MA.L2-3.7.1 Perform maintenance
Performing corrective, preventive, adaptive and perfective maintenance on organizational systems, including regular patching, and keeping maintenance records. Covers the maintenance evidence assessors examine.
MA Maintenance
The six CMMC Level 2 maintenance requirements: performing and controlling maintenance, sanitizing equipment removed for off-site maintenance, inspecting media and tools, nonlocal maintenance and supervising maintenance personnel.
MA.L2-3.7.2 System maintenance control
Controlling the tools, techniques, mechanisms and personnel used for system maintenance so maintenance does not introduce malware or misuse elevated access. A 5-point requirement in the scoring methodology.
MA.L2-3.7.3 Equipment sanitization
Sanitizing equipment of any CUI before it leaves organizational spaces for off-site maintenance, by clearing, purging or destroying media. Covers sanitization methods and records.
MA.L2-3.7.4 Media inspection
Checking media that contain diagnostic and test programs, such as vendor troubleshooting tools, for malicious code before they are used on systems that handle CUI.
MA.L2-3.7.5 Nonlocal maintenance
Requiring multifactor authentication to establish maintenance sessions over external network connections and terminating those connections when the work is done. A 5-point requirement in the scoring methodology.
MA.L2-3.7.6 Maintenance personnel
Supervising maintenance work by people who lack the required access authorization, such as visiting vendor technicians, with temporary and tightly limited accounts.
