Maintenance Log

Maintenance Log template: The record of each maintenance, repair and replacement activity on a system, local or nonlocal, with its approval, the people and escort, the tools, any removal and sanitization, and the control check afterward, plus the system's authorized maintenance personnel and approved maintenance tools, as SP 800-53 MA-2 requires.

Type	Program stage	Status	Template version	NIST basis
Form or register	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The record of each maintenance, repair and replacement activity on a system, local or nonlocal, with its approval, the people and escort, the tools, any removal and sanitization, and the control check afterward, plus the system’s authorized maintenance personnel and approved maintenance tools, as SP 800-53 MA-2 requires.

Controls satisfied

Control	Title
MA-2	Controlled Maintenance
MA-2(2)	Automated Maintenance Activities
MA-3	Maintenance Tools
MA-3(1)	Inspect Tools
MA-3(2)	Inspect Media
MA-3(3)	Prevent Unauthorized Removal
MA-4	Nonlocal Maintenance
MA-4(3)	Comparable Security and Sanitization
MA-5	Maintenance Personnel
MA-5(1)	Individuals Without Appropriate Access

Downloads

Variant	Ready to adopt	Annotated
All baselines	Word · Markdown	Word · Markdown

The register as a spreadsheet: CSV, with one column per field.

Preview (annotated)

Guidance

Keep one log for each system, or one per facility for shared equipment such as printers and copiers, which NIST’s MA-2 discussion includes. An organization with an IT service management system can keep the register there instead, as long as each record holds the fields below; for a High system, that is how MA-2(2) is usually met. Assessors sample the register against the maintenance schedule, the change records and remote access logs, and ask for the approval, the escort and the sanitization record behind each entry. The register at the end is also downloadable as a CSV file. Sections 2 and 3 are the lists that MA-5 and MA-3 require; keep them current here or link to where they are kept.

System	System owner	Log owner	Last updated	Updated by
Fill in: system name and identifier	Fill in: name and title	Fill in: maintenance coordinator or system administrator	Fill in: date	Fill in: name and title

1. How to use this log

• Schedule maintenance, repair and replacement as the manufacturer or vendor specifies and as organizational requirements add, and record each activity in the register (MA-2a).
• Get the system owner’s approval before each activity starts, and record who monitored it (MA-2b).
• Include Fill in: information to be included in organizational maintenance records Typical: the date and time, the system and component, a description of the maintenance performed, the names and organization of the individuals performing it, the escort’s name, the components or equipment removed or replaced, the approval, and the result of the post-maintenance control check in each record (MA-2f).
• Record in the register the change request for any maintenance that changes the system’s configuration (MA-2b, CM-3).
• Before a component leaves the facility for off-site maintenance, repair or replacement, get the explicit approval of Fill in: personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs Typical: the system owner (MA-2c), and sanitize its media to remove Fill in: information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement Typical: all organizational information, including personally identifiable information, credentials and cryptographic keys (MA-2d). Record the sanitization record’s ID. Keep storage media that cannot be sanitized, such as a failed drive, rather than sending them.
• After each activity, check the potentially impacted controls and record the result (MA-2e).
• The system owner reviews the register at least quarterly against the maintenance schedule and change records, and records the review in section 5 (MA-2a).
• Keep the log for Fill in: retention period from the organization’s records retention schedule.

Field	What to record
Record ID	A unique ID for the activity
Start and end	Date and time the activity started and ended
Component	The system component or equipment serviced, with its inventory ID (CM-8)
Type	Scheduled, repair, replacement or diagnostic
Location	On site, nonlocal, or off site (removed from the facility)
Description	What was done, and why
Performed by	Names and organization of the individuals who performed it, and whether each is on the authorized list in section 2 (MA-5)
Escort or supervisor	Name of the person who escorted or supervised, or “not required” for authorized, unescorted personnel (MA-5c)
Approved by	Name and date of the approval before the activity (MA-2b), and the change request ID if one applies (CM-3)
Tools and media	Tools used, from section 3, with the result of the tool inspection and the media scan (MA-3, MA-3(1), MA-3(2))
Nonlocal session	For nonlocal maintenance: how the person connected and authenticated, and when the session and connections ended (MA-4)
Removed or replaced	Components or equipment removed or replaced, with serial numbers; for removal, who approved it and the sanitization record ID (MA-2c, MA-2d); for maintenance equipment, how its removal was handled (MA-3(3))
Control check	Controls checked after the activity, by whom, and the result (MA-2e)

2. Authorized maintenance organizations and personnel

• Only the organizations and people on this list may perform maintenance on the system without an escort, and only after their access authorizations are verified (MA-5a, MA-5b).
• The system owner approves each addition and reviews the list at least quarterly (MA-5a).
• Anyone not on the list works only under the supervision of a designated escort with the required access authorizations and technical competence, with temporary credentials valid for that maintenance period only (MA-5c).

