NIST SP 800-53 MA Maintenance: Key Controls, Enhancements and How to Evidence Them

Maintenance is privileged access by another name: engineers, vendors and tools that service a system can change it, read its data and leave with its storage. This guide works through the Maintenance (MA) family of NIST SP 800-53 Rev. 5 control by control: what each key control and enhancement requires, which baselines select it, which organisation-defined parameters you must set, and what evidence an assessor will ask for. It is written for system owners, infrastructure and OT engineers, PAM owners, security plan authors and assessors. The focus is the part of MA that most often goes wrong: nonlocal maintenance by suppliers and the tools and accounts they use. For the catalogue as a whole, see the NIST SP 800-53 Guide.

Key takeaways

• MA-1, MA-2, MA-4 and MA-5 apply at Low. Moderate adds MA-3 Maintenance Tools with three enhancements and MA-6 Timely Maintenance. High adds automated maintenance records, comparable security for remote maintenance and rules for maintenance staff without the required access.
• MA-4 is a remote access control. Nonlocal maintenance must be approved and monitored, allowed only as documented in the security plan, established with strong authentication, recorded, and terminated when finished. That is the same set of controls you would apply to any privileged remote session.
• Sanitise before equipment leaves. MA-2d requires sanitising information you define from media before components go off site for repair, and MA-3(3) at Moderate and High prevents unauthorised removal of maintenance equipment containing organisational information.
• Check controls after maintenance. MA-2e requires checking all potentially impacted controls after maintenance, repair or replacement. Re-enabled default accounts and disabled logging after a firmware update are classic MA-2e findings.
• Maintenance accounts are non-human identities too. Vendor support accounts, RMM agents and diagnostic service accounts hold standing privilege unless you make them time-bound. Inventory and own them.

The MA family at a glance

The table lists every MA base control with its baseline allocation, taken from NIST's OSCAL Release 5.2.0 catalogue and baseline profiles (L = Low, M = Moderate, H = High). MA has no controls in the privacy baseline.

For selection and tailoring method, see the NIST SP 800-53B Control Baselines and Tailoring Guide.

MA-1 and MA-2: policy and controlled maintenance

MA-1 follows the standard pattern: a maintenance policy at the level you select, procedures, a designated official, and review at a frequency and after events you define. MA-2 carries the substance in six parts.

• MA-2a: schedule, document and review records of maintenance, repair and replacement in line with manufacturer or vendor specifications and your own requirements.
• MA-2b: approve and monitor all maintenance, on site or remote, and whether the component is serviced in place or removed.
• MA-2c: named roles explicitly approve removal of the system or components for off-site maintenance, repair or replacement.
• MA-2d: sanitise information you define from associated media before removal.
• MA-2e: check all potentially impacted controls after maintenance, repair or replacement.
• MA-2f: include information you define in maintenance records.

For MA-2f, a useful record holds date and time, component, who performed the work and for which organisation, who approved and escorted, what was changed, whether media left the site, and the result of the MA-2e control check. MA-2(2) at High schedules and documents maintenance with automated mechanisms and produces complete records of actions requested, scheduled, in process and completed, which in practice means maintenance tracked in the IT service management or computerised maintenance management system rather than in email. For sanitisation methods, see the Media Sanitisation Guide, which covers SP 800-88 Rev. 2, published September 2025.

MA-3: maintenance tools

MA-3 (Moderate and High) requires you to approve, control and monitor maintenance tools and to review the approved list at a frequency you define. Tools include hardware diagnostic kits, laptops used by field engineers, software utilities and remote support applications.

Remote monitoring and management (RMM) and remote support software belong in the MA-3 approved list. CISA's Guide to Securing Remote Access Software notes that cyber threat actors increasingly co-opt legitimate remote access software to reach victim systems, and ATT&CK tracks this as T1219 Remote Access Tools. An approved list, plus detection of unapproved tools, turns MA-3 into a real control. See the RMM Tool Security Guide and MITRE ATT&CK T1219 Remote Access Tools.

MA-4: nonlocal maintenance

MA-4 applies to maintenance and diagnostics carried out by people communicating through an external or internal network. Its five parts read as a remote privileged access standard.

MA-4(3) at High requires remote maintenance to be performed from a system with comparable security to the one being serviced, or the component to be removed, sanitised, serviced and then inspected and sanitised for malicious software before reconnection. Useful tailoring candidates are MA-4(1) logging and review of session audit events, MA-4(4) replay-resistant authenticators and separation of maintenance sessions, MA-4(5) approval of each session and notification of planned maintenance, MA-4(6) cryptographic protection of maintenance communications, and MA-4(7) verification that sessions and connections actually terminated.

MA-4 is where supplier risk meets identity risk. Remote services and trusted relationships with suppliers are mapped in ATT&CK as T1133 External Remote Services and T1199 Trusted Relationship, and valid supplier accounts as T1078. Broker supplier sessions through a privileged access or remote access gateway, give each engineer a named account, and make access just in time. See the Third-Party Access Guide, Secure Remote Access Beyond VPN Guide and Remote access and PAM vendors as tier-zero suppliers.

