# Maintenance Policy

**Template version:** 1.0.0 · **Baseline:** Low · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ma/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet MA-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the MA-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Maintenance, and who is accountable for meeting those requirements. (MA-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (MA-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (MA-1a.1(a))
- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (MA-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (MA-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (MA-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (MA-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (MA-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (MA-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (MA-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (MA-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (MA-1a.1(a))

## Procedures

The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (MA-1a.2)

## Dissemination

- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the maintenance policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (MA-1a)
- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the maintenance procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (MA-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Controlled maintenance (MA-2)

> **Guidance:** MA-2 covers every kind of maintenance, repair and replacement, on site or remote, including printers, scanners and copiers, which NIST's MA-2 discussion names. The information recorded for each activity is the list NIST's discussion gives, plus the approval and the control check that MA-2b and MA-2e ask for. The [maintenance log](https://kston83.github.io/nist-guide/templates/forms/maintenance-log/) holds these records. Sanitize media before they leave for repair as the media sanitization procedure sets out (MP-6), following NIST SP 800-88 Rev. 2, [Guidelines for Media Sanitization](https://csrc.nist.gov/pubs/sp/800/88/r2/final) (September 2025, final; as of September 2026), and record it in the [media sanitization record](https://kston83.github.io/nist-guide/templates/forms/media-sanitization-record/). Assessors sample maintenance records against the schedule and ask for the removal approvals and sanitization records.

- The [System owner] shall schedule maintenance, repair and replacement of system components in accordance with manufacturer or vendor specifications and organizational requirements. (MA-2a)
- The [System owner] shall document each maintenance, repair and replacement activity in the system's maintenance records. (MA-2a)
- The [System owner] shall review the maintenance records at least quarterly against the maintenance schedule and the system's change records. (MA-2a)
- The [System owner] shall approve each maintenance activity before it starts, whether it is performed on site or remotely and whether components are serviced on site or removed to another location. (MA-2b)
- The [System owner] shall ensure each maintenance activity is monitored while it is performed, by an escort or by review of the session and its records. (MA-2b)
- Maintenance that changes the system's configuration shall also follow the change control process (CM-3). (MA-2b)
- The [System owner] shall require [Fill in: personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs. Typical: the system owner] to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair or replacement. (MA-2c)
- The [System owner] shall ensure equipment is sanitized to remove [Fill in: information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement. Typical: all organizational information, including personally identifiable information, credentials and cryptographic keys] from associated media before it is removed from organizational facilities for off-site maintenance, repair or replacement. (MA-2d)
- Where storage media cannot be sanitized, such as a failed drive, the [System owner] shall keep the media within the organization and sanitize or destroy them there, rather than release them. (MA-2d)
- After each maintenance, repair or replacement action, the [System owner] shall check all potentially impacted controls to verify that they are still functioning properly. (MA-2e)
- The [System owner] shall include [Fill in: information to be included in organizational maintenance records. Typical: the date and time, the system and component, a description of the maintenance performed, the names and organization of the individuals performing it, the escort's name, the components or equipment removed or replaced, the approval, and the result of the post-maintenance control check] in the organization's maintenance records. (MA-2f)

> **Guidance:** Replacement components bring supply chain risk, which NIST's MA-2 discussion asks organizations to consider: obtain them from the original manufacturer or its authorized channel, or from a source the supply chain risk management plan allows. The post-maintenance check can use the change's security impact analysis (CM-4) to decide which controls to verify.

### Nonlocal maintenance (MA-4)

> **Guidance:** Nonlocal maintenance is maintenance or diagnosis by someone who connects over a network, internal or external, rather than being physically present. It is remote access, so the AC-17 requirements apply as well: a managed access control point (AC-17(3)), encryption (AC-17(2)) and remote privileged commands only as AC-17(4) allows. NIST's MA-4 discussion ties strong authentication to IA-2: replay-resistant, multi-factor authenticators, such as a PKI certificate on a token protected by a PIN. The common finding is a vendor's always-on remote support tool or account that nobody approved; enabling a maintenance account only for each approved session and disabling it afterward closes that gap. The [maintenance log](https://kston83.github.io/nist-guide/templates/forms/maintenance-log/) records each session.