Organization	Person	Maintenance performed	Access authorizations verified (screening, access agreement)	Local, nonlocal or both	Approved by and date	Contract or agreement	Review date
Fill in: organization	Fill in: name	Fill in: components or services	Fill in: what was verified, and date	Fill in: type	Fill in: name and date	Fill in: reference	Fill in: date

Guidance

For a High system, record here which people lack the clearances, citizenship or other access approvals the system’s information requires, since MA-5(1) sets extra steps for them: supervision throughout by a qualified escort with the required access, volatile storage sanitized and nonvolatile media removed or disconnected beforehand, or the alternate controls in the MA-5(1) clause where that cannot be done.

3. Approved maintenance tools

• Only the tools on this list may be used to maintain the system, by authorized maintenance personnel (MA-3a).
• Tools brought in or downloaded by maintenance personnel are inspected for improper or unauthorized modifications before each use, and media with diagnostic or test programs are scanned for malicious code before use (MA-3(1), MA-3(2)). Report a modified tool or infected media as a security incident.
• Review this list Fill in: frequency at which to review previously approved system maintenance tools Typical: at least annually and remove tools that are outdated, unsupported, no longer needed or no longer used (MA-3b).
• Maintenance equipment containing organizational information leaves the facility only after it is verified to hold none, is sanitized or destroyed, or under a written exemption from Fill in: personnel or roles who can authorize removal of equipment from the facility Typical: the Chief Information Security Officer; otherwise it stays (MA-3(3)).

Tool	Version	Type (hardware, software, firmware or cloud service)	Owner (organization or provider)	Used for	Nonlocal use documented in the system security plan	Approved by and date	Last review
Fill in: tool	Fill in: version	Fill in: type	Fill in: owner	Fill in: purpose	Fill in: yes, with the section, or not used remotely	Fill in: name and date	Fill in: date

4. Nonlocal maintenance

• Each nonlocal session is approved beforehand, monitored while it runs, and recorded in the register (MA-4a, MA-4d).
• Connections go through the organization’s managed remote access service, with multi-factor, replay-resistant authentication, using only tools documented in the system security plan (MA-4b, MA-4c).
• Accounts that external maintenance providers use stay disabled except during an approved session (MA-4c).
• The session and network connections are ended when the maintenance is completed (MA-4e).
• For a High system, record for each provider the basis for concluding its maintenance system has comparable security; where it does not, remove, sanitize and afterward inspect the component instead (MA-4(3)).

Federal systems

OMB M-22-09 (January 26, 2022) requires phishing-resistant multi-factor authentication for agency staff, contractors and partners, and OMB M-19-17 (May 21, 2019), Section III, item 2, requires PIV credentials, where applicable in accordance with OPM requirements, as the primary means of authentication to Federal information systems by Federal employees and contractors; OMB M-26-18 (August 31, 2026), footnote 5, lists both as existing OMB policy. CISA Binding Operational Directive 23-02 (June 13, 2023) requires agencies, within 14 days of discovery or of notice from CISA, to make the internet-exposed management interfaces of in-scope network devices reachable only from an internal enterprise network or only through a zero trust policy enforcement point separate from the interface. As of September 2026.

• For each nonlocal session, the register’s “Nonlocal session” field shall record the phishing-resistant authenticator used, as OMB M-22-09 requires, and whether it was a PIV or derived PIV credential. (MA-4c)
• Where nonlocal maintenance uses the management interface of a device within the scope of BOD 23-02, the register shall record the internal network or policy enforcement point the session passed through. (MA-4b)

5. Record reviews

Review date	Reviewed by	Period covered	Records checked against the schedule and change records	Issues found and actions	Next review
Fill in: date	Fill in: name and title	Fill in: dates	Fill in: number, and any gaps	Fill in: issues, or “none”	Fill in: date

Register

Record ID	Start and end	Component	Type	Location	Description	Performed by	Escort or supervisor	Approved by	Tools and media	Nonlocal session	Removed or replaced	Control check
Fill in: ID	Fill in: dates and times	Fill in: component and inventory ID	Fill in: type	Fill in: on site, nonlocal or off site	Fill in: what was done and why	Fill in: names, organization, on the authorized list or not	Fill in: name, or not required	Fill in: name, date, change request ID	Fill in: tools, inspection and scan results	Fill in: connection, authentication, end time, or not applicable	Fill in: items, serial numbers, removal approval and sanitization record ID, or none	Fill in: controls checked, by whom, result