MA.L2-3.7.6 Maintenance personnel: requirements and evidence

What MA.L2-3.7.6 maintenance personnel requires for vendor technicians

MA.L2-3.7.6 asks the organization to supervise maintenance activities performed by people who do not hold the access authorization required for the systems being serviced. The typical case is a visiting vendor technician who repairs a server, firmware component or application on a system that handles CUI. The control does not ban these visits. It requires that someone with the right authority watches the work, limits what the outsider can reach, and keeps the access from outliving the job. The risk is plain: an unvetted person with hands on a CUI system can copy data, change configuration or install software without anyone noticing. In the CMMC scoring methodology, MA.L2-3.7.6 is a 1-point requirement, which makes it low weight in the score but still a finding an assessor will test.

The control is harder than it sounds because ownership is usually split. The IT team may believe the vendor's account manager is responsible for the technician, while the vendor assumes the customer will supply access. Shared logins are the most common shortcut: a single vendor account gets reused across visits, so no one can say which person did what. Support tickets create the second problem. A ticket opened for a repair often stays open for weeks, and the temporary access granted for it never gets removed. The CMMC Assessment Guide Level 2 suggests temporary accounts with short expiration periods and the most restrictive permissions possible for unauthorized maintenance personnel, which is the design to aim for. Before you set it up, confirm with your assessor which records they will request, since NIST SP 800-171A points to service contracts, authorized personnel lists, maintenance records and access control records.

A practical starting point is to decide, in writing, who approves each vendor visit, who supervises the session, and who removes the access afterward. Named, individually issued accounts with a defined expiration and the narrowest group membership that lets the technician complete the task give you evidence that is easy to produce. Keep the approval, the session record and the account removal together in one ticket. Your identity platform should show that the account was disabled when the work ended, not only that it was created. Confirm these details with your identity and maintenance teams and with the vendor's contract terms before the next visit, because the control is judged on the process you actually run.

Which maintenance personnel, systems and contracts fall under MA.L2-3.7.6

MA.L2-3.7.6 applies only to maintenance people who lack the access authorization for the CUI system they touch. Who counts as in scope depends on who works on which system and under what contract, so these decisions should be made before the supervision procedure is written.

On-site vendor technicians

Vendors who physically service servers, network gear, printers or test equipment inside CUI spaces are the most common case. Decide, for each visit, whether the technician holds the required access authorization. If not, the work must be escorted and supervised by an authorized employee, and the visit logged. Check whether the vendor's service visit procedure names the escort and the systems the technician may touch.

Remote vendor and OEM support staff

Remote support staff who reach CUI systems over a network are still maintenance personnel for this requirement, even though they never enter the building. Identify OEM engineers, software support desks and managed service providers that connect remotely. Confirm who can start a session, who watches it, and whether the account they use is temporary and limited to the task. Session controls are covered separately under MA.L2-3.7.5.

Managed service providers and their staff

A managed service provider that administers CUI systems may hold accounts that look like regular administrators. Confirm whether its staff hold the access authorization that the CUI system requires. Staff who do not should be treated as unauthorized maintenance personnel, with temporary accounts and supervision. Ask the provider how it assigns, logs and removes its own technicians' access to your environment.

Internal staff without the required authorization

Employees from facilities, general IT or other departments may perform maintenance without being authorized for the CUI enclave. Examples include a desktop technician repairing a workstation in a CUI room or a network engineer working on a switch that carries CUI traffic. Build a roster of who is authorized, then decide how these staff are escorted, supervised or given restricted accounts. Do not assume that employment alone grants access.

In-scope systems and enclaves

Define which systems fall inside the CUI boundary, including enclaves, shared infrastructure and any system that stores, processes or transmits CUI. Maintenance personnel only need supervision where they can reach those systems. Map each maintenance activity to a system in the boundary and mark it as in or out of scope. Out-of-scope systems still need documented controls, but they do not trigger this requirement for the CUI environment.

