# Maintenance Policy

**Template version:** 1.0.0 · **Baseline:** High · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ma/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet MA-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the MA-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Maintenance, and who is accountable for meeting those requirements. (MA-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (MA-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (MA-1a.1(a))
- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (MA-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (MA-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (MA-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (MA-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (MA-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (MA-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (MA-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (MA-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (MA-1a.1(a))

## Procedures

The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (MA-1a.2)

## Dissemination

- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the maintenance policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (MA-1a)
- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the maintenance procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (MA-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Controlled maintenance (MA-2)

> **Guidance:** MA-2 covers every kind of maintenance, repair and replacement, on site or remote, including printers, scanners and copiers, which NIST's MA-2 discussion names. The information recorded for each activity is the list NIST's discussion gives, plus the approval and the control check that MA-2b and MA-2e ask for. The [maintenance log](https://kston83.github.io/nist-guide/templates/forms/maintenance-log/) holds these records. Sanitize media before they leave for repair as the media sanitization procedure sets out (MP-6), following NIST SP 800-88 Rev. 2, [Guidelines for Media Sanitization](https://csrc.nist.gov/pubs/sp/800/88/r2/final) (September 2025, final; as of September 2026), and record it in the [media sanitization record](https://kston83.github.io/nist-guide/templates/forms/media-sanitization-record/). Assessors sample maintenance records against the schedule and ask for the removal approvals and sanitization records.

- The [System owner] shall schedule maintenance, repair and replacement of system components in accordance with manufacturer or vendor specifications and organizational requirements. (MA-2a)
- The [System owner] shall document each maintenance, repair and replacement activity in the system's maintenance records. (MA-2a)
- The [System owner] shall review the maintenance records at least quarterly against the maintenance schedule and the system's change records. (MA-2a)
- The [System owner] shall approve each maintenance activity before it starts, whether it is performed on site or remotely and whether components are serviced on site or removed to another location. (MA-2b)
- The [System owner] shall ensure each maintenance activity is monitored while it is performed, by an escort or by review of the session and its records. (MA-2b)
- Maintenance that changes the system's configuration shall also follow the change control process (CM-3). (MA-2b)
- The [System owner] shall require [Fill in: personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs. Typical: the system owner] to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair or replacement. (MA-2c)
- The [System owner] shall ensure equipment is sanitized to remove [Fill in: information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement. Typical: all organizational information, including personally identifiable information, credentials and cryptographic keys] from associated media before it is removed from organizational facilities for off-site maintenance, repair or replacement. (MA-2d)
- Where storage media cannot be sanitized, such as a failed drive, the [System owner] shall keep the media within the organization and sanitize or destroy them there, rather than release them. (MA-2d)
- After each maintenance, repair or replacement action, the [System owner] shall check all potentially impacted controls to verify that they are still functioning properly. (MA-2e)
- The [System owner] shall include [Fill in: information to be included in organizational maintenance records. Typical: the date and time, the system and component, a description of the maintenance performed, the names and organization of the individuals performing it, the escort's name, the components or equipment removed or replaced, the approval, and the result of the post-maintenance control check] in the organization's maintenance records. (MA-2f)

> **Guidance:** Replacement components bring supply chain risk, which NIST's MA-2 discussion asks organizations to consider: obtain them from the original manufacturer or its authorized channel, or from a source the supply chain risk management plan allows. The post-maintenance check can use the change's security impact analysis (CM-4) to decide which controls to verify.

### Automated maintenance activities (MA-2(2))

> **Guidance:** MA-2(2) is in the High baseline. An IT service management or maintenance management system that schedules work orders, and management tools that carry out and report the work, give the timely, accurate and complete records NIST's discussion describes. Records of requested and scheduled work, not only completed work, are what distinguish this enhancement from MA-2.

- The [System owner] shall schedule maintenance, repair and replacement actions for the system using [Fill in: automated mechanisms used to schedule maintenance, repair, and replacement actions for the system. Typical: the organization's IT service management system]. (MA-2(2)(a))
- The [System owner] shall conduct maintenance, repair and replacement actions for the system using [Fill in: automated mechanisms used to conduct maintenance, repair, and replacement actions for the system. Typical: the endpoint and configuration management tools that deploy updates, firmware and configuration changes], where the action can be automated. (MA-2(2)(a))
- The [System owner] shall document maintenance, repair and replacement actions for the system using [Fill in: automated mechanisms used to document maintenance, repair, and replacement actions for the system. Typical: the organization's IT service management system, fed by the endpoint and configuration management tools]. (MA-2(2)(a))
- The [System owner] shall ensure those mechanisms produce up-to-date, accurate and complete records of all maintenance, repair and replacement actions requested, scheduled, in process and completed. (MA-2(2)(b))

### Maintenance tools (MA-3)

> **Guidance:** Maintenance tools are the diagnostic and repair tools that are not part of the system: diagnostic test equipment, packet sniffers, vendor utilities brought in on media or downloaded, and cloud-based diagnostic services. NIST's MA-3 discussion notes they can carry malicious code into a facility and a system, and excludes utilities built into the system, such as ping or a switch's monitoring port. Keep the approved tools list in the [maintenance log](https://kston83.github.io/nist-guide/templates/forms/maintenance-log/). The periodic review withdraws approval for tools that are outdated, unsupported or no longer used, as NIST's discussion describes.

