Supervise the maintenance activities of personnel without required access authorization
📖 What This Means
This practice requires organizations to ensure that any maintenance activities performed by personnel who do not have the necessary access authorization are supervised. This means that if an external vendor or contractor is working on your systems, they must be closely monitored by someone who is authorized to access those systems. The goal is to prevent unauthorized access or modifications to sensitive systems that could lead to data breaches or other security incidents. For example, if a contractor is brought in to repair a server, an authorized employee should oversee the entire process to ensure that the contractor does not access or alter any data they are not supposed to.
🎯 Why It Matters
Supervising maintenance activities by unauthorized personnel is critical because it mitigates the risk of insider threats and accidental security breaches. Without proper supervision, unauthorized personnel could intentionally or unintentionally access or modify sensitive data, install malicious software, or exploit vulnerabilities in the system. A real-world example is the 2017 breach at Equifax, where attackers exploited a vulnerability in a web application that was not properly maintained. The DoD and CMMC emphasize this control to ensure that maintenance activities do not introduce vulnerabilities or compromise the integrity of systems handling Controlled Unclassified Information (CUI). The potential impact of not supervising maintenance activities includes data loss, financial penalties, and damage to the organization's reputation.
✅ How to Implement
- Identify all cloud maintenance activities that require supervision.
- Assign authorized personnel to oversee any maintenance performed by third-party vendors.
- Use cloud provider tools (e.g., AWS CloudTrail, Azure Monitor) to log and monitor maintenance activities.
- Implement role-based access control (RBAC) to limit access to sensitive cloud resources.
- Regularly review logs to ensure supervision protocols are followed.
📋 Evidence Examples
Maintenance Supervision Policy
Maintenance Logs
Training Records
Audit Reports
Access Control Lists
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For MA.L2-3.7.6 ("Supervise the maintenance activities of personnel without required access authorization"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how system maintenance is controlled, including scheduling, change management, tool approval, remote maintenance security, and personnel authorization. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"MA.L2-3.7.6 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to supervise the maintenance activities of personnel without required access author.... The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"MA.L2-3.7.6 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to supervise the maintenance activities of personnel without required access author.... Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"MA.L2-3.7.6 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify systems within the CUI boundary requiring maintenance
- • Document maintenance windows and change control process
- • Specify remote maintenance tools and access controls
- • Ensure this control covers all systems within your defined CUI boundary where supervise the maintenance activities of personnel without required access authorization applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Maintenance Policy
- 📄 Change management records
- 📄 Approved maintenance tool inventory
- 📄 Remote maintenance session logs
- 📄 Evidence artifacts specific to MA.L2-3.7.6
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will review maintenance records for proper approval workflow, verify remote maintenance uses MFA and is logged, and check that non-company maintenance personnel are supervised.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do you have a policy in place for supervising maintenance activities by unauthorized personnel?
Question 2: Are logs maintained for all maintenance activities, including supervisor details?
Question 3: Are authorized personnel trained to supervise maintenance activities?
Question 4: Are periodic audits conducted to ensure compliance with supervision protocols?
Question 5: Is access to sensitive systems restricted to authorized personnel only?
⚠️ Common Mistakes (What Auditors Flag)
1. Failing to maintain logs of maintenance activities.
2. Not assigning an authorized supervisor to oversee maintenance tasks.
3. Inadequate training for authorized supervisors.
4. Lack of periodic audits to verify compliance.
5. Not restricting physical access to sensitive systems.
📚 Parent Policy
This practice is governed by the Maintenance Policy