Maintenance Policy

Maintenance Policy template: Ready-to-adopt Maintenance policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High).

Type	Program stage	Status	Template version	NIST basis
Policy	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Maintenance policy states what the organization requires for maintenance and who is accountable for it. It meets MA-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. MA-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
MA-1	Policy and Procedures	Yes	Yes	Yes
MA-2	Controlled Maintenance	Yes	Yes	Yes
MA-2(2)	Automated Maintenance Activities			Yes
MA-3	Maintenance Tools		Yes	Yes
MA-3(1)	Inspect Tools		Yes	Yes
MA-3(2)	Inspect Media		Yes	Yes
MA-3(3)	Prevent Unauthorized Removal		Yes	Yes
MA-4	Nonlocal Maintenance	Yes	Yes	Yes
MA-4(3)	Comparable Security and Sanitization			Yes
MA-5	Maintenance Personnel	Yes	Yes	Yes
MA-5(1)	Individuals Without Appropriate Access			Yes
MA-6	Timely Maintenance		Yes	Yes

Decisions to make first

The policy has 19 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Who approves maintenance on each system, and where are the maintenance records kept?	MA-2, MA-2(2)	The system owner approves scheduled maintenance through the change control process and each unscheduled repair before it starts; every activity is recorded in the maintenance log or the IT service management system, and the system owner reviews the records each quarter.	System owner
Who may perform nonlocal maintenance, and how do they connect?	MA-4, MA-4(3), MA-5	Only personnel and maintenance organizations on the authorized list, through the organization’s managed remote access service with multi-factor authentication, using a maintenance account that is enabled for each approved session and disabled when it ends; no always-on remote access tools installed by a vendor.	Chief Information Security Officer
How are maintenance personnel who lack the required access authorizations handled?	MA-5, MA-5(1)	They work only while escorted and supervised by a technically competent employee who has the required access authorizations, with temporary credentials for that visit or session that are disabled when it ends.	System owner
What may leave the facility for repair or replacement, and what must stay?	MA-2, MA-3(3)	Storage media stay; a failed drive is kept and sanitized or destroyed by the organization, under a media retention option in the maintenance contract where available. Other components leave only after sanitization and the system owner’s approval.	System owner
Which components need contracted maintenance support or spare parts, and how quickly must they be restored?	MA-6	The components that support essential mission and business functions, and the security components that protect them, with support contracts or spares on hand that restore them within the recovery time objective in the contingency plan.	System owner

Record your values in the Maintenance decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown

Everything for this family in one file: MA pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet MA-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the MA-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Maintenance, and who is accountable for meeting those requirements. (MA-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (MA-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (MA-1a.1(a))
• The Fill in: an official to manage the maintenance policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (MA-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (MA-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (MA-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (MA-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (MA-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (MA-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (MA-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (MA-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (MA-1a.1(a))

Procedures

The Fill in: an official to manage the maintenance policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (MA-1a.2)

Dissemination

• The Fill in: an official to manage the maintenance policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the maintenance policy is to be disseminated Typical: everyone within its scope, through the policy library. (MA-1a)
• The Fill in: an official to manage the maintenance policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the maintenance procedures are to be disseminated Typical: the people who carry them out, and the system owners. (MA-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Controlled maintenance (MA-2)

Guidance

MA-2 covers every kind of maintenance, repair and replacement, on site or remote, including printers, scanners and copiers, which NIST’s MA-2 discussion names. The information recorded for each activity is the list NIST’s discussion gives, plus the approval and the control check that MA-2b and MA-2e ask for. The maintenance log holds these records. Sanitize media before they leave for repair as the media sanitization procedure sets out (MP-6), following NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025, final; as of September 2026), and record it in the media sanitization record. Assessors sample maintenance records against the schedule and ask for the removal approvals and sanitization records.

