MA.L2-3.7.1 – Perform maintenance on organizational systems.

This control requires your organization to regularly perform maintenance on its systems, including hardware and software updates, patches, configuration changes, and preventive care to ensure secure and stable operation—especially for systems that store or process Controlled Unclassified Information (CUI).

MA.L2-3.7.3 – Ensure equipment removed for off-site maintenance is sanitized of any CUI.

This control requires your organization to sanitize (or remove) Controlled Unclassified Information (CUI) from any equipment before it leaves your facility for off-site maintenance. If sanitization isn’t possible, you must apply approved safeguards to protect the data during transport and while off-site.

MA.L2-3.7.4 – Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

This control ensures that any external media (e.g., USB drives, CDs, portable hard drives) containing diagnostic or testing tools is scanned for malware or malicious code before it is connected to or used on organizational systems—especially those handling Controlled Unclassified Information (CUI).

MA.L2-3.7.5[b] – Examine documentation to confirm individuals authorized to perform maintenance are identified.

This objective ensures that the individuals or roles authorized to perform maintenance on systems—especially those that handle Controlled Unclassified Information (CUI)—are formally documented in your organization’s policies or security plans.

MA.L2-3.7.2[b] – Examine documentation to confirm system maintenance controls are identified.

This objective ensures that the controls for managing and securing system maintenance—as identified in MA.L2-3.7.2[a]—are formally documented in policies, procedures, or system security plans. It verifies that your maintenance safeguards are clearly written, accessible, and aligned with your actual practices.

MA.L2-3.7.2[c] – Determine if system maintenance controls are implemented.

This objective confirms that the maintenance controls identified and documented in previous objectives (MA.L2-3.7.2[a–b]) are actually in place and functioning. It focuses on whether your organization is following its defined procedures to manage risk during system maintenance activities.

MA.L2-3.7.2[a] – Identify controls for system maintenance.

This objective requires your organization to identify the security controls in place for managing system maintenance activities—including who can perform maintenance, how it’s tracked, and how risks are mitigated during the process.

MA.L2-3.7.5[a] – Identify individuals authorized to perform maintenance.

This objective requires your organization to identify and document who is authorized to perform maintenance on systems that store, process, or transmit Controlled Unclassified Information (CUI). These individuals must be vetted, assigned appropriate access, and listed by role or name.

MA.L2-3.7.6 – Ensure maintenance personnel are supervised when maintenance is performed on a system containing CUI.

This control requires your organization to supervise any maintenance personnel—internal or external—while they are performing maintenance on systems that store, process, or transmit Controlled Unclassified Information (CUI). Supervision helps reduce the risk of unauthorized access, data exposure, or system compromise during elevated-access activities.

MA.L2-3.7.2[d] – Determine if system maintenance controls are enforced.

This objective confirms that your organization doesn’t just have maintenance controls in place—it actively enforces those controls through technical safeguards, policy compliance, and oversight. The focus is on preventing unauthorized or noncompliant maintenance activities, not just trusting people to follow procedures.