- The [System owner] shall approve each maintenance tool before it is used on the system, and record it on the system's approved maintenance tools list. (MA-3a)
- The [System owner] shall control the use of maintenance tools, so that only approved tools are used, only by authorized maintenance personnel. (MA-3a)
- The [System owner] shall monitor the use of maintenance tools, through escort or session supervision and the audit records of privileged tool use (AU-2). (MA-3a)
- The [System owner] shall review previously approved system maintenance tools [Fill in: frequency at which to review previously approved system maintenance tools. Typical: at least annually], and withdraw approval for tools that are outdated, unsupported, no longer needed or no longer used. (MA-3b)

### Inspect tools (MA-3(1))

> **Guidance:** Inspection means checking that a tool is the approved one, in the approved version, with no sign of tampering: for hardware, its seals, serial number and condition; for software, a hash or signature check against the vendor's published value. NIST's discussion of this enhancement has an improperly modified tool, or one containing malicious code, handled as an incident.

- The [System owner] shall ensure the maintenance tools that maintenance personnel bring into the facility or download are inspected for improper or unauthorized modifications before each use on the system. (MA-3(1))
- Personnel shall report a tool found to be modified improperly, or to contain malicious code, as a security incident under the incident response plan (IR-6). (MA-3(1))

### Inspect media (MA-3(2))

> **Guidance:** Scan the media on a workstation that is not connected to the system, with the organization's malicious code protection (SI-3), and record the scan in the maintenance log. NIST's discussion of this enhancement has malicious code found on the media handled as an incident.

- The [System owner] shall ensure media containing diagnostic and test programs are checked for malicious code before the media are used in the system. (MA-3(2))
- Personnel shall report malicious code found on such media as a security incident under the incident response plan (IR-6), and the media shall not be used. (MA-3(2))

### Prevent unauthorized removal (MA-3(3))

> **Guidance:** MA-3(3) covers maintenance equipment, such as a vendor's diagnostic laptop or analyzer, that may have picked up organizational information during the work. Organizational information includes information the organization holds as a steward for others, as NIST's discussion of this enhancement says. The four measures are alternatives; the maintenance log records which one was used. Sanitize as the media sanitization procedure sets out (MP-6), and record it in the [media sanitization record](https://kston83.github.io/nist-guide/templates/forms/media-sanitization-record/).

- The [System owner] shall prevent the removal of maintenance equipment containing organizational information from the facility by verifying that there is no organizational information on the equipment, sanitizing or destroying the equipment, retaining the equipment within the facility, or obtaining a written exemption from [Fill in: personnel or roles who can authorize removal of equipment from the facility. Typical: the Chief Information Security Officer] explicitly authorizing its removal. (MA-3(3))
- The [System owner] shall record in the maintenance records which of these four measures was used for each piece of maintenance equipment. (MA-3(3))
- Maintenance contracts shall allow the organization to keep, sanitize or destroy maintenance equipment or its storage media that contain organizational information. (MA-3(3))

#### Federal systems

Under [32 CFR 2002.14(f)(2)](https://www.ecfr.gov/current/title-32/section-2002.14), agencies that destroy controlled unclassified information (CUI), including in electronic form, must make it unreadable, indecipherable and irrecoverable. They must use any destruction method specifically required by law, regulation or Government-wide policy for that CUI; otherwise they must use the destruction guidance in NIST SP 800-53 and SP 800-88, or a method approved for classified national security information under 32 CFR 2001.47. As of September 2026.

- Where maintenance equipment containing CUI is destroyed to prevent its removal, the [System owner] shall destroy it by a method that 32 CFR 2002.14(f)(2) permits. (MA-3(3)(b))

### Nonlocal maintenance (MA-4)

> **Guidance:** Nonlocal maintenance is maintenance or diagnosis by someone who connects over a network, internal or external, rather than being physically present. It is remote access, so the AC-17 requirements apply as well: a managed access control point (AC-17(3)), encryption (AC-17(2)) and remote privileged commands only as AC-17(4) allows. NIST's MA-4 discussion ties strong authentication to IA-2: replay-resistant, multi-factor authenticators, such as a PKI certificate on a token protected by a PIN. The common finding is a vendor's always-on remote support tool or account that nobody approved; enabling a maintenance account only for each approved session and disabling it afterward closes that gap. The [maintenance log](https://kston83.github.io/nist-guide/templates/forms/maintenance-log/) records each session.

