Maintenance Policy
Maintenance Domain (MA)
📖 What This Policy Covers
Maintenance ensures your systems stay operational and secure while protecting CUI during the maintenance process itself. This policy covers maintenance scheduling and windows, controlled maintenance procedures (backup, approve, execute, verify), approved maintenance tools (only vetted, company-approved tools), non-local/remote maintenance (MFA, session recording, monitoring), maintenance personnel authorization (background checks, escorts for non-company), and maintenance records and documentation.
Purpose
This policy ensures system maintenance is performed on schedule with proper controls, CUI is protected during maintenance activities, only approved tools are used for maintenance, remote/non-local maintenance is secured and monitored, maintenance personnel are authorized and supervised, and all maintenance activities are documented.
Scope
Applies to all maintenance activities on systems processing or storing CUI, including scheduled maintenance, emergency patches, remote support sessions, vendor maintenance, and hardware repair.
🎯 Why It Matters
Maintenance activities are a high-risk window -- systems may be in a vulnerable state, vendor access may be required, and CUI could be exposed during equipment repair. An uncontrolled maintenance session could introduce malware, expose CUI to unauthorized personnel, or leave systems misconfigured. Assessors check that maintenance follows change control and that remote sessions are authenticated with MFA and logged.
🔐 Key Requirements
1. Maintenance Scheduling
Scheduled and emergency maintenance with proper notification.
- ✓ Scheduled maintenance during approved windows (e.g., Sundays 2-6 AM)
- ✓ Emergency maintenance (critical patches) with CISO approval outside windows
- ✓ 72-hour advance notification to users
- ✓ All maintenance follows Change Management Policy
2. Controlled Maintenance
Structured process for safe maintenance execution.
- ✓ Before: backup, review procedure, obtain change ticket approval, prepare rollback plan
- ✓ During: follow documented procedure, log all actions, monitor for issues
- ✓ After: test functionality, verify CUI integrity, update documentation, close ticket
- ✓ CUI protection: sanitize before sending equipment for repair, escort non-cleared personnel, monitor remote sessions
3. Approved Maintenance Tools
Only approved, vetted tools for maintenance activities.
- ✓ Diagnostic tools approved by IT Security (scanned for malware)
- ✓ Remote access tools: company-approved only (TeamViewer, LogMeIn with MFA)
- ✓ USB drives: company-issued encrypted only
- ✓ Tool inventory maintained by IT, updated annually
- ✓ Personal USB drives, unauthorized software, untrusted scripts prohibited
4. Non-Local/Remote Maintenance
Controls for remote maintenance sessions.
- ✓ MFA authentication required
- ✓ Session recording (logs + video if available)
- ✓ Approval: submit request with justification, manager + IT Security approval
- ✓ Real-time monitoring by IT Security for sensitive systems
- ✓ Session terminated after task completion or if suspicious activity detected
- ✓ Encrypted channels only (VPN, RDP over TLS)
- ✓ Vendor access: temporary accounts, deactivated after maintenance, logs reviewed, NDA required
5. Maintenance Personnel
Authorization and supervision of maintenance personnel.
- ✓ Company employees: background checks per PS Policy
- ✓ Contractors: background checks + NDA + escorted by company personnel
- ✓ Vendors: equipment sanitized before shipping, or access via monitored remote session
- ✓ Authorized personnel list maintained by IT, updated quarterly
6. Maintenance Records
Documentation of all maintenance activities.
- ✓ Maintenance schedule (what, when, who)
- ✓ Change tickets for all maintenance
- ✓ Maintenance logs (actions performed, results)
- ✓ Equipment inventory (assets serviced, dates, technicians)
- ✓ 3-year retention
- ✓ Quarterly review by IT Security for anomalies
👥 Roles & Responsibilities
CISO / IT Director
- • Approve emergency maintenance outside scheduled windows
- • Review maintenance logs quarterly
- • Approve maintenance tool inventory
- • Authorize vendor access to CUI systems
IT Operations
- • Schedule and perform maintenance
- • Maintain approved tool inventory
- • Document all maintenance activities
- • Escort non-company maintenance personnel
IT Security
- • Monitor remote maintenance sessions
- • Review maintenance logs for anomalies
- • Approve maintenance tools (malware scan)
- • Verify CUI protection during maintenance
Vendors / Contractors
- • Follow company maintenance procedures
- • Use only approved tools
- • Sign NDAs before accessing CUI systems
- • Report any CUI exposure during maintenance
🛠️ Implementation Roadmap (4 Weeks)
Procedures & Windows
Weeks 1-2- → Define maintenance windows
- → Create maintenance procedure templates
- → Establish change management workflow for maintenance
- → Create approved tool inventory
Remote & Vendor Controls
Weeks 3-4- → Configure remote maintenance controls (MFA, session recording)
- → Create vendor access procedures and NDA templates
- → Deploy maintenance logging and documentation
- → Train IT staff on new procedures
- → Test remote maintenance workflow end-to-end
Recommended Tools
📊 CMMC Practice Mapping
| Practice ID | Requirement | Policy Section |
|---|---|---|
| MA.L2-3.7.1 | Perform maintenance timely | 1 |
| MA.L2-3.7.2 | Control maintenance activities | 2, 4 |
| MA.L2-3.7.3 | Require MFA for nonlocal maintenance | 4 |
| MA.L2-3.7.4 | Maintain equipment securely | 2, 6 |
| MA.L2-3.7.5 | Approve maintenance tools | 3, 5 |
| MA.L2-3.7.6 | Supervise non-Company maintenance | 5, 6 |
📋 Evidence Requirements
These are the artifacts a C3PAO assessor will ask for. Start collecting early.
Maintenance Schedule
Sample Change Tickets
Maintenance Tool Inventory
Remote Maintenance Logs
Vendor NDAs
⚠️ Common Gaps (What Assessors Flag)
1. Maintenance performed without change tickets
2. Vendor remote access unmonitored
3. No maintenance tool inventory
📝 Template Customization Guide
When filling in the downloadable template for this policy, replace these placeholders with your organization's specifics:
[COMPANY NAME] Your organization's legal name
Example: Acme Defense Systems, LLC
[CISO Name] Name of your CISO or IT Director
Example: Jane Smith
Customization Tips
- 💡 Specify your actual maintenance windows (day/time)
- 💡 List your approved remote access tools by name
- 💡 Include your vendor management process and NDA template reference
- 💡 If you outsource IT, document how the managed service provider follows these requirements