This objective ensures that the controls for managing and securing system maintenance—as identified in MA.L2-3.7.2[a]—are formally documented in policies, procedures, or system security plans. It verifies that your maintenance safeguards are clearly written, accessible, and aligned with your actual practices.