Mapped to NIST 800-171 Requirement: 3.4.7
CMMC Assessment Objective: CM.L2-3.4.7[a]
What This Objective Means
System maintenance tools include built-in or third-party software that can:
• Modify system settings
• Access sensitive files or databases
• Restart or shut down systems
• Monitor or manipulate performance
Examples: PowerShell, Registry Editor, Remote Desktop, Task Manager, BIOS utilities, backup software, SSH clients.
This objective focuses on identifying what controls you have in place to restrict and monitor the use of those tools.
Why It Matters
If these tools are misused—intentionally or accidentally—they can:
• Bypass security controls
• Grant unauthorized access to CUI
• Alter logging, access, or protection mechanisms
Without access control and visibility, system maintenance tools become a significant risk.
How to Implement It
• Identify maintenance tools present in your environment
◦ Windows: PowerShell, Command Prompt, MMC snap-ins
◦ Linux: sudo/root commands, shell scripts, SSH
◦ Cloud: Admin consoles, management interfaces
• Identify controls in place to manage them, such as:
◦ Role-based access controls (RBAC)
◦ Multifactor authentication (MFA)
◦ Application allowlisting
◦ Administrative access restrictions
◦ Logging and alerting for use of these tools
• Document the tools and controls in your:
◦ System Security Plan (SSP)
◦ Configuration Management or Access Control Policy
Evidence the Assessor Will Look For
• List of maintenance tools and descriptions of how their use is controlled
• Policies that define authorized use of administrative utilities
• Logs or access control rules tied to system tools
• References to controls in your SSP or technical documentation
Common Gaps
• Maintenance tools installed by default with no control or documentation
• All users can access admin-level tools without restriction
• No logging or monitoring of system-level utility usage
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Restricting system tool access to authorized roles within the enclave
• Preventing unauthorized use of maintenance tools through RBAC and application control
• Logging all use of privileged tools for review and compliance
• Helping document allowed tools and associated controls
With Cuick Trac, maintenance utilities are controlled, monitored, and never a mystery.
Final CTA
Tools that can reconfigure your system should never be open to everyone.
Schedule a Cuick Trac demo and gain complete visibility and control over your system-level utilities.