Maintenance Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the MA control family policy (POL-MA). It covers every control in the maintenance family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the MA family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the moderate security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• PR.PS — Platform Security (Protect function)
• PR.IR — Technology Infrastructure Resilience (Protect function)
• RC.RP — Recovery Plan Execution (Recover function)

3. Controls Covered #

This procedure covers the following 10 controls in the MA family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the MA control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices

• The organization must implement lifecycle management for edge devices to ensure timely replacement before vendor support ends. Devices approaching end-of-support must be identified and prioritized for replacement. (CISA BOD 26-02, §2)

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the MA controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Maintenance family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The System Administrator / Maintenance Personnel carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The CISO oversees the procedure and receives its performance measures. See the MA policy (POL-MA) for the role definitions.

4.2 Control-Specific Procedures #

MA-01 — Policy and Procedures #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] maintenance policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the maintenance policy and procedures; and
3. Review and update the current maintenance:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Procedure:

The designated policy owner keeps the maintenance policy and this procedure as controlled documents with version history. Every 3 years, the policy owner opens a tracked review task. The policy owner gathers comments from the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and key stakeholders. The policy owner records the disposition of each comment and closes the review on the approving official’s signature before the revision publishes. The policy owner opens the same workflow out of cycle after a major change to applicable policy.

In each review, the policy owner checks the documents against current directives, including the Binding Operational Directive (BOD) 26-02 lifecycle expectations for edge devices, and against how maintenance staff actually perform the work. The procedure must describe what staff do. The policy owner resolves any gap between the documents and practice in the revision, or opens a corrective action ticket against practice.

The policy owner publishes approved versions, records the distribution to the named roles in the review record, and archives superseded versions instead of deleting them. Evidence: review records with dispositions and approvals, the version history, the corrective action tickets, and the distribution records.

MA-02 — Controlled Maintenance #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

1. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
2. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
3. Require that [Assignment: organization-defined personnel or roles — to be defined] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
4. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: organization-defined information — to be defined];
5. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
6. Include the following information in organizational maintenance records: [Assignment: organization-defined information — to be defined].

Procedure:

Maintenance runs on the ticketing system tickets from request to closure. Scheduled work follows manufacturer and vendor specifications and the Organization’s own requirements. The System Owner, ISSO, or designated representative approves each planned action before work begins, and gives unplanned repairs the same approval through an expedited step. An assigned escort or monitor observes the work as it happens.

For off-site repair or replacement, the ticket holds the explicit removal approval and the sanitization record that shows all information was removed from associated media before the equipment left the facility. Without the approval, the equipment does not leave.

After completion, the ISSO verifies the controls the action could have affected and records the result in the ticket before it closes. The closed record holds the start and end dates and times, the individuals or group who performed the maintenance, a description of the work, and the components removed or replaced with their identifiers. The ISSO reviews the accumulated records for completeness and for patterns such as repeat failures, recurring vendors, and components that fail often.

Evidence: approved tickets, removal approvals with sanitization records, post-maintenance control verifications, and the component maintenance histories.

MA-03 — Maintenance Tools #

Baselines: Moderate / High CSF 2.0: PR.PS (Platform Security)

1. Approve, control, and monitor the use of system maintenance tools; and
2. Review previously approved system maintenance tools at least annually.

Procedure:

The ticketing system holds the approved-tool list. Each entry names the tool, its purpose, its approver, and its next review date. A request to use a new tool goes to the System Owner or ISSO for approval before the tool touches any system. Outside maintenance personnel must present their tools at intake for a check against the list. An unlisted tool does not enter until the System Owner or ISSO approves it, or the Organization refuses it.

The maintenance ticket lists the tools used for each action, so anyone can reconstruct a tool’s history from the record. In the review, at least every year or at license renewal, the System Owner or ISSO re-confirms each entry. The System Owner or ISSO withdraws tools that are outdated, unsupported, or idle, removes them from the list, takes them out of circulation, and records the disposition.

Evidence: the approved-tool list with its review history, the approval requests, tool-use entries in maintenance tickets, and the withdrawal dispositions.

MA-03(1) — Inspect Tools #

Baselines: Moderate / High

Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.

Procedure:

At intake, the escort or the ISSO inspects each maintenance tool against its expected state before it goes near a system. The inspection covers the integrity of software, the physical condition of hardware, and the provenance of anything downloaded. The escort or the ISSO records the result in the maintenance ticket. When the inspection shows improper or unauthorized modification, the escort or the ISSO quarantines the tool at once, the maintenance action stops, and the ISSO starts the incident process. The ISSO preserves the tool as evidence and does not return it. Evidence: inspection results in the maintenance tickets and the incident records for every failed inspection.

MA-03(2) — Inspect Media #

Baselines: Moderate / High

Check media containing diagnostic and test programs for malicious code before the media are used in the system.

Procedure:

Before any media that carry diagnostic or test programs connect to a system, the escort or the ISSO runs the malicious code check and records the result in the maintenance ticket. Clean media proceed. When the check flags media, the work stops: the escort or the ISSO quarantines the media, starts the incident process, and cross-references the incident record in the ticket. The check applies equally to vendor-shipped media, media that technicians carry in, and downloads staged for the maintenance action. Evidence: the recorded check results in maintenance tickets and the incident records where media failed the check.

