Skip to content
ControlVerdict
Sign in
MA.L2-3.7.6CMMC Level 2Level 2

Maintenance Personnel

Submit your own example

Practice statement

Supervise the maintenance activities of maintenance personnel without required access authorization.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.7.6.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(1)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    maintenance personnel without required access authorization are supervised during maintenance activities.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    MA.L2-3.7.6Maintenance Personnel
    Supervise the maintenance activities of maintenance personnel without required access authorization.

    • [a]

      maintenance personnel without required access authorization are supervised during maintenance activities.

    Uncleared technicians are badge-escorted and screen-watched for the entire visit

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses the Maintenance Personnel objective: maintenance personnel without required access authorization are supervised during maintenance activities.

    Who needs an escort. The authorized maintenance personnel list marks each individual as authorized or not for the areas and systems in question. Anyone not on that list as authorized — including long-familiar contractors we have worked with for years, which is the case where discipline usually slips — is escorted. Facilities staff who only need the mechanical room and never the server room are handled by area rather than by exception.

    Escort qualification. An escort is a designated employee who is technically able to recognize what the technician is doing, not simply the nearest available body. For work inside the server room the escort is from IT; for electrical and HVAC work the escort is facilities with IT present if the work touches racks, power to racks, or cooling for racks.

    During the visit. The escort remains physically present for the entire visit, including breaks and trips to the vehicle. The technician's work is observed directly — screen included when a laptop or console is involved. The escort has explicit authority to stop work, and the visit brief tells the technician that up front so stopping is not treated as an accusation.

    Preparation before entry. Where practical, CUI is removed from the immediate work area before the technician arrives: screens locked, printed material cleared, and the specific system placed in a state that exposes nothing. Sessions on nearby workstations are logged out rather than locked when the work will be lengthy.

    Record. The escort log records the technician, the sponsoring vendor, the work performed, the escort's name, and entry and exit times, and is cross-checked against badge reads and camera coverage of the server room door.

    Maintenance. Quarterly reconciliation of escort logs against badge records to find unescorted entries; annual refresher for the escort pool on what to watch for and when to stop work.

    Accepted gap. Overnight janitorial service cannot be escorted for the whole shift within our budget. Instead, cleaning access excludes the server room and the engineering area entirely — those doors are on a separate badge group cleaned during business hours under escort — and the general office areas are covered by clean-desk enforcement and camera coverage.

    What the evidence looks like

    • Authorized maintenance personnel list with authorization status by area and system
    • Escort procedure including escort qualification and stop-work authority
    • Escort logs for recent visits with entry and exit times
    • Badge group configuration excluding cleaning staff from the server and engineering areas
    • Quarterly reconciliation of escort logs against badge reads

    Environment

    Two-building campus. Janitorial, HVAC, electrical, and copier technicians all enter the room that holds the enclave file server and network core; none of them are authorized for CUI access.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.