Mapped to NIST 800-171 Requirement: 3.7.2
CMMC Assessment Objective: MA.L2-3.7.2[c]
What This Objective Means
This control checks whether your team is actively using the safeguards you’ve defined for system maintenance. It looks at:
• Who performs maintenance
• Whether only authorized personnel are granted access
• Whether approved tools are used
• If required steps (e.g., change control, logging) are followed
• If elevated access is removed after the work is complete
In short, are you doing what you said you would?
Why It Matters
Without implementation:
• Anyone with admin rights could perform untracked maintenance
• Sensitive systems could be exposed to unvetted tools or insecure updates
• Unapproved changes may introduce vulnerabilities or violate compliance
• Maintenance records may be incomplete or nonexistent
This control ensures your maintenance process is secure, structured, and enforced.
How to Implement It
1. Use Role-Based Access
• Only allow maintenance by authorized individuals
• Limit access duration (e.g., temporary privilege elevation)
2. Follow Documented Procedures
• Require pre-approval, scheduling, and verification
• Use a checklist or ticketing system to guide the process
3. Track Every Maintenance Event
• Log:
◦ Who performed it
◦ What systems were involved
◦ What tools were used
◦ Start/end times
4. Enforce Tool and Media Control
• Only allow use of scanned, approved software
• Block use of unknown USB drives or remote tools unless explicitly permitted
5. Monitor and Review
• Review maintenance logs during audits or post-maintenance evaluations
• Follow up on exceptions or deviations
Evidence the Assessor Will Look For
• Maintenance tickets showing actual execution of documented steps
• Audit logs showing access granted and revoked for maintenance
• Screenshots of role-based access controls or change control workflows
• Records of maintenance tool validation or scanning
• Interview responses from maintenance personnel confirming procedure use
Common Gaps
• Maintenance policies exist but aren’t followed
• Maintenance is performed without approval or documentation
• Unauthorized individuals carry out updates or troubleshooting
• No log or trace of what occurred during system changes
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Enforcing role-based access controls for system maintenance
• Logging all maintenance activities—including user, tools, time, and systems affected
• Preventing unauthorized maintenance through enclave policy enforcement
• Providing templates for maintenance checklists and procedures
• Supporting regular reviews to ensure ongoing implementation and compliance
With Cuick Trac, maintenance is not only planned—it’s securely executed and verifiable.
Final CTA
Controls mean nothing if they’re not followed.
Schedule a Cuick Trac demo to ensure your system maintenance procedures are actually implemented and enforced.