Maintenance Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for maintenance in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers maintenance of the Organization’s systems, whether local or remote and whether employees or vendors perform it. Maintenance is a privileged path into production systems, and the Organization controls it as one. The Organization must authorize and schedule all maintenance, supervise it where required, perform it with approved and inspected tools, and record it fully. Remote maintenance sessions must use strong authentication, and the Organization must end and review each session when the work is complete.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• PR.PS — Platform Security (Protect function)
• PR.IR — Technology Infrastructure Resilience (Protect function)
• RC.RP — Recovery Plan Execution (Recover function)

These categories fall under the Protect, Recover function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every maintenance control in the moderate baseline of FIPS 200 and NIST SP 800-53B:

• MA-01 — Policy and Procedures
• MA-02 — Controlled Maintenance
• MA-03 — Maintenance Tools
• MA-03(1) — Inspect Tools
• MA-03(2) — Inspect Media
• MA-03(3) — Prevent Unauthorized Removal
• MA-04 — Nonlocal Maintenance
• MA-05 — Maintenance Personnel
• MA-05(1) — Individuals Without Appropriate Access
• MA-06 — Timely Maintenance

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices, February 5, 2026.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the MA control family. They add to the NIST SP 800-53 control requirements in the Policy section.

CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices

• The organization must implement lifecycle management for edge devices to ensure timely replacement before vendor support ends. Devices approaching end-of-support must be identified and prioritized for replacement. (CISA BOD 26-02, §2)

3. Policy #

The Organization must implement and maintain its maintenance controls to meet the following requirements:

MA-01 — Policy and Procedures #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] maintenance policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the maintenance policy and procedures; and
3. Review and update the current maintenance:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep an organization-level maintenance policy and the procedures that implement it. The designated policy owner is accountable for developing, documenting, and distributing both documents. The designated policy owner must distribute them to the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and key stakeholders. The designated policy owner must review and update both documents at least every 3 years and after a major change to applicable policy. The policy must include the lifecycle requirement in Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 26-02. Under it, the Organization identifies edge devices that approach the end of vendor support and prioritizes them for replacement before support lapses. A written procedure keeps the maintenance program working when experienced staff leave.

MA-02 — Controlled Maintenance #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

1. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
2. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
3. Require that [Assignment: organization-defined personnel or roles — to be defined] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
4. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: organization-defined information — to be defined];
5. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
6. Include the following information in organizational maintenance records: [Assignment: organization-defined information — to be defined].

Implementation guidance:

The Organization must schedule, document, and review maintenance, repair, and replacement of system components against manufacturer and vendor specifications and organizational requirements. The System Owner, ISSO, or a designated representative must approve all maintenance before it happens and monitor it while it happens. This applies to maintenance on site or remote, and to work in place or after removal to another location. The System Owner, ISSO, or a designated representative must explicitly approve any removal of equipment from organizational facilities for off-site repair or replacement. The System Owner must ensure that all information is sanitized from associated media before the equipment leaves. After the work, the ISSO must verify that every control the action could have affected still functions. The ISSO must treat a repair that disabled a control as a new incident. Maintenance records must capture the dates and times, who performed the work, what they did, and which components they removed or replaced.

MA-03 — Maintenance Tools #

Baselines: Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

1. Approve, control, and monitor the use of system maintenance tools; and
2. Review previously approved system maintenance tools at least annually.

Implementation guidance:

The System Owner or ISSO must approve each maintenance tool before anyone uses it. Maintenance tools include the hardware, software, and firmware brought in for diagnostic and repair work. The Organization must control each tool while it is present and monitor it in use. The Organization must keep the approved-tool record current. The System Owner or ISSO must review each previously approved tool at least every year or at license renewal, whichever comes first. The System Owner or ISSO must withdraw approval from a tool that is outdated, unsupported, or no longer used. The ISSO must treat a tool connected to a system without approval as a security event.

MA-03(1) — Inspect Tools #

Baselines: Moderate / High

Requirement:

Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.

Implementation guidance:

The escort or the ISSO must inspect every tool that maintenance personnel bring for improper or unauthorized modification before anyone uses it. This applies whether the tool is carried in, shipped ahead, or downloaded for the job. When an inspection finds an altered tool or malicious code, the maintenance action stops. The ISSO preserves the tool for analysis and handles the finding through the incident process. The ISSO owns the inspection standard and the record it leaves.

MA-03(2) — Inspect Media #

Baselines: Moderate / High

Requirement:

Check media containing diagnostic and test programs for malicious code before the media are used in the system.

