System Maintenance Control

Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.7.2.Source

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

1. [a]

   tools used to conduct system maintenance are controlled;

   1 example covers this

2. [b]

   techniques used to conduct system maintenance are controlled;

   1 example covers this

3. [c]

   mechanisms used to conduct system maintenance are controlled; and

   1 example covers this

4. [d]

   personnel used to conduct system maintenance are controlled.

   1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

• addresses[a][b][c][d]

  MA.L2-3.7.2 · System Maintenance Control

  Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

  • [a]

    tools used to conduct system maintenance are controlled;

  • [b]

    techniques used to conduct system maintenance are controlled;

  • [c]

    mechanisms used to conduct system maintenance are controlled; and

  • [d]

    personnel used to conduct system maintenance are controlled.

  Approved tool register, no personal laptops on the plant floor, escorted OEM techs

  CCControlVerdict Corpus@cv-corpusOSCJul 31, 2026

  Community is just starting — add yours. No verdicts yet.

  Implementation

  AO coverage. Addresses all System Maintenance Control objectives — controls over the tools, techniques, mechanisms, and personnel used to conduct maintenance.

  Tools. A register lists the maintenance and diagnostic tools approved for use on in-scope systems: the remote management agent, the imaging tool, the packet capture utility, and the two vendor diagnostic suites. Approval requires a security review, and installation is limited to managed technician workstations. Personal or vendor-owned laptops are not permitted to connect to any in-scope system — vendors either use a loaner managed laptop we provide or work through a screen-shared session on our hardware. Tools that arrive on media go through the media inspection procedure before use.

  Techniques. Documented procedures cover how maintenance is done, not just that it is approved: work happens in the change window, privileged access is obtained just-in-time rather than standing, configuration is backed up before change, and the technician follows a written back-out plan. Techniques that would weaken a control — disabling endpoint protection, opening a temporary firewall rule, connecting a system directly to the internet for an update — require explicit approval, a time limit, and verification that the change was reverted.

  Mechanisms. On-site maintenance connections land on a dedicated maintenance VLAN with no route to the CUI enclave and an explicit allow-list to the specific device under service. Remote mechanisms are covered by the nonlocal maintenance pattern. Diagnostic ports on controllers are physically capped and the caps are checked during the quarterly walk.

  Personnel. Maintenance personnel are authorized in the register by name and organization, with the systems they may service and whether they hold enclave access authorization. Those without authorization are escorted under the maintenance personnel supervision procedure. Vendor personnel changes require the vendor to notify us before the visit; unnamed substitutes are turned away or escorted as unauthorized.

  Maintenance. Register reviewed quarterly; tool approvals re-reviewed annually or on a major version change. Post-visit, the escort confirms the device is back in its baseline state and no tooling was left behind.

  Accepted gap. One CNC controller vendor requires their own proprietary dongle and laptop to perform a specific calibration. That work is done with the controller physically disconnected from the network, under continuous escort, and with a post-service verification of the controller configuration against the recorded baseline.

  What the evidence looks like

  • Approved maintenance tool register with review dates and approval records
  • Maintenance procedure document covering change windows, backups, and back-out
  • Network configuration showing the maintenance VLAN and its allow-list
  • Authorized maintenance personnel list with systems and authorization status
  • Escort log and post-service verification for a recent OEM visit

  Environment

  Contract manufacturer, ~250 staff. OEM field engineers service CNC controllers and the building management system several times a year and habitually arrive with their own laptops and USB drives.

  Tools

  • CMDB
  • Ivanti
  • Visitor management

  Edit history

  · No edits yet