• The System owner shall schedule maintenance, repair and replacement of system components in accordance with manufacturer or vendor specifications and organizational requirements. (MA-2a)
• The System owner shall document each maintenance, repair and replacement activity in the system’s maintenance records. (MA-2a)
• The System owner shall review the maintenance records at least quarterly against the maintenance schedule and the system’s change records. (MA-2a)
• The System owner shall approve each maintenance activity before it starts, whether it is performed on site or remotely and whether components are serviced on site or removed to another location. (MA-2b)
• The System owner shall ensure each maintenance activity is monitored while it is performed, by an escort or by review of the session and its records. (MA-2b)
• Maintenance that changes the system’s configuration shall also follow the change control process (CM-3). (MA-2b)
• The System owner shall require Fill in: personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs Typical: the system owner to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair or replacement. (MA-2c)
• The System owner shall ensure equipment is sanitized to remove Fill in: information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement Typical: all organizational information, including personally identifiable information, credentials and cryptographic keys from associated media before it is removed from organizational facilities for off-site maintenance, repair or replacement. (MA-2d)
• Where storage media cannot be sanitized, such as a failed drive, the System owner shall keep the media within the organization and sanitize or destroy them there, rather than release them. (MA-2d)
• After each maintenance, repair or replacement action, the System owner shall check all potentially impacted controls to verify that they are still functioning properly. (MA-2e)
• The System owner shall include Fill in: information to be included in organizational maintenance records Typical: the date and time, the system and component, a description of the maintenance performed, the names and organization of the individuals performing it, the escort’s name, the components or equipment removed or replaced, the approval, and the result of the post-maintenance control check in the organization’s maintenance records. (MA-2f)

Guidance

Replacement components bring supply chain risk, which NIST’s MA-2 discussion asks organizations to consider: obtain them from the original manufacturer or its authorized channel, or from a source the supply chain risk management plan allows. The post-maintenance check can use the change’s security impact analysis (CM-4) to decide which controls to verify.

Maintenance tools (MA-3)

Guidance

Maintenance tools are the diagnostic and repair tools that are not part of the system: diagnostic test equipment, packet sniffers, vendor utilities brought in on media or downloaded, and cloud-based diagnostic services. NIST’s MA-3 discussion notes they can carry malicious code into a facility and a system, and excludes utilities built into the system, such as ping or a switch’s monitoring port. Keep the approved tools list in the maintenance log. The periodic review withdraws approval for tools that are outdated, unsupported or no longer used, as NIST’s discussion describes.

• The System owner shall approve each maintenance tool before it is used on the system, and record it on the system’s approved maintenance tools list. (MA-3a)
• The System owner shall control the use of maintenance tools, so that only approved tools are used, only by authorized maintenance personnel. (MA-3a)
• The System owner shall monitor the use of maintenance tools, through escort or session supervision and the audit records of privileged tool use (AU-2). (MA-3a)
• The System owner shall review previously approved system maintenance tools Fill in: frequency at which to review previously approved system maintenance tools Typical: at least annually, and withdraw approval for tools that are outdated, unsupported, no longer needed or no longer used. (MA-3b)

Inspect tools (MA-3(1))

Guidance

Inspection means checking that a tool is the approved one, in the approved version, with no sign of tampering: for hardware, its seals, serial number and condition; for software, a hash or signature check against the vendor’s published value. NIST’s discussion of this enhancement has an improperly modified tool, or one containing malicious code, handled as an incident.

• The System owner shall ensure the maintenance tools that maintenance personnel bring into the facility or download are inspected for improper or unauthorized modifications before each use on the system. (MA-3(1))
• Personnel shall report a tool found to be modified improperly, or to contain malicious code, as a security incident under the incident response plan (IR-6). (MA-3(1))

Inspect media (MA-3(2))

Guidance

Scan the media on a workstation that is not connected to the system, with the organization’s malicious code protection (SI-3), and record the scan in the maintenance log. NIST’s discussion of this enhancement has malicious code found on the media handled as an incident.

