M-26-18-Scaling-Use-of-Login.gov-to-Deliver-a-Universal-Sign-on-for-Public-Services.pdf) (August 31, 2026), footnote 5, lists both as existing OMB policy. CISA [Binding Operational Directive 23-02](https://www.cisa.gov/news-events/directives/binding-operational-directive-23-02) (June 13, 2023) requires agencies, within 14 days of discovery or of notice from CISA, to make the internet-exposed management interfaces of in-scope network devices reachable only from an internal enterprise network or only through a zero trust policy enforcement point separate from the interface. As of September 2026.

- For each nonlocal session, the register's "Nonlocal session" field shall record the phishing-resistant authenticator used, as OMB M-22-09 requires, and whether it was a PIV or derived PIV credential. (MA-4c)
- Where nonlocal maintenance uses the management interface of a device within the scope of BOD 23-02, the register shall record the internal network or policy enforcement point the session passed through. (MA-4b)

## 5. Record reviews

| Review date | Reviewed by | Period covered | Records checked against the schedule and change records | Issues found and actions | Next review |
| --- | --- | --- | --- | --- | --- |
| [Fill in: date] | [Fill in: name and title] | [Fill in: dates] | [Fill in: number, and any gaps] | [Fill in: issues, or "none"] | [Fill in: date] |

## Register

| Record ID | Start and end | Component | Type | Location | Description | Performed by | Escort or supervisor | Approved by | Tools and media | Nonlocal session | Removed or replaced | Control check |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: dates and times] | [Fill in: component and inventory ID] | [Fill in: type] | [Fill in: on site, nonlocal or off site] | [Fill in: what was done and why] | [Fill in: names, organization, on the authorized list or not] | [Fill in: name, or not required] | [Fill in: name, date, change request ID] | [Fill in: tools, inspection and scan results] | [Fill in: connection, authentication, end time, or not applicable] | [Fill in: items, serial numbers, removal approval and sanitization record ID, or none] | [Fill in: controls checked, by whom, result] |