Mapped to NIST 800-171 Requirement: 3.7.6
CMMC Assessment Objective: MA.L2-3.7.6
What This Control Means
Any time maintenance is performed on a CUI system—especially by vendors, contractors, or even internal IT staff—someone must be present to oversee the work.
This applies to:
• Hardware or software servicing
• Diagnostics and troubleshooting
• Remote support (with screen sharing or elevated access)
• Emergency patching or system restoration
Supervision ensures that all activity is visible, policy-compliant, and does not compromise sensitive data.
Why It Matters
Maintenance often involves elevated privileges or direct access to sensitive components. Without supervision:
• CUI could be accidentally or intentionally accessed, copied, or altered
• Unapproved tools or backdoors could be installed
• Activity may go unlogged or untraceable
• You may lose the chain of custody during off-hours or vendor service calls
Supervision adds a layer of accountability and real-time control.
How to Implement It
1. Define Supervision Requirements in Policy
• State that all CUI-related maintenance must be actively supervised
• Apply this to both internal and third-party support personnel
2. Assign a Supervisor for Each Maintenance Event
• Must be an authorized, trained individual
• Should have knowledge of the system and security requirements
3. Log Supervised Events
• Document who supervised the work, what was done, and any anomalies
• Include supervision details in your maintenance records
4. Use Monitoring for Remote Maintenance
• If physical supervision isn’t possible:
◦ Use session recording
◦ Require screen sharing
◦ Limit remote access to specific time windows
5. Train All Supervisors
• Ensure they understand their responsibilities and know what to watch for
Evidence the Assessor Will Look For
• Policy requiring supervision of CUI system maintenance
• Logs or tickets referencing who supervised maintenance
• Procedures for assigning and verifying supervision
• Remote access logs or session recordings (if applicable)
• Training records for individuals assigned supervisory duties
Common Gaps
• Maintenance performed without oversight
• No logs documenting who supervised the activity
• Remote vendors given access without time restrictions or monitoring
• Policies don’t distinguish between routine IT tasks and maintenance on CUI systems
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Enforcing supervision policies during maintenance windows
• Assigning and logging supervisory roles in every maintenance event
• Supporting session monitoring and recording for remote maintenance
• Logging full activity records with timestamps, users, and system impact
• Providing templates and workflows to ensure supervision is consistently applied
With Cuick Trac, you always know who performed maintenance—and who watched over it.
Final CTA
When systems contain CUI, you can’t afford blind spots.
Schedule a Cuick Trac demo to ensure all maintenance is supervised, secure, and compliant.