MA-2 MA · Maintenance

Controlled Maintenance

✓ LOW ✓ MODERATE ✓ HIGH
1 Enhancement 1 Overlay 12 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Discussion (NIST Supplemental Guidance)

Controlling system maintenance addresses the information security aspects of the system maintenance program and applies to all types of maintenance to system components conducted by local or nonlocal entities. Maintenance includes peripherals such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes the date and time of maintenance, a description of the maintenance performed, names of the individuals or group performing the maintenance, name of the escort, and system components or equipment that are removed or replaced. Organizations consider supply chain-related risks associated with replacement components for systems.

Enhancements NIST SOURCE

MA-2(1) Record Content WITHDRAWN

Withdrawn. Incorporated into MA-2.

MA-2(2) Automated Maintenance Activities LOW MODERATE ✓ HIGH
  1. (a) Schedule, conduct, and document maintenance, repair, and replacement actions for the system using [organization-defined automated mechanisms] ; and
  2. (b) Produce up-to date, accurate, and complete records of all maintenance, repair, and replacement actions requested, scheduled, in process, and completed.
Discussion

The use of automated mechanisms to manage and control system maintenance programs and activities helps to ensure the generation of timely, accurate, complete, and consistent maintenance records.

Open full page for MA-2(2) →

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for MA-2 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs is/are defined;
  2. information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement is defined;
  3. information to be included in organizational maintenance records is defined;
  4. maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements;
  5. maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements;
  6. records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements;
  7. all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved;
  8. all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored;
  9. <MA-02_ODP[01] personnel or roles> is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
  10. equipment is sanitized to remove <MA-02_ODP[02] information> from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement;
  11. all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair, or replacement actions;
  12. <MA-02_ODP[03] information> is included in organizational maintenance records.

Examine

[SELECT FROM: Maintenance policy; procedures addressing controlled system maintenance; maintenance records; manufacturer/vendor maintenance specifications; equipment sanitization records; media sanitization records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system maintenance responsibilities; organizational personnel with information security responsibilities; organizational personnel responsible for media sanitization; system/network administrators].

Test

[SELECT FROM: Organizational processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for the system; organizational processes for sanitizing system components; mechanisms supporting and/or implementing controlled maintenance; mechanisms implementing the sanitization of system components].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

  • Base control: Included (matches standard baseline)

MODERATE

  • Base control: Included (matches standard baseline)

HIGH

  • Base control: Included (matches standard baseline)
  • Included: (2)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for MA-2. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • Maintenance policy
  • system security plan

Testing

  • Organizational processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for the system
  • organizational processes for sanitizing system components
  • mechanisms supporting and/or implementing controlled maintenance
  • mechanisms implementing the sanitization of system components

Other Records

  • procedures addressing controlled system maintenance
  • maintenance records
  • manufacturer/vendor maintenance specifications
  • equipment sanitization records
  • media sanitization records
  • other relevant documents or records