Contracts and service-level agreements

Third-party maintenance is governed by contracts and service-level agreements, which are assessment objects for this requirement. Review whether each agreement names the personnel who may work on CUI systems, requires notice of technician changes, and specifies escort, supervision and account rules. Where a contract is silent, the gap should be fixed in an amendment before the next visit. Ask legal and procurement to confirm that these terms flow down to subcontractors.

How an assessor tests maintenance personnel supervision

This table compares what an assessor examines for MA.L2-3.7.6, the single objective in NIST SP 800-171A, and where evidence usually falls short. Read each row as a question the assessor will ask, then check that your records answer it with final, dated documents. The main takeaway is that supervision is judged by whether every vendor session traces to a ticket, an approved person, and a short-lived account.

Assessment element	What the assessor checks	Evidence that satisfies it	Common finding
Assessment objective	Maintenance personnel without required access authorization are supervised during maintenance activities	Procedure and records showing an escort or monitor was assigned for each such session	Vendor work performed with no named supervisor recorded
Service provider contracts and SLAs	Whether maintenance by outside personnel is covered by written terms on access, supervision and data handling	Signed contract or SLA clauses on remote and onsite maintenance, with current versions	Contract silent on supervision, or only a draft agreement exists
List of authorized personnel	Who holds required access authorization and who does not, with the review date	Current roster of authorized staff and a record separating them from visiting technicians	Roster outdated, or vendor staff not identified at all
Maintenance records	Whether each maintenance event shows the people involved, the supervisor and the scope of work	Work orders listing technician names, supervisor, start and end times, and actions taken	Entries reading only 'vendor support' with no individual or supervisor named
Access control records	Whether temporary accounts were created for unauthorized personnel and removed after the work	Account creation and disable logs, expiry dates set at creation, and permissions matching the task	Accounts that never expired, or vendor accounts with broad administrative rights
Process for authorizing and managing maintenance personnel	Whether the organization can show how access is requested, approved, limited and ended, and that staff follow it	Written procedure, sample walkthrough of one vendor visit, and proof of the approval step before access was granted	No link between a maintenance ticket and an access grant, so approvals cannot be traced
Evidence status	Whether the records presented are final and reflect the period under review	Signed, dated and version-controlled records, with drafts kept separate from the evidence package	Draft procedures or unsigned contracts offered as proof of operation

How to implement supervised maintenance access step by step

This sequence turns a vendor technician's visit into a bounded, recorded event: the organization defines who needs supervision, binds each visit to an approved ticket, gives the visitor a short-lived and minimal account, watches the session, and removes access when the work ends. Each step leaves an artifact an assessor can examine for MA.L2-3.7.6.