MA-03(3) — Prevent Unauthorized Removal #

Baselines: Moderate / High

Prevent the removal of maintenance equipment containing organizational information by: (a) Verifying that there is no organizational information contained on the equipment; (b) Sanitizing or destroying the equipment; (c) Retaining the equipment within the facility; or (d) Obtaining an exemption from the information owner explicitly authorizing removal of the equipment from the facility.

Procedure:

Before maintenance equipment leaves the facility, the escort or the ISSO decides how it may leave and records the decision in the maintenance ticket. The decision states one of three outcomes: verified free of organizational information, sanitized with the method noted, or retained on site. Sometimes a vendor requires the equipment back and none of those options works, for example a failed component that cannot be sanitized or a leased diagnostic unit. In that case, the exemption request goes to the System Owner and the CISO, and the equipment leaves only on their recorded joint approval. Evidence: the exit decisions in maintenance tickets and the signed exemption records.

MA-04 — Nonlocal Maintenance #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

1. Approve and monitor nonlocal maintenance and diagnostic activities;
2. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;
3. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;
4. Maintain records for nonlocal maintenance and diagnostic activities; and
5. Terminate session and network connections when nonlocal maintenance is completed.

Procedure:

Nonlocal maintenance starts with a ticketing system ticket, which the System Owner or ISSO approves before anyone establishes a connection. The ticket names the technician, the purpose, the components in scope, and the diagnostic tools, which must be the tools the system’s System Security and Privacy Plan (SSPP) documents. The technician establishes the session with strong multi-factor, replay-resistant authentication, and an assigned monitor observes the activity while it runs.

The session record captures who connected, the start and end times, the actions taken, and the components touched. At completion, the technician ends the session and closes the network connection. The monitor confirms the termination and records it in the ticket. The ISSO treats a connection that remains open after its work order closed as unauthorized access.

Evidence: approved session tickets with tool listings, authentication and session records, the monitor’s observations, and the termination confirmations.

MA-05 — Maintenance Personnel #

Baselines: Low / Moderate / High CSF 2.0: PR.PS (Platform Security)

1. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
2. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and
3. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Procedure:

The ISSO maintains the authorized maintenance list in the ticketing system: the organizations, the named individuals, and the basis for each authorization. The ISSO updates the list as contracts and staff change. Before non-escorted work starts, the ISSO or a designated representative verifies that the technician appears on the list and holds the access authorizations the work requires, and records the verification in the maintenance ticket.

When a technician lacks the required authorizations, the ISSO assigns in the ticket a designated supervisor who holds the access and the technical competence relevant to the work. The supervisor stays with the activity, and the record names the supervisor. Vendor personnel who arrive on short notice receive temporary credentials scoped to the work. The ISSO records on the ticket when these credentials are issued and revoked, so no access remains after the work ends.

Evidence: the authorization list with its change history, verification records, supervisor assignments, and the temporary credential issue and revocation records.

MA-05(1) — Individuals Without Appropriate Access #

Baselines: Moderate / High

1. Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:

1. Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified; and
2. Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and

2. Develop and implement [Assignment: organization-defined alternate controls — to be defined] in the event a system component cannot be sanitized, removed, or disconnected from the system.

Procedure:

When a work order involves personnel without the needed clearances, access approvals, or citizenship, the ticketing system ticket flags the condition and names the escort. The escort is a staff member with full clearance, the required authorizations, and technical qualifications, who stays with the activity from start to finish. Preparation comes before access: volatile storage is sanitized, and nonvolatile media are removed or physically disconnected and secured. The escort records each preparation step in the ticket before the technician reaches the system. If a component does not allow that preparation, the Organization applies and documents its alternate controls before work proceeds. Without them, the work does not proceed. Evidence: flagged tickets with escort assignments, the recorded preparation steps, and the documented alternate-control applications.

MA-06 — Timely Maintenance #

Baselines: Moderate / High CSF 2.0: PR.PS (Platform Security), PR.IR (Technology Infrastructure Resilience), RC.RP (Recovery Plan Execution)

Obtain maintenance support and/or spare parts for [Assignment: organization-defined system components — to be defined] within a timeframe to support advertised uptime and availability of failure.

Procedure:

Each System Owner maintains a mapping from the SSPP’s key-component list to its support arrangements. For each component, the mapping records the maintenance contract or parts source. It also records the recovery time objective (RTO) from the business impact analysis (BIA) and information technology contingency plan (ITCP) that the arrangement must satisfy. The System Owner revisits the mapping when contracts renew, when the key-component list changes, and when a vendor’s support changes.

When a key component fails, the ticketing system ticket records the failure time and the start of the support engagement against the RTO. If the response threatens to exceed the RTO, the escalation goes to the System Owner and ISSO. They start the contingency arrangements the ITCP provides instead of waiting for the vendor. Under BOD 26-02, the System Owner flags components that near the end of vendor support in the mapping. The System Owner prioritizes their replacement before support expires.

Evidence: the component-to-support mapping with its revision history, failure tickets that show response times against the RTO, escalation records, and the end-of-support replacement plans.

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Procedure execution records for MA
• Configuration documentation
• Periodic review records
• Evidence for IG FISMA metric CP.01
• Evidence for IG FISMA metric CP.02
• Evidence for IG FISMA metric CP.35

7. Performance Measurement #

The CISO measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the CISO trends and reports it. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices, February 5, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST Cybersecurity Framework 2.0, February 26, 2024.