• The System owner shall ensure media containing diagnostic and test programs are checked for malicious code before the media are used in the system. (MA-3(2))
• Personnel shall report malicious code found on such media as a security incident under the incident response plan (IR-6), and the media shall not be used. (MA-3(2))

Prevent unauthorized removal (MA-3(3))

Guidance

MA-3(3) covers maintenance equipment, such as a vendor’s diagnostic laptop or analyzer, that may have picked up organizational information during the work. Organizational information includes information the organization holds as a steward for others, as NIST’s discussion of this enhancement says. The four measures are alternatives; the maintenance log records which one was used. Sanitize as the media sanitization procedure sets out (MP-6), and record it in the media sanitization record.

• The System owner shall prevent the removal of maintenance equipment containing organizational information from the facility by verifying that there is no organizational information on the equipment, sanitizing or destroying the equipment, retaining the equipment within the facility, or obtaining a written exemption from Fill in: personnel or roles who can authorize removal of equipment from the facility Typical: the Chief Information Security Officer explicitly authorizing its removal. (MA-3(3))
• The System owner shall record in the maintenance records which of these four measures was used for each piece of maintenance equipment. (MA-3(3))
• Maintenance contracts shall allow the organization to keep, sanitize or destroy maintenance equipment or its storage media that contain organizational information. (MA-3(3))

Federal systems

Under 32 CFR 2002.14(f)(2), agencies that destroy controlled unclassified information (CUI), including in electronic form, must make it unreadable, indecipherable and irrecoverable. They must use any destruction method specifically required by law, regulation or Government-wide policy for that CUI; otherwise they must use the destruction guidance in NIST SP 800-53 and SP 800-88, or a method approved for classified national security information under 32 CFR 2001.47. As of September 2026.

• Where maintenance equipment containing CUI is destroyed to prevent its removal, the System owner shall destroy it by a method that 32 CFR 2002.14(f)(2) permits. (MA-3(3)(b))

Nonlocal maintenance (MA-4)

Guidance

Nonlocal maintenance is maintenance or diagnosis by someone who connects over a network, internal or external, rather than being physically present. It is remote access, so the AC-17 requirements apply as well: a managed access control point (AC-17(3)), encryption (AC-17(2)) and remote privileged commands only as AC-17(4) allows. NIST’s MA-4 discussion ties strong authentication to IA-2: replay-resistant, multi-factor authenticators, such as a PKI certificate on a token protected by a PIN. The common finding is a vendor’s always-on remote support tool or account that nobody approved; enabling a maintenance account only for each approved session and disabling it afterward closes that gap. The maintenance log records each session.

• The System owner shall approve each nonlocal maintenance and diagnostic session before it starts. (MA-4a)
• The System owner shall ensure each nonlocal maintenance and diagnostic session is monitored while it is in progress, through session supervision or live review of its audit records. (MA-4a)
• The System owner shall allow the use of nonlocal maintenance and diagnostic tools only as this policy permits and as documented in the system security plan, which shall name each tool and the connection it uses. (MA-4b)
• Nonlocal maintenance connections shall pass through the organization’s managed remote access service, and not through a tool or connection that the maintenance provider controls on its own. (MA-4b)
• The System owner shall ensure nonlocal maintenance and diagnostic sessions are established with strong authentication: multi-factor authentication with a replay-resistant authenticator, as required for network access to the system’s accounts (IA-2(1), IA-2(2), IA-2(8)). (MA-4c)
• The Account manager shall keep each account used by an external maintenance provider disabled except during an approved session. (MA-4c)
• The System owner shall maintain records of each nonlocal maintenance and diagnostic session, including who performed it, when it started and ended, what was done and who approved it. (MA-4d)
• The person performing nonlocal maintenance shall terminate the session and network connections when the maintenance is completed, and the System owner shall ensure the system also ends them when the approved session ends. (MA-4e)

Federal systems

OMB M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (January 26, 2022), requires phishing-resistant multi-factor authentication for agency staff, contractors and partners, enforced at the application layer. OMB M-19-17 (May 21, 2019), Section III, item 2, requires Personal Identity Verification (PIV) credentials, where applicable in accordance with OPM requirements, as the primary means of identification and authentication to Federal information systems by Federal employees and contractors. OMB M-26-18 (August 31, 2026), footnote 5, lists both memoranda as existing OMB policy. CISA Binding Operational Directive 23-02, Mitigating the Risk from Internet-Exposed Management Interfaces (June 13, 2023), covers the networked management interfaces of routers, switches, firewalls, VPN concentrators, proxies, load balancers and out-of-band server management interfaces that are reachable from the public internet, but not the management portals and APIs of cloud service offerings. Within 14 days of discovering such an interface, or of notice from CISA, agencies must either make it reachable only from an internal enterprise network or put access to it behind a zero trust policy enforcement point separate from the interface. As of September 2026.