- The [System owner] shall approve each nonlocal maintenance and diagnostic session before it starts. (MA-4a)
- The [System owner] shall ensure each nonlocal maintenance and diagnostic session is monitored while it is in progress, through session supervision or live review of its audit records. (MA-4a)
- The [System owner] shall allow the use of nonlocal maintenance and diagnostic tools only as this policy permits and as documented in the system security plan, which shall name each tool and the connection it uses. (MA-4b)
- Nonlocal maintenance connections shall pass through the organization's managed remote access service, and not through a tool or connection that the maintenance provider controls on its own. (MA-4b)
- The [System owner] shall ensure nonlocal maintenance and diagnostic sessions are established with strong authentication: multi-factor authentication with a replay-resistant authenticator, as required for network access to the system's accounts (IA-2(1), IA-2(2), IA-2(8)). (MA-4c)
- The [Account manager] shall keep each account used by an external maintenance provider disabled except during an approved session. (MA-4c)
- The [System owner] shall maintain records of each nonlocal maintenance and diagnostic session, including who performed it, when it started and ended, what was done and who approved it. (MA-4d)
- The person performing nonlocal maintenance shall terminate the session and network connections when the maintenance is completed, and the [System owner] shall ensure the system also ends them when the approved session ends. (MA-4e)

#### Federal systems

[OMB M-22-09](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf), Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (January 26, 2022), requires phishing-resistant multi-factor authentication for agency staff, contractors and partners, enforced at the application layer. [OMB M-19-17](https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf) (May 21, 2019), Section III, item 2, requires Personal Identity Verification (PIV) credentials, where applicable in accordance with OPM requirements, as the primary means of identification and authentication to Federal information systems by Federal employees and contractors. [OMB M-26-18](https://www.whitehouse.gov/wp-content/uploads/2026/08/M-26-18-Scaling-Use-of-Login.gov-to-Deliver-a-Universal-Sign-on-for-Public-Services.pdf) (August 31, 2026), footnote 5, lists both memoranda as existing OMB policy. CISA [Binding Operational Directive 23-02](https://www.cisa.gov/news-events/directives/binding-operational-directive-23-02), Mitigating the Risk from Internet-Exposed Management Interfaces (June 13, 2023), covers the networked management interfaces of routers, switches, firewalls, VPN concentrators, proxies, load balancers and out-of-band server management interfaces that are reachable from the public internet, but not the management portals and APIs of cloud service offerings. Within 14 days of discovering such an interface, or of notice from CISA, agencies must either make it reachable only from an internal enterprise network or put access to it behind a zero trust policy enforcement point separate from the interface. As of September 2026.

- The [System owner] shall require phishing-resistant multi-factor authentication for nonlocal maintenance sessions by agency staff, contractors and partners, as OMB M-22-09 requires, using a PIV or derived PIV credential where the person holds one, as OMB M-19-17 requires. (MA-4c)
- For each device within the scope of BOD 23-02, the [System owner] shall ensure its management interface is reachable only from an internal enterprise network, or only through a policy enforcement point separate from the interface, and shall correct any exposed interface within 14 days of its discovery or of notice from CISA. (MA-4b)

### Comparable security and sanitization (MA-4(3))

> **Guidance:** MA-4(3) is in the High baseline. Comparable security means the controls on the system, tools and equipment used for the maintenance are at least as comprehensive as those on the system being serviced, as NIST's discussion of this enhancement puts it. For an external provider, get that assurance in the maintenance contract and check it the way the external service review checks any provider (SA-9). Where no provider can show it, use the second option: take the component out, sanitize it, and inspect and sanitize it again before it goes back.

- The [System owner] shall require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced. (MA-4(3)(a))
- The [System owner] shall record, for each provider of nonlocal maintenance, the basis for concluding that its capability is comparable, such as its authorization or an independent attestation. (MA-4(3)(a))
- Where comparable capability cannot be shown, the [System owner] shall remove the component to be serviced from the system and sanitize it of organizational information before the nonlocal service, and inspect it and sanitize it of potentially malicious software after the service and before reconnecting it to the system. (MA-4(3)(b))

### Maintenance personnel (MA-5)

> **Guidance:** MA-5 covers the people who maintain the system's hardware and software; physical access to the facility for them is PE-2, recorded in the [physical access list](https://kston83.github.io/nist-guide/templates/forms/physical-access-list/) or, for visitors, the [visitor log](https://kston83.github.io/nist-guide/templates/forms/visitor-log/). Unescorted maintenance personnel need the same access authorizations as anyone with that access: screening (PS-3), a signed access agreement (PS-6) and, for a contractor, the external personnel requirements of the [Personnel Security Policy](https://kston83.github.io/nist-guide/templates/policies/ps/) (PS-7). NIST's MA-5 discussion allows temporary credentials, for one use or a very limited time, for vendors who must work with little notice. The [maintenance log](https://kston83.github.io/nist-guide/templates/forms/maintenance-log/) holds the authorized list and records each escort.

