Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance
📖 What This Means
This control requires organizations to implement safeguards for all tools, techniques, and personnel involved in system maintenance to prevent unauthorized access or tampering. It means you must track who performs maintenance, what tools they use, and how they access systems—ensuring only approved methods and trusted individuals are allowed. For example, if a vendor needs to patch a server, you should verify their identity, log their activities, and ensure they use only pre-approved software. Another example: remote maintenance sessions must use encrypted connections (like VPNs) and be monitored. The goal is to prevent malicious actors from exploiting maintenance activities as an entry point into your systems.
🎯 Why It Matters
Uncontrolled maintenance activities are a top attack vector for data breaches. A 2022 Ponemon study found that 56% of breaches involved privileged access abuse during maintenance. In one real incident, a defense contractor's HVAC vendor used unapproved remote access tools, leading to a ransomware infection that cost $4.2M in recovery. The DoD specifically requires this control because maintenance accounts often have elevated privileges—if compromised, they could expose Controlled Unclassified Information (CUI). CMMC treats this as a Level 2 requirement because improper maintenance controls directly enable lateral movement in networks.
✅ How to Implement
- 1. In AWS/Azure/GCP, create separate IAM roles for maintenance personnel with time-bound permissions (e.g., 4-hour JIT access).
- 2. Enable CloudTrail/Azure Activity Log/GCP Audit Logs to record all maintenance sessions.
- 3. Restrict maintenance tools to approved instances (e.g., only allow SSM Session Manager in AWS, block third-party RDP clients).
- 4. Implement Service Control Policies (SCPs) or Organization Policies to block unapproved regions/APIs during maintenance.
- 5. Require MFA for all maintenance sessions and document approvals in a ticketing system like ServiceNow or Jira.
📋 Evidence Examples
Approved Maintenance Tools List
Maintenance Session Logs
Vendor Maintenance Agreement
MFA Configuration Screenshot
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For MA.L2-3.7.2 ("Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how system maintenance is controlled, including scheduling, change management, tool approval, remote maintenance security, and personnel authorization. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"MA.L2-3.7.2 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to provide controls on the tools, techniques, mechanisms, and personnel used to con.... The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"MA.L2-3.7.2 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to provide controls on the tools, techniques, mechanisms, and personnel used to con.... Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"MA.L2-3.7.2 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify systems within the CUI boundary requiring maintenance
- • Document maintenance windows and change control process
- • Specify remote maintenance tools and access controls
- • Ensure this control covers all systems within your defined CUI boundary where provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Maintenance Policy
- 📄 Change management records
- 📄 Approved maintenance tool inventory
- 📄 Remote maintenance session logs
- 📄 Evidence artifacts specific to MA.L2-3.7.2
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will review maintenance records for proper approval workflow, verify remote maintenance uses MFA and is logged, and check that non-company maintenance personnel are supervised.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do you maintain an up-to-date inventory of all approved maintenance tools?
Question 2: Are all remote maintenance sessions recorded and reviewed?
Question 3: Do maintenance personnel use separate accounts with MFA?
Question 4: Is there a process to deprovision maintenance access after work completes?
Question 5: Can you produce logs showing a recent maintenance session with all required controls?
⚠️ Common Mistakes (What Auditors Flag)
1. Allowing vendors to use personal TeamViewer accounts
2. Shared maintenance accounts without MFA
3. No logging for local maintenance (USB drives, consoles)
4. Approved tools list hasn't been updated in 2+ years
5. Missing vendor escort documentation for CUI systems
📚 Parent Policy
This practice is governed by the Maintenance Policy