# Maintenance Policy

**Template version:** 1.0.0 · **Baseline:** Moderate · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ma/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Maintenance, and who is accountable for meeting those requirements. (MA-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (MA-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (MA-1a.1(a))
- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (MA-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (MA-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (MA-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (MA-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (MA-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (MA-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (MA-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (MA-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (MA-1a.1(a))

## Procedures

The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (MA-1a.2)

## Dissemination

- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the maintenance policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (MA-1a)
- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the maintenance procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (MA-1a)

## Policy statements

### Controlled maintenance (MA-2)

- The [System owner] shall schedule maintenance, repair and replacement of system components in accordance with manufacturer or vendor specifications and organizational requirements. (MA-2a)
- The [System owner] shall document each maintenance, repair and replacement activity in the system's maintenance records. (MA-2a)
- The [System owner] shall review the maintenance records at least quarterly against the maintenance schedule and the system's change records. (MA-2a)
- The [System owner] shall approve each maintenance activity before it starts, whether it is performed on site or remotely and whether components are serviced on site or removed to another location. (MA-2b)
- The [System owner] shall ensure each maintenance activity is monitored while it is performed, by an escort or by review of the session and its records. (MA-2b)
- Maintenance that changes the system's configuration shall also follow the change control process (CM-3). (MA-2b)
- The [System owner] shall require [Fill in: personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs. Typical: the system owner] to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair or replacement. (MA-2c)
- The [System owner] shall ensure equipment is sanitized to remove [Fill in: information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement. Typical: all organizational information, including personally identifiable information, credentials and cryptographic keys] from associated media before it is removed from organizational facilities for off-site maintenance, repair or replacement. (MA-2d)
- Where storage media cannot be sanitized, such as a failed drive, the [System owner] shall keep the media within the organization and sanitize or destroy them there, rather than release them. (MA-2d)
- After each maintenance, repair or replacement action, the [System owner] shall check all potentially impacted controls to verify that they are still functioning properly. (MA-2e)
- The [System owner] shall include [Fill in: information to be included in organizational maintenance records. Typical: the date and time, the system and component, a description of the maintenance performed, the names and organization of the individuals performing it, the escort's name, the components or equipment removed or replaced, the approval, and the result of the post-maintenance control check] in the organization's maintenance records. (MA-2f)

### Maintenance tools (MA-3)

- The [System owner] shall approve each maintenance tool before it is used on the system, and record it on the system's approved maintenance tools list. (MA-3a)
- The [System owner] shall control the use of maintenance tools, so that only approved tools are used, only by authorized maintenance personnel. (MA-3a)
- The [System owner] shall monitor the use of maintenance tools, through escort or session supervision and the audit records of privileged tool use (AU-2). (MA-3a)
- The [System owner] shall review previously approved system maintenance tools [Fill in: frequency at which to review previously approved system maintenance tools. Typical: at least annually], and withdraw approval for tools that are outdated, unsupported, no longer needed or no longer used. (MA-3b)

### Inspect tools (MA-3(1))

- The [System owner] shall ensure the maintenance tools that maintenance personnel bring into the facility or download are inspected for improper or unauthorized modifications before each use on the system. (MA-3(1))
- Personnel shall report a tool found to be modified improperly, or to contain malicious code, as a security incident under the incident response plan (IR-6). (MA-3(1))

### Inspect media (MA-3(2))

- The [System owner] shall ensure media containing diagnostic and test programs are checked for malicious code before the media are used in the system. (MA-3(2))
- Personnel shall report malicious code found on such media as a security incident under the incident response plan (IR-6), and the media shall not be used. (MA-3(2))

### Prevent unauthorized removal (MA-3(3))

- The [System owner] shall prevent the removal of maintenance equipment containing organizational information from the facility by verifying that there is no organizational information on the equipment, sanitizing or destroying the equipment, retaining the equipment within the facility, or obtaining a written exemption from [Fill in: personnel or roles who can authorize removal of equipment from the facility. Typical: the Chief Information Security Officer] explicitly authorizing its removal. (MA-3(3))
- The [System owner] shall record in the maintenance records which of these four measures was used for each piece of maintenance equipment. (MA-3(3))
- Maintenance contracts shall allow the organization to keep, sanitize or destroy maintenance equipment or its storage media that contain organizational information. (MA-3(3))

#### Federal systems

Under [32 CFR 2002.14(f)(2)](https://www.ecfr.gov/current/title-32/section-2002.14), agencies that destroy controlled unclassified information (CUI), including in electronic form, must make it unreadable, indecipherable and irrecoverable. They must use any destruction method specifically required by law, regulation or Government-wide policy for that CUI; otherwise they must use the destruction guidance in NIST SP 800-53 and SP 800-88, or a method approved for classified national security information under 32 CFR 2001.47. As of September 2026.