- The [System owner] shall establish a process for authorizing maintenance personnel, in which the system owner approves each maintenance organization and each individual before they perform maintenance. (MA-5a)
- The [System owner] shall maintain a list of authorized maintenance organizations and personnel for the system, and review it at least quarterly. (MA-5a)
- Maintenance contracts shall require the provider to notify the organization within 24 hours when a person on the authorized list leaves the provider or no longer supports the organization, as for other external personnel (PS-7). (MA-5a)
- The [System owner] shall verify that non-escorted personnel performing maintenance on the system possess the required access authorizations before the work starts. (MA-5b)
- The [System owner] shall designate organizational personnel with the required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations. (MA-5c)
- The designated supervisor shall remain with the maintenance personnel, or supervise the session, for the whole activity, and shall be recorded as the escort in the maintenance records. (MA-5c)
- Where maintenance personnel not on the authorized list need access with little notice, the [Account manager] shall issue temporary credentials valid for one use or for the approved maintenance period only, and disable them when it ends. (MA-5)

### Individuals without appropriate access (MA-5(1))

> **Guidance:** MA-5(1) is in the High baseline. NIST's discussion of this enhancement says these procedures are meant to deny visual and electronic access to classified or controlled unclassified information on the system, and that they can be documented in the system security plan. Outside government, apply them to maintenance personnel who lack the screening, citizenship or other access approvals the system's information requires, such as export-controlled information. Systems that process classified information add MA-5(2) to MA-5(4), which are in no baseline.

- The [System owner] shall implement procedures, documented in the system security plan, for the use of maintenance personnel who lack the security clearances, citizenship or formal access approvals the system's information requires. (MA-5(1)(a))
- Those maintenance personnel shall be escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who hold the required clearances and access authorizations and are technically qualified. (MA-5(1)(a)(1))
- Before such personnel begin maintenance or diagnostic activities, the [System owner] shall ensure all volatile information storage components within the system are sanitized, and all nonvolatile storage media are removed or physically disconnected from the system and secured. (MA-5(1)(a)(2))
- Where a system component cannot be sanitized, removed or disconnected from the system, the [System owner] shall develop and implement [Fill in: alternate controls to be developed and implemented in the event that a system component cannot be sanitized, removed, or disconnected from the system. Typical: continuous supervision by an escort who has the required access authorizations, is technically qualified and can end the activity at any time; screens, ports and data on the component kept out of the maintenance person's view and reach; and review of the audit records of the activity afterward]. (MA-5(1)(b))

### Timely maintenance (MA-6)

> **Guidance:** MA-6 makes sure a failed component can be fixed in time. NIST's MA-6 discussion has the organization pick the components whose failure raises risk, and names having contracts in place as one way to obtain support. Take the components and time from the [business impact analysis](https://kston83.github.io/nist-guide/templates/reports/business-impact-analysis/) and the [contingency plan](https://kston83.github.io/nist-guide/templates/plans/contingency-plan/), so the maintenance support and the recovery time objective agree (CP-2, CP-10). For cloud services, the provider's service level agreement covers its components; record that in the [external service review](https://kston83.github.io/nist-guide/templates/forms/external-service-review/).

- The [System owner] shall obtain maintenance support or spare parts for [Fill in: system components for which maintenance support and/or spare parts are obtained. Typical: the components that support essential mission and business functions, as the business impact analysis identifies them, and the security components that protect them] within [Fill in: time period within which maintenance support and/or spare parts are to be obtained after a failure. Typical: the recovery time objective set in the contingency plan from the business impact analysis] of failure. (MA-6)
- The [System owner] shall keep maintenance contracts, with response and repair times that meet that time, or spare parts on hand, for each of those components, and record the contracts in the contingency plan's vendor contact list. (MA-6)
- The [System owner] shall review the maintenance contracts and spare parts each time the contingency plan is reviewed, and before a contract expires. (MA-6)

## Review and update

- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency with which the current maintenance policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current maintenance policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (MA-1c.1)
- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency with which the current maintenance procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the maintenance procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (MA-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (MA-1a.1(b))