Maintenance Decision Worksheet

Maintenance Decision Worksheet template: Every decision the Maintenance family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Maintenance family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every MA control in the baseline, with a typical value where the Maintenance Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV

Decisions (Moderate baseline)

20 decisions.

Decision	Control	Typical value	Who decides
Who approves maintenance on each system, and where are the maintenance records kept?	MA-2, MA-2(2)	The system owner approves scheduled maintenance through the change control process and each unscheduled repair before it starts; every activity is recorded in the maintenance log or the IT service management system, and the system owner reviews the records each quarter.	System owner
Who may perform nonlocal maintenance, and how do they connect?	MA-4, MA-4(3), MA-5	Only personnel and maintenance organizations on the authorized list, through the organization’s managed remote access service with multi-factor authentication, using a maintenance account that is enabled for each approved session and disabled when it ends; no always-on remote access tools installed by a vendor.	Chief Information Security Officer
How are maintenance personnel who lack the required access authorizations handled?	MA-5, MA-5(1)	They work only while escorted and supervised by a technically competent employee who has the required access authorizations, with temporary credentials for that visit or session that are disabled when it ends.	System owner
What may leave the facility for repair or replacement, and what must stay?	MA-2, MA-3(3)	Storage media stay; a failed drive is kept and sanitized or destroyed by the organization, under a media retention option in the maintenance contract where available. Other components leave only after sanitization and the system owner’s approval.	System owner
Which components need contracted maintenance support or spare parts, and how quickly must they be restored?	MA-6	The components that support essential mission and business functions, and the security components that protect them, with support contracts or spares on hand that restore them within the recovery time objective in the contingency plan.	System owner
Personnel or roles to whom the maintenance policy is to be disseminated	MA-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the maintenance procedures are to be disseminated	MA-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	MA-1	Organization-level	Chief Information Security Officer
An official to manage the maintenance policy and procedures	MA-1	Chief Information Security Officer	Chief Information Security Officer
The frequency with which the current maintenance policy is reviewed and updated	MA-1	Annually	Chief Information Security Officer
Events that would require the current maintenance policy to be reviewed and updated	MA-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency with which the current maintenance procedures are reviewed and updated	MA-1	Annually	Chief Information Security Officer
Events that would require the maintenance procedures to be reviewed and updated	MA-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
Personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs	MA-2	The system owner	Chief Information Security Officer
Information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement	MA-2	All organizational information, including personally identifiable information, credentials and cryptographic keys	Chief Information Security Officer
Information to be included in organizational maintenance records	MA-2	The date and time, the system and component, a description of the maintenance performed, the names and organization of the individuals performing it, the escort’s name, the components or equipment removed or replaced, the approval, and the result of the post-maintenance control check	Chief Information Security Officer
Frequency at which to review previously approved system maintenance tools	MA-3	At least annually	Chief Information Security Officer
Personnel or roles who can authorize removal of equipment from the facility	MA-3(3)	The Chief Information Security Officer	Chief Information Security Officer
System components for which maintenance support and/or spare parts are obtained	MA-6	The components that support essential mission and business functions, as the business impact analysis identifies them, and the security components that protect them	Chief Information Security Officer
Time period within which maintenance support and/or spare parts are to be obtained after a failure	MA-6	The recovery time objective set in the contingency plan from the business impact analysis	Chief Information Security Officer