Maintenance Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for maintenance in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers maintenance of the Organization’s systems, whether local or remote and whether employees or vendors perform it. Maintenance is a privileged path into production systems, and the Organization controls it as one. The Organization must authorize and schedule all maintenance, supervise it where required, perform it with approved and inspected tools, and record it fully. Remote maintenance sessions must use strong authentication, and the Organization must end and review each session when the work is complete.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• PR.PS — Platform Security (Protect function)
• PR.IR — Technology Infrastructure Resilience (Protect function)
• RC.RP — Recovery Plan Execution (Recover function)

These categories fall under the Protect, Recover function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every maintenance control in the low baseline of FIPS 200 and NIST SP 800-53B:

• MA-01 — Policy and Procedures
• MA-02 — Controlled Maintenance
• MA-04 — Nonlocal Maintenance
• MA-05 — Maintenance Personnel

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices, February 5, 2026.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the MA control family. They add to the NIST SP 800-53 control requirements in the Policy section.

CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices

• The organization must implement lifecycle management for edge devices to ensure timely replacement before vendor support ends. Devices approaching end-of-support must be identified and prioritized for replacement. (CISA BOD 26-02, §2)

3. Policy #

The Organization must implement and maintain its maintenance controls to meet the following requirements:

MA-01 — Policy and Procedures #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] maintenance policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the maintenance policy and procedures; and
3. Review and update the current maintenance:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep an organization-level maintenance policy and the procedures that implement it. The designated policy owner is accountable for developing, documenting, and distributing both documents. The designated policy owner must distribute them to the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and key stakeholders. The designated policy owner must review and update both documents at least every 3 years and after a major change to applicable policy. The policy must include the lifecycle requirement in Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 26-02. Under it, the Organization identifies edge devices that approach the end of vendor support and prioritizes them for replacement before support lapses. A written procedure keeps the maintenance program working when experienced staff leave.

MA-02 — Controlled Maintenance #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

1. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
2. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
3. Require that [Assignment: organization-defined personnel or roles — to be defined] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
4. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: organization-defined information — to be defined];
5. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
6. Include the following information in organizational maintenance records: [Assignment: organization-defined information — to be defined].

Implementation guidance:

The Organization must schedule, document, and review maintenance, repair, and replacement of system components against manufacturer and vendor specifications and organizational requirements. The System Owner, ISSO, or a designated representative must approve all maintenance before it happens and monitor it while it happens. This applies to maintenance on site or remote, and to work in place or after removal to another location. The System Owner, ISSO, or a designated representative must explicitly approve any removal of equipment from organizational facilities for off-site repair or replacement. The System Owner must ensure that all information is sanitized from associated media before the equipment leaves. After the work, the ISSO must verify that every control the action could have affected still functions. The ISSO must treat a repair that disabled a control as a new incident. Maintenance records must capture the dates and times, who performed the work, what they did, and which components they removed or replaced.

MA-04 — Nonlocal Maintenance #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

1. Approve and monitor nonlocal maintenance and diagnostic activities;
2. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;
3. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;
4. Maintain records for nonlocal maintenance and diagnostic activities; and
5. Terminate session and network connections when nonlocal maintenance is completed.

Implementation guidance:

The System Owner or ISSO must approve nonlocal maintenance and diagnostic activity before the session is established and must monitor it while it runs. Nonlocal maintenance must use only the tools that organizational policy allows and the system’s System Security and Privacy Plan (SSPP) documents. Every session must start with strong authentication that is multi-factor and resistant to replay. The Organization must keep a record of every nonlocal session: who connected, when, what they did, and to which components. When the work is complete, the technician must end the session and close its network connections. A maintenance path left open between engagements is an unauthorized access route. System Owners and ISSOs own the approval and the monitoring for their systems.

MA-05 — Maintenance Personnel #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

1. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
2. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and
3. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Implementation guidance:

The Organization must run an authorization process for maintenance personnel. The ISSO must maintain the current list of authorized maintenance organizations and individuals. Before non-escorted maintenance begins, the ISSO or a designated representative must verify that the technician holds the access authorizations the work requires. A technician without those authorizations works only under the supervision of designated organizational personnel who hold the required authorizations and the technical competence to judge the work. Vendor personnel who arrive on short notice must use temporary credentials scoped to the job that expire when it ends. They must never use borrowed accounts.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of maintenance controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves maintenance through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Move remote maintenance to brokered, recorded, just-in-time sessions with automatic credential expiry.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices, February 5, 2026.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.