Implementation guidance:

The escort or the ISSO must check media that contain diagnostic or test programs for malicious code before anyone uses the media in any system. The check applies regardless of the source and regardless of how routine the vendor relationship is. Malicious code found on maintenance media is a security incident. The maintenance action halts, and the ISSO follows the incident procedures. Urgency does not create an exception: an emergency repair does not skip the check.

MA-03(3) — Prevent Unauthorized Removal #

Baselines: Moderate / High

Requirement:

Prevent the removal of maintenance equipment containing organizational information by: (a) Verifying that there is no organizational information contained on the equipment; (b) Sanitizing or destroying the equipment; (c) Retaining the equipment within the facility; or (d) Obtaining an exemption from the information owner explicitly authorizing removal of the equipment from the facility.

Implementation guidance:

Maintenance personnel must not remove maintenance equipment from organizational facilities while organizational information may remain on it. Before removal, one of three things must happen. The escort or the ISSO verifies that the equipment holds no organizational information, the equipment is sanitized, or the equipment stays in the facility. When none of those options works, removal requires an explicit exemption from the System Owner and the CISO. They accept the risk in writing.

MA-04 — Nonlocal Maintenance #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

1. Approve and monitor nonlocal maintenance and diagnostic activities;
2. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;
3. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;
4. Maintain records for nonlocal maintenance and diagnostic activities; and
5. Terminate session and network connections when nonlocal maintenance is completed.

Implementation guidance:

The System Owner or ISSO must approve nonlocal maintenance and diagnostic activity before the session is established and must monitor it while it runs. Nonlocal maintenance must use only the tools that organizational policy allows and the system’s System Security and Privacy Plan (SSPP) documents. Every session must start with strong authentication that is multi-factor and resistant to replay. The Organization must keep a record of every nonlocal session: who connected, when, what they did, and to which components. When the work is complete, the technician must end the session and close its network connections. A maintenance path left open between engagements is an unauthorized access route. System Owners and ISSOs own the approval and the monitoring for their systems.

MA-05 — Maintenance Personnel #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

1. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
2. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and
3. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Implementation guidance:

The Organization must run an authorization process for maintenance personnel. The ISSO must maintain the current list of authorized maintenance organizations and individuals. Before non-escorted maintenance begins, the ISSO or a designated representative must verify that the technician holds the access authorizations the work requires. A technician without those authorizations works only under the supervision of designated organizational personnel who hold the required authorizations and the technical competence to judge the work. Vendor personnel who arrive on short notice must use temporary credentials scoped to the job that expire when it ends. They must never use borrowed accounts.

MA-05(1) — Individuals Without Appropriate Access #

Baselines: Moderate / High

Requirement:

1. Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:

1. Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified; and
2. Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and

2. Develop and implement [Assignment: organization-defined alternate controls — to be defined] in the event a system component cannot be sanitized, removed, or disconnected from the system.

Implementation guidance:

Maintenance personnel who lack the needed clearances or access approvals, or who are not U.S. citizens, must work only under escort and supervision. The escort must be an approved member of the Organization’s staff. The escort must hold full clearance, the required access authorizations, and the technical qualifications to judge the work. Before such work begins, the escort must confirm that volatile storage in the system is sanitized. The escort must also confirm that nonvolatile media are removed or physically disconnected and secured. When sanitizing, removing, or disconnecting a component is not possible, the Organization’s alternate controls apply. The work must not start until they are in place.

MA-06 — Timely Maintenance #

Baselines: Moderate / High CSF 2.0: PR.PS (Platform Security), PR.IR (Technology Infrastructure Resilience), RC.RP (Recovery Plan Execution)

Requirement:

Obtain maintenance support and/or spare parts for [Assignment: organization-defined system components — to be defined] within a timeframe to support advertised uptime and availability of failure.

Implementation guidance:

For the key components that each System Security and Privacy Plan (SSPP) identifies, the Organization must arrange maintenance support and spare parts in advance. The Organization must execute contracts, identify sources, and know lead times. That way, support or parts arrive within the recovery time objectives (RTOs) in the system’s business impact analysis (BIA) and information technology contingency plan (ITCP). System Owners must keep support arrangements aligned to those RTOs as systems and vendors change. System Owners must treat a support gap on a key component as a risk that requires action, not as a procurement backlog item. Consistent with CISA BOD 26-02, System Owners must identify components that approach the end of vendor support and prioritize them for replacement before support lapses. A failed component with no path to repair becomes an availability incident.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of maintenance controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves maintenance through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Move remote maintenance to brokered, recorded, just-in-time sessions with automatic credential expiry.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices, February 5, 2026.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.