MA-5, MA-6 and MA-7: people, timeliness and field maintenance

• MA-5 Maintenance Personnel: (a) a process to authorise maintenance personnel and a list of authorised organisations or individuals; (b) verification that non-escorted personnel hold the required access authorisations; (c) designated, technically competent staff with the right authorisations to supervise those who lack them. MA-5(1) at High sets procedures for maintenance staff without appropriate clearances or who are not US citizens: escort and supervision, sanitisation of volatile storage and removal or disconnection of nonvolatile media before work starts, and alternate controls you define where that is not possible.
• MA-6 Timely Maintenance (M, H): obtain maintenance support or spare parts for components you define within a time period you define of failure. Set it from the recovery time objectives in the contingency plan, so support contracts and spares match CP-2 and CP-7 commitments. MA-6(1) preventive and MA-6(2) predictive maintenance are tailoring candidates, common in OT.
• MA-7 Field Maintenance: restrict or prohibit field maintenance on systems you define to trusted maintenance facilities. Relevant where devices are deployed in the field or at customer sites.

How to evidence MA controls

SP 800-53A Rev. 5 assessment procedures use examine, interview and test. The table turns them into evidence an assessor can accept in one pass.

For assessment depth, see the NIST SP 800-53A Guide.

Implementing the MA family: a phased approach

This sequence is NHI Mgmt Group's recommendation for a Moderate system with supplier maintenance.

1. Inventory maintenance paths. List every supplier and internal team that maintains the system, how they connect, which tools they use and which accounts they hold, including service accounts and agents.
2. Write the parameters. Fill MA-1c, MA-2c, MA-2d, MA-2f, MA-3b and MA-6 in the system security plan, and list permitted remote tools for MA-4b.
3. Broker remote sessions. Route supplier access through one gateway with named accounts, strong authentication, approval and session recording. Remove direct inbound paths.
4. Make access time-bound. Disable standing vendor accounts; enable them per approved window and expire them automatically to meet MA-4e.
5. Control tools. Publish the approved tool list, block or alert on others, and add maintenance tools to patch scope.
6. Add the post-maintenance check. A short checklist after every maintenance action: logging on, default accounts disabled, configuration matches baseline.
7. Align with contingency planning. Match MA-6 contract terms and spares with recovery time objectives.

Move suppliers to the brokered path one at a time, keeping the old path disabled but restorable for a short agreed period. Roll back by re-enabling that path for the affected supplier only, with extra monitoring, while the issue is fixed.

Decision guidance

• Low versus Moderate: Low already covers controlled maintenance, remote maintenance and personnel. Moderate adds tool control with inspection and removal prevention, and timely maintenance commitments.
• Brokered versus supplier-owned tooling: letting each supplier install its own remote tool is simpler but multiplies paths and accounts. A single gateway under your control meets MA-4 more cleanly and gives one set of records.
• Cloud and SaaS: provider maintenance of its own infrastructure is usually inherited. Your obligations remain for components you manage and for any provider support access to your tenant, which should follow MA-4 principles.
• Small organisations: a managed service provider often performs all maintenance. Put MA-4 requirements in the contract: named accounts, MFA, records and session termination.

Detection and measurement

• Share of nonlocal maintenance sessions that went through the approved path with an approval record.
• Number of standing vendor or maintenance accounts enabled outside approved windows.
• Unapproved remote access tools detected per month, and time to removal.
• Share of maintenance actions with a recorded post-maintenance control check.
• Share of off-site repairs with a sanitisation record before removal.

Framework mapping

The SP 800-171 Rev. 3 column follows that publication's Maintenance family, where earlier requirements 03.07.01 to 03.07.03 are withdrawn. CSF and ATT&CK links are "intersects with", not equivalence, and are our reading. Check against NIST's published informative references before using them in an audit.

Common failure patterns

• Always-on vendor access: a supplier VPN or remote tool with a shared password is left open between visits, defeating MA-4a, MA-4c and MA-4e.
• Unlisted remote tools: suppliers install their own RMM agents, which never appear on the MA-3 list or in the security plan.
• Drives leave unsanitised: failed disks go back to the manufacturer under warranty with data intact.
• No post-maintenance check: a firmware update resets logging or re-enables a default account and nobody notices.
• Stale personnel list: supplier staff who have left still appear as authorised, and their accounts still work.
• Support contracts out of step with recovery: four-hour recovery objectives backed by next-business-day hardware support.

Practitioner checklist

• Inventory every maintenance path, tool and account, human and non-human.
• List permitted remote maintenance tools in the security plan and block or alert on the rest.
• Broker supplier sessions through one gateway with named accounts and phishing-resistant MFA.
• Make vendor access time-bound and confirm sessions terminate after each window.
• Record every maintenance action with the MA-2f fields and a post-maintenance control check.
• Sanitise media before any component leaves for repair or replacement.
• Keep the authorised maintenance personnel list current with supplier staff changes.
• Align MA-6 support terms and spares with contingency plan recovery objectives.

Standards and references

• NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
• NIST: OSCAL content, SP 800-53 Release 5.2.0 catalogue and baseline profiles
• NIST: SP 800-53B, Control Baselines for Information Systems and Organizations
• NIST: SP 800-53A Rev. 5, Assessing Security and Privacy Controls
• NIST: SP 800-88 Rev. 2, Guidelines for Media Sanitization
• CISA: Guide to Securing Remote Access Software
• NIST: SP 800-171 Rev. 3

Related NHI Mgmt Group resources: NIST SP 800-53 Guide · Privileged Access Management Guide · Third-Party Access Guide · RMM Tool Security Guide