AO coverage. Addresses the Perform Maintenance objective: system maintenance is performed on organizational systems.

Driven by inventory. Every asset in the inventory carries a maintenance profile: firmware and OS patch cadence, hardware service interval, warranty or support contract end date, and the responsible owner. Assets without a profile fail the monthly inventory reconciliation, which is how we found two switches nobody had updated in four years.

Scheduled maintenance. Endpoints and servers patch on a monthly cycle with a defined window; network and security appliances follow a quarterly firmware review that either applies the update or records why it was deferred. Physical work — filter changes on the closet cooling unit, battery replacement on the UPS, cable audits — is on the same calendar because a dead UPS takes the enclave down just as effectively as an unpatched server.

Corrective maintenance. Failures open a ticket that records the fault, the action, the parts, who performed it, and whether the system holds CUI. If it does, the ticket routes through the off-site sanitization and supervision procedures before anything leaves the room or a vendor touches it.

Records. Every maintenance event, scheduled or corrective, leaves a ticket. The ticket is the maintenance record: date, system, work performed, performer, and approval. There is no separate logbook to fall out of sync.

Maintenance of the process. Monthly reconciliation of inventory against maintenance profiles; annual review of support contract coverage against the asset list so end-of-support hardware is identified before it is unsupported rather than after.

Accepted gap. Two pieces of lab test equipment run vendor-controlled embedded software that we cannot patch on our cadence; the vendor releases updates roughly annually. They are on an isolated segment with no CUI at rest, and their profile records the vendor cadence rather than pretending to ours.

• Asset inventory export showing maintenance profile fields populated
• Maintenance calendar for the current year with completed and scheduled entries
• Sample scheduled and corrective maintenance tickets with performer and approval
• Monthly inventory reconciliation output
• Support contract coverage review with end-of-support flags