Define who counts as unauthorized maintenance personnel
Start by listing every maintenance role that touches in-scope systems and marking those who lack the access authorization required for the CUI environment, such as visiting vendor engineers, OEM field technicians and contractors without a current screening. Assign an owner, usually the system owner or IT security lead, to keep this list current. Done means a written definition of the population, with the authorized personnel list kept separately so the two cannot be confused. Assessors look for this list as an assessment object for 3.7.6.
Write escort and supervision terms into contracts and SLAs
Update vendor service contracts and service-level agreements so they require that unauthorized technicians be escorted or supervised by an authorized employee for the full duration of maintenance, and that the vendor follow the organization's access and session rules. Ask counsel and procurement to confirm the wording, since the terms set what a vendor must accept before any work begins. Done means the signed contract or SLA contains the supervision clause, and the account owner can point to it. Contracts are a named assessment object for this requirement.
Tie every visit to an approved ticket
Require that each maintenance session starts from a change or service ticket that names the system, the work to be done, the vendor personnel involved, the planned window and the supervising employee. An authorized approver reviews and signs off before access is granted, and the approval is stored with the ticket. Done means a dated approval record exists for the visit, and no account is created without it. This record links the access decision to a specific need, which is what an assessor will trace.
Create temporary accounts with short expiry and minimal rights
Provision a separate account for each visiting technician instead of sharing a generic login or adding them to a regular user group. Set an expiration date that matches the approved window, grant only the permissions needed for the approved task, and deny access to other systems and data by default. In a directory such as FreeIPA or a federated identity provider such as authentik, this is typically done with a dedicated group, a time-limited account and role-restricted access policies. Done means an account exists with an expiry date and a permission set that matches the ticket. Confirm the exact capabilities of your platform before relying on them.
Supervise and record each maintenance session
Have the authorized employee stay with the technician for the session, or watch it through a monitored channel the organization controls, and log what was done, when, by whom and from where. Route session activity into the audit trail so the record can be correlated with the ticket. Done means a session log exists that shows the supervisor's presence, the actions taken and the start and end times. Assessors compare these records with the approval and account data to confirm supervision actually occurred.
Deprovision access when the work is complete
At the end of the window, or as soon as the approved task is finished, disable or delete the temporary account, revoke any active sessions and remove group memberships granted for the visit. In an identity platform that pushes changes to downstream applications, such as the authentik SCIM provider, confirm that the removal reaches each target. Done means the account is disabled or deleted, the deprovisioning event is logged, and the ticket is closed with a note of the completion time. Leftover accounts are a common finding, so check this step against the access records.
Review the visit records and correct gaps
Periodically compare tickets, approvals, account creation and expiry events, session logs and deprovisioning records for each vendor visit. Look for accounts that outlived their window, sessions without a named supervisor and visits without an approval. Record findings and corrective actions in the system security plan or POA&M as the program requires. Done means the records reconcile for every visit in the period, or each exception has an owner and a documented fix. This review keeps the evidence consistent when an assessor asks for it.

Which open-source identity tools can produce the supervision evidence

authentik can manage the lifecycle of a temporary maintenance account across the applications your team connects to it. Its SCIM provider pushes user and group creations, changes and deletions to target applications over SCIM 2.0, so an account created for a visiting technician exists only where the group membership reaches. The provider runs a full sync every hour and deprovisions users from the target when they lose access to the application. The project is released under the MIT license.

Temporary accounts as group members: Place the technician's account in a dedicated maintenance group that carries only the narrow role the task needs. This follows the CMMC Assessment Guide's suggestion of temporary accounts with the most restrictive permissions possible.
Provisioning records: Each creation, change and deletion pushed by the SCIM provider is a change event your team can export and attach to the maintenance record for that visit.
Removal window: Because a full sync runs every hour, deprovisioning reaches the target applications within that cycle. Document the expected window so an assessor can compare it with the scheduled end of the visit.
Connector coverage: The SCIM provider reaches only the applications you connect to it. Inventory every system the technician can access and confirm each one receives deletions.

Confirm in your own environment whether authentik gives you the session supervision, escort logging and expiry rules you need, since the SCIM provider covers account lifecycle rather than supervised activity.

Maintenance personnel evidence that passes an assessment

An assessor testing MA.L2-3.7.6 checks whether supervision is documented, authorized and provable after the fact. The six artifacts below connect: the authorized list defines who may be unsupervised, contracts and tickets show how access was granted, and lifecycle, session and access records show it ended and was supervised.

Authorized personnel list

This is the baseline the assessor uses to decide who counts as maintenance personnel without required access authorization. It should name each vendor technician or internal staff member who lacks the access authorization, the system scope they may touch, and the supervising employee for each. Keep it current by reviewing it on a fixed schedule and after every contract change, and remove anyone whose engagement has closed. Confirm that the list matches the accounts actually created in your identity system.

Vendor contracts and SLAs

Service provider contracts and service-level agreements should state that maintenance by the vendor's personnel is supervised by your staff, and say who holds that responsibility. Assessors look for the supervision terms themselves, not a general security clause. Review the terms when a vendor changes its technician roster or subcontracts work, and file amendments with the original agreement so the version in force on any audit date is easy to show.

Approval tickets for temporary accounts

Each temporary account should trace to a request that names the technician, the system, the work scope, the supervisor and the start and end times. The ticket should carry an approval from someone outside the requesting team. Sample closed tickets each quarter and confirm that every temporary account has one, and that no account was created by a verbal or chat request with no record.

