Mapped to NIST 800-171 Requirement: 3.7.2
CMMC Assessment Objective: MA.L2-3.7.2[a]
What This Objective Means
Before performing maintenance, you need to define how it will be controlled to protect systems and data—especially when handling Controlled Unclassified Information (CUI).
This includes:
• Who is allowed to perform maintenance
• How access is granted, tracked, and revoked
• What procedures are followed to ensure maintenance doesn’t introduce risk
• How tools or software used in maintenance are vetted
The objective is to prevent unauthorized changes, data loss, or unintended exposure during routine or corrective work.
Why It Matters
System maintenance often involves:
• Elevated privileges
• Configuration changes
• Temporary disruption of security controls
• Potential introduction of unapproved tools
Without proper controls:
• Maintenance may introduce new vulnerabilities
• Malicious insiders or external vendors may gain access
• Sensitive data could be exposed or corrupted
You need to anticipate these risks and build protections around them.
How to Implement It
1. Define Maintenance Roles and Access
• Only authorize trained personnel
• Document who has access and for what systems
2. Establish Maintenance Procedures
• Include steps for:
◦ Pre-approval or notification
◦ Use of approved tools only
◦ Logging of activities
◦ Verification after work is complete
3. Secure Tools and Devices
• Ensure laptops, USB drives, or software used in maintenance are scanned and approved
• Use centrally managed tools where possible
4. Maintain a List of Approved Maintenance Activities
• Distinguish between routine (e.g., patching) and non-routine (e.g., system rebuild)
5. Document the Controls
• Add to your Access Control Policy, Configuration Management Plan, or System Security Plan
Evidence the Assessor Will Look For
• Policies or procedures identifying controls for system maintenance
• Documentation showing who is authorized to perform maintenance
• Lists of approved tools or software
• Risk mitigation strategies during maintenance
• Logs or tickets showing maintenance access was controlled and reviewed
Common Gaps
• Anyone with admin rights performs maintenance without restriction
• No differentiation between routine and emergency maintenance
• Use of unvetted or unmanaged tools during system access
• No formal controls outlined in documentation
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Defining role-based access controls specific to maintenance activities
• Providing templates and workflows for authorized maintenance approvals
• Ensuring only approved tools and configurations are used during maintenance
• Centralizing logging and access control during scheduled work
• Helping document and review all maintenance procedures in compliance with CMMC
With Cuick Trac, maintenance isn’t just allowed—it’s controlled, monitored, and secure.
Final CTA
Maintenance without controls creates risk. Put structure around your updates.
Schedule a Cuick Trac demo to define and enforce system maintenance controls that meet CMMC standards.