- The [System owner] shall approve each nonlocal maintenance and diagnostic session before it starts. (MA-4a)
- The [System owner] shall ensure each nonlocal maintenance and diagnostic session is monitored while it is in progress, through session supervision or live review of its audit records. (MA-4a)
- The [System owner] shall allow the use of nonlocal maintenance and diagnostic tools only as this policy permits and as documented in the system security plan, which shall name each tool and the connection it uses. (MA-4b)
- Nonlocal maintenance connections shall pass through the organization's managed remote access service, and not through a tool or connection that the maintenance provider controls on its own. (MA-4b)
- The [System owner] shall ensure nonlocal maintenance and diagnostic sessions are established with strong authentication: multi-factor authentication with a replay-resistant authenticator, as required for network access to the system's accounts (IA-2(1), IA-2(2), IA-2(8)). (MA-4c)
- The [Account manager] shall keep each account used by an external maintenance provider disabled except during an approved session. (MA-4c)
- The [System owner] shall maintain records of each nonlocal maintenance and diagnostic session, including who performed it, when it started and ended, what was done and who approved it. (MA-4d)
- The person performing nonlocal maintenance shall terminate the session and network connections when the maintenance is completed, and the [System owner] shall ensure the system also ends them when the approved session ends. (MA-4e)

#### Federal systems

[OMB M-22-09](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf), Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (January 26, 2022), requires phishing-resistant multi-factor authentication for agency staff, contractors and partners, enforced at the application layer. [OMB M-19-17](https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf) (May 21, 2019), Section III, item 2, requires Personal Identity Verification (PIV) credentials, where applicable in accordance with OPM requirements, as the primary means of identification and authentication to Federal information systems by Federal employees and contractors. [OMB M-26-18](https://www.whitehouse.gov/wp-content/uploads/2026/08/M-26-18-Scaling-Use-of-Login.gov-to-Deliver-a-Universal-Sign-on-for-Public-Services.pdf) (August 31, 2026), footnote 5, lists both memoranda as existing OMB policy. CISA [Binding Operational Directive 23-02](https://www.cisa.gov/news-events/directives/binding-operational-directive-23-02), Mitigating the Risk from Internet-Exposed Management Interfaces (June 13, 2023), covers the networked management interfaces of routers, switches, firewalls, VPN concentrators, proxies, load balancers and out-of-band server management interfaces that are reachable from the public internet, but not the management portals and APIs of cloud service offerings. Within 14 days of discovering such an interface, or of notice from CISA, agencies must either make it reachable only from an internal enterprise network or put access to it behind a zero trust policy enforcement point separate from the interface. As of September 2026.

- The [System owner] shall require phishing-resistant multi-factor authentication for nonlocal maintenance sessions by agency staff, contractors and partners, as OMB M-22-09 requires, using a PIV or derived PIV credential where the person holds one, as OMB M-19-17 requires. (MA-4c)
- For each device within the scope of BOD 23-02, the [System owner] shall ensure its management interface is reachable only from an internal enterprise network, or only through a policy enforcement point separate from the interface, and shall correct any exposed interface within 14 days of its discovery or of notice from CISA. (MA-4b)

### Maintenance personnel (MA-5)

> **Guidance:** MA-5 covers the people who maintain the system's hardware and software; physical access to the facility for them is PE-2, recorded in the [physical access list](https://kston83.github.io/nist-guide/templates/forms/physical-access-list/) or, for visitors, the [visitor log](https://kston83.github.io/nist-guide/templates/forms/visitor-log/). Unescorted maintenance personnel need the same access authorizations as anyone with that access: screening (PS-3), a signed access agreement (PS-6) and, for a contractor, the external personnel requirements of the [Personnel Security Policy](https://kston83.github.io/nist-guide/templates/policies/ps/) (PS-7). NIST's MA-5 discussion allows temporary credentials, for one use or a very limited time, for vendors who must work with little notice. The [maintenance log](https://kston83.github.io/nist-guide/templates/forms/maintenance-log/) holds the authorized list and records each escort.

- The [System owner] shall establish a process for authorizing maintenance personnel, in which the system owner approves each maintenance organization and each individual before they perform maintenance. (MA-5a)
- The [System owner] shall maintain a list of authorized maintenance organizations and personnel for the system, and review it at least quarterly. (MA-5a)
- Maintenance contracts shall require the provider to notify the organization within 24 hours when a person on the authorized list leaves the provider or no longer supports the organization, as for other external personnel (PS-7). (MA-5a)
- The [System owner] shall verify that non-escorted personnel performing maintenance on the system possess the required access authorizations before the work starts. (MA-5b)
- The [System owner] shall designate organizational personnel with the required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations. (MA-5c)
- The designated supervisor shall remain with the maintenance personnel, or supervise the session, for the whole activity, and shall be recorded as the escort in the maintenance records. (MA-5c)
- Where maintenance personnel not on the authorized list need access with little notice, the [Account manager] shall issue temporary credentials valid for one use or for the approved maintenance period only, and disable them when it ends. (MA-5)

## Review and update

- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency with which the current maintenance policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current maintenance policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (MA-1c.1)
- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency with which the current maintenance procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the maintenance procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (MA-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (MA-1a.1(b))