• The System owner shall require phishing-resistant multi-factor authentication for nonlocal maintenance sessions by agency staff, contractors and partners, as OMB M-22-09 requires, using a PIV or derived PIV credential where the person holds one, as OMB M-19-17 requires. (MA-4c)
• For each device within the scope of BOD 23-02, the System owner shall ensure its management interface is reachable only from an internal enterprise network, or only through a policy enforcement point separate from the interface, and shall correct any exposed interface within 14 days of its discovery or of notice from CISA. (MA-4b)

Maintenance personnel (MA-5)

Guidance

MA-5 covers the people who maintain the system’s hardware and software; physical access to the facility for them is PE-2, recorded in the physical access list or, for visitors, the visitor log. Unescorted maintenance personnel need the same access authorizations as anyone with that access: screening (PS-3), a signed access agreement (PS-6) and, for a contractor, the external personnel requirements of the Personnel Security Policy (PS-7). NIST’s MA-5 discussion allows temporary credentials, for one use or a very limited time, for vendors who must work with little notice. The maintenance log holds the authorized list and records each escort.

• The System owner shall establish a process for authorizing maintenance personnel, in which the system owner approves each maintenance organization and each individual before they perform maintenance. (MA-5a)
• The System owner shall maintain a list of authorized maintenance organizations and personnel for the system, and review it at least quarterly. (MA-5a)
• Maintenance contracts shall require the provider to notify the organization within 24 hours when a person on the authorized list leaves the provider or no longer supports the organization, as for other external personnel (PS-7). (MA-5a)
• The System owner shall verify that non-escorted personnel performing maintenance on the system possess the required access authorizations before the work starts. (MA-5b)
• The System owner shall designate organizational personnel with the required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations. (MA-5c)
• The designated supervisor shall remain with the maintenance personnel, or supervise the session, for the whole activity, and shall be recorded as the escort in the maintenance records. (MA-5c)
• Where maintenance personnel not on the authorized list need access with little notice, the Account manager shall issue temporary credentials valid for one use or for the approved maintenance period only, and disable them when it ends. (MA-5)

Timely maintenance (MA-6)

Guidance

MA-6 makes sure a failed component can be fixed in time. NIST’s MA-6 discussion has the organization pick the components whose failure raises risk, and names having contracts in place as one way to obtain support. Take the components and time from the business impact analysis and the contingency plan, so the maintenance support and the recovery time objective agree (CP-2, CP-10). For cloud services, the provider’s service level agreement covers its components; record that in the external service review.

• The System owner shall obtain maintenance support or spare parts for Fill in: system components for which maintenance support and/or spare parts are obtained Typical: the components that support essential mission and business functions, as the business impact analysis identifies them, and the security components that protect them within Fill in: time period within which maintenance support and/or spare parts are to be obtained after a failure Typical: the recovery time objective set in the contingency plan from the business impact analysis of failure. (MA-6)
• The System owner shall keep maintenance contracts, with response and repair times that meet that time, or spare parts on hand, for each of those components, and record the contracts in the contingency plan’s vendor contact list. (MA-6)
• The System owner shall review the maintenance contracts and spare parts each time the contingency plan is reviewed, and before a contract expires. (MA-6)

Review and update

• The Fill in: an official to manage the maintenance policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency with which the current maintenance policy is reviewed and updated Typical: annually and following Fill in: events that would require the current maintenance policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (MA-1c.1)
• The Fill in: an official to manage the maintenance policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency with which the current maintenance procedures are reviewed and updated Typical: annually and following Fill in: events that would require the maintenance procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (MA-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (MA-1a.1(b))