Maintenance Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the MA control family policy (POL-MA). It covers every control in the maintenance family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the MA family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the low security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• PR.PS — Platform Security (Protect function)
• PR.IR — Technology Infrastructure Resilience (Protect function)
• RC.RP — Recovery Plan Execution (Recover function)

3. Controls Covered #

This procedure covers the following 4 controls in the MA family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the MA control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices

• The organization must implement lifecycle management for edge devices to ensure timely replacement before vendor support ends. Devices approaching end-of-support must be identified and prioritized for replacement. (CISA BOD 26-02, §2)

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the MA controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Maintenance family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The System Administrator / Maintenance Personnel carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The CISO oversees the procedure and receives its performance measures. See the MA policy (POL-MA) for the role definitions.

4.2 Control-Specific Procedures #

MA-01 — Policy and Procedures #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] maintenance policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the maintenance policy and procedures; and
3. Review and update the current maintenance:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Procedure:

The designated policy owner keeps the maintenance policy and this procedure as controlled documents with version history. Every 3 years, the policy owner opens a tracked review task. The policy owner gathers comments from the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and key stakeholders. The policy owner records the disposition of each comment and closes the review on the approving official’s signature before the revision publishes. The policy owner opens the same workflow out of cycle after a major change to applicable policy.

In each review, the policy owner checks the documents against current directives, including the Binding Operational Directive (BOD) 26-02 lifecycle expectations for edge devices, and against how maintenance staff actually perform the work. The procedure must describe what staff do. The policy owner resolves any gap between the documents and practice in the revision, or opens a corrective action ticket against practice.

The policy owner publishes approved versions, records the distribution to the named roles in the review record, and archives superseded versions instead of deleting them. Evidence: review records with dispositions and approvals, the version history, the corrective action tickets, and the distribution records.

MA-02 — Controlled Maintenance #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

1. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
2. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
3. Require that [Assignment: organization-defined personnel or roles — to be defined] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
4. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: organization-defined information — to be defined];
5. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
6. Include the following information in organizational maintenance records: [Assignment: organization-defined information — to be defined].

Procedure:

Maintenance runs on the ticketing system tickets from request to closure. Scheduled work follows manufacturer and vendor specifications and the Organization’s own requirements. The System Owner, ISSO, or designated representative approves each planned action before work begins, and gives unplanned repairs the same approval through an expedited step. An assigned escort or monitor observes the work as it happens.

For off-site repair or replacement, the ticket holds the explicit removal approval and the sanitization record that shows all information was removed from associated media before the equipment left the facility. Without the approval, the equipment does not leave.

After completion, the ISSO verifies the controls the action could have affected and records the result in the ticket before it closes. The closed record holds the start and end dates and times, the individuals or group who performed the maintenance, a description of the work, and the components removed or replaced with their identifiers. The ISSO reviews the accumulated records for completeness and for patterns such as repeat failures, recurring vendors, and components that fail often.

Evidence: approved tickets, removal approvals with sanitization records, post-maintenance control verifications, and the component maintenance histories.

MA-04 — Nonlocal Maintenance #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

1. Approve and monitor nonlocal maintenance and diagnostic activities;
2. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;
3. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;
4. Maintain records for nonlocal maintenance and diagnostic activities; and
5. Terminate session and network connections when nonlocal maintenance is completed.

Procedure:

Nonlocal maintenance starts with a ticketing system ticket, which the System Owner or ISSO approves before anyone establishes a connection. The ticket names the technician, the purpose, the components in scope, and the diagnostic tools, which must be the tools the system’s System Security and Privacy Plan (SSPP) documents. The technician establishes the session with strong multi-factor, replay-resistant authentication, and an assigned monitor observes the activity while it runs.

The session record captures who connected, the start and end times, the actions taken, and the components touched. At completion, the technician ends the session and closes the network connection. The monitor confirms the termination and records it in the ticket. The ISSO treats a connection that remains open after its work order closed as unauthorized access.

Evidence: approved session tickets with tool listings, authentication and session records, the monitor’s observations, and the termination confirmations.

MA-05 — Maintenance Personnel #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

1. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
2. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and
3. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Procedure:

The ISSO maintains the authorized maintenance list in the ticketing system: the organizations, the named individuals, and the basis for each authorization. The ISSO updates the list as contracts and staff change. Before non-escorted work starts, the ISSO or a designated representative verifies that the technician appears on the list and holds the access authorizations the work requires, and records the verification in the maintenance ticket.

When a technician lacks the required authorizations, the ISSO assigns in the ticket a designated supervisor who holds the access and the technical competence relevant to the work. The supervisor stays with the activity, and the record names the supervisor. Vendor personnel who arrive on short notice receive temporary credentials scoped to the work. The ISSO records on the ticket when these credentials are issued and revoked, so no access remains after the work ends.

Evidence: the authorization list with its change history, verification records, supervisor assignments, and the temporary credential issue and revocation records.

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Procedure execution records for MA
• Configuration documentation
• Periodic review records
• Evidence for IG FISMA metric CP.01
• Evidence for IG FISMA metric CP.02
• Evidence for IG FISMA metric CP.35

7. Performance Measurement #

The CISO measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the CISO trends and reports it. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices, February 5, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST Cybersecurity Framework 2.0, February 26, 2024.