- Where maintenance equipment containing CUI is destroyed to prevent its removal, the [System owner] shall destroy it by a method that 32 CFR 2002.14(f)(2) permits. (MA-3(3)(b))

### Nonlocal maintenance (MA-4)

- The [System owner] shall approve each nonlocal maintenance and diagnostic session before it starts. (MA-4a)
- The [System owner] shall ensure each nonlocal maintenance and diagnostic session is monitored while it is in progress, through session supervision or live review of its audit records. (MA-4a)
- The [System owner] shall allow the use of nonlocal maintenance and diagnostic tools only as this policy permits and as documented in the system security plan, which shall name each tool and the connection it uses. (MA-4b)
- Nonlocal maintenance connections shall pass through the organization's managed remote access service, and not through a tool or connection that the maintenance provider controls on its own. (MA-4b)
- The [System owner] shall ensure nonlocal maintenance and diagnostic sessions are established with strong authentication: multi-factor authentication with a replay-resistant authenticator, as required for network access to the system's accounts (IA-2(1), IA-2(2), IA-2(8)). (MA-4c)
- The [Account manager] shall keep each account used by an external maintenance provider disabled except during an approved session. (MA-4c)
- The [System owner] shall maintain records of each nonlocal maintenance and diagnostic session, including who performed it, when it started and ended, what was done and who approved it. (MA-4d)
- The person performing nonlocal maintenance shall terminate the session and network connections when the maintenance is completed, and the [System owner] shall ensure the system also ends them when the approved session ends. (MA-4e)

#### Federal systems

[OMB M-22-09](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf), Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (January 26, 2022), requires phishing-resistant multi-factor authentication for agency staff, contractors and partners, enforced at the application layer. [OMB M-19-17](https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf) (May 21, 2019), Section III, item 2, requires Personal Identity Verification (PIV) credentials, where applicable in accordance with OPM requirements, as the primary means of identification and authentication to Federal information systems by Federal employees and contractors. [OMB M-26-18](https://www.whitehouse.gov/wp-content/uploads/2026/08/M-26-18-Scaling-Use-of-Login.gov-to-Deliver-a-Universal-Sign-on-for-Public-Services.pdf) (August 31, 2026), footnote 5, lists both memoranda as existing OMB policy. CISA [Binding Operational Directive 23-02](https://www.cisa.gov/news-events/directives/binding-operational-directive-23-02), Mitigating the Risk from Internet-Exposed Management Interfaces (June 13, 2023), covers the networked management interfaces of routers, switches, firewalls, VPN concentrators, proxies, load balancers and out-of-band server management interfaces that are reachable from the public internet, but not the management portals and APIs of cloud service offerings. Within 14 days of discovering such an interface, or of notice from CISA, agencies must either make it reachable only from an internal enterprise network or put access to it behind a zero trust policy enforcement point separate from the interface. As of September 2026.

- The [System owner] shall require phishing-resistant multi-factor authentication for nonlocal maintenance sessions by agency staff, contractors and partners, as OMB M-22-09 requires, using a PIV or derived PIV credential where the person holds one, as OMB M-19-17 requires. (MA-4c)
- For each device within the scope of BOD 23-02, the [System owner] shall ensure its management interface is reachable only from an internal enterprise network, or only through a policy enforcement point separate from the interface, and shall correct any exposed interface within 14 days of its discovery or of notice from CISA. (MA-4b)

### Maintenance personnel (MA-5)

- The [System owner] shall establish a process for authorizing maintenance personnel, in which the system owner approves each maintenance organization and each individual before they perform maintenance. (MA-5a)
- The [System owner] shall maintain a list of authorized maintenance organizations and personnel for the system, and review it at least quarterly. (MA-5a)
- Maintenance contracts shall require the provider to notify the organization within 24 hours when a person on the authorized list leaves the provider or no longer supports the organization, as for other external personnel (PS-7). (MA-5a)
- The [System owner] shall verify that non-escorted personnel performing maintenance on the system possess the required access authorizations before the work starts. (MA-5b)
- The [System owner] shall designate organizational personnel with the required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations. (MA-5c)
- The designated supervisor shall remain with the maintenance personnel, or supervise the session, for the whole activity, and shall be recorded as the escort in the maintenance records. (MA-5c)
- Where maintenance personnel not on the authorized list need access with little notice, the [Account manager] shall issue temporary credentials valid for one use or for the approved maintenance period only, and disable them when it ends. (MA-5)

### Timely maintenance (MA-6)

- The [System owner] shall obtain maintenance support or spare parts for [Fill in: system components for which maintenance support and/or spare parts are obtained. Typical: the components that support essential mission and business functions, as the business impact analysis identifies them, and the security components that protect them] within [Fill in: time period within which maintenance support and/or spare parts are to be obtained after a failure. Typical: the recovery time objective set in the contingency plan from the business impact analysis] of failure. (MA-6)
- The [System owner] shall keep maintenance contracts, with response and repair times that meet that time, or spare parts on hand, for each of those components, and record the contracts in the contingency plan's vendor contact list. (MA-6)
- The [System owner] shall review the maintenance contracts and spare parts each time the contingency plan is reviewed, and before a contract expires. (MA-6)

## Review and update

- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency with which the current maintenance policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current maintenance policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (MA-1c.1)
- The [Fill in: an official to manage the maintenance policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency with which the current maintenance procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the maintenance procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (MA-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (MA-1a.1(b))