Account lifecycle records

These records prove the temporary accounts were short-lived and most restrictive, as the CMMC Assessment Guide Level 2 expects for unauthorized maintenance personnel. Capture creation, permission grants, expiry dates and removal events. In an authentik deployment, the SCIM provider can push user and group deprovisioning to target applications, and the sync log shows when that happened. Confirm that expired accounts are actually disabled, not merely dated, by testing one before each assessment.

Session and escort logs

These logs show that a supervisor was present or watching when unauthorized personnel worked. Depending on the system, they may come from a privileged session recorder, a sign-in and sign-out record with the supervisor's name, or a physical escort log for on-site work. Assessors check that the times line up with the approved ticket and that the supervisor is the person named there. Retain them with the audit records for the system, and test that they can be retrieved for a sample date.

Access control records

Directory and access control records show what each temporary account could reach and who administered it. In FreeIPA, the 389 Directory Server stores users, groups and host objects, and delegated administration shows which administrators can create or change accounts. Export group membership and sudo or role assignments at intervals, and compare them with the authorized list to find accounts that should have been removed. Confirm the export includes the delegation rules, because assessors ask who could grant access.

What supervising maintenance personnel costs to meet

This table breaks down the cost components of meeting MA.L2-3.7.6 for supervised vendor and visiting technicians, showing who is paid, whether each cost is one-time or recurring, and what pushes it up. Use it to build a quote request and to see where self-hosted open source removes license spend while effort remains.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it up
Identity tooling or licenses	Software vendor or internal platform team	Recurring if commercial; none for self-hosted open source license fees	Number of target applications and identity sources; self-hosted platforms still need hosting and admin time
Engineering time for temporary account workflows	Internal identity team or implementation partner	One-time build, then periodic review	Number of vendors, variety of systems visitors touch, and how many approval paths exist
Contract and SLA revisions	Internal legal or procurement, sometimes outside counsel	One-time per contract, then at renewal	Number of maintenance vendors and how many contracts lack supervision or access terms
Supervision time from internal staff	Internal system administrators or facility escorts	Recurring, tied to each maintenance visit or session	Visit frequency, number of in-scope systems, and whether remote sessions need live observation
Evidence upkeep	Internal compliance or security staff	Recurring, such as keeping authorized personnel lists and maintenance records current	Turnover among vendor technicians and the number of maintenance events per period
Auditor sampling and assessment support	Independent assessor, plus internal staff who pull records	Recurring at each assessment cycle	Number of maintenance events an assessor samples and how quickly records can be produced in final form
Account expiration and cleanup	Internal identity administrators	Recurring	Accounts left active after work ends; confirm automated expiration is configured in the identity platform
Remediation of gaps found in testing	Internal team or implementation partner	One-time per gap, then retest	Missing supervision logs, shared accounts, or contracts that grant standing access

Who owns supervised maintenance access and who should do the work

Your organization owns MA.L2-3.7.6. The requirement is that maintenance personnel without the required access authorization are supervised while they work, and only your organization can decide who is authorized, who may visit, and when a session is allowed to start. No partner or vendor can accept that accountability on your behalf, and an assessor will look for named internal owners who can explain each decision and show the records behind it.

Approving visits: A named person in your organization approves each maintenance visit by an unauthorized technician, records the scope of work, and sets the start and end time.
Supervising sessions: An internal employee with the right access watches or directly controls each session, with the ability to stop it at any point.
Keeping the authorized list current: Your team maintains the list of personnel who hold the access authorization needed to work unsupervised, and removes people when contracts end.
Owning vendor contracts: Service agreements and service-level terms that cover maintenance personnel are signed and reviewed by your organization, not delegated entirely to the vendor.
Retaining records: Visit approvals, session logs and access control records are kept in final form so they can be produced for the assessment.

Before an assessment, confirm that each step above has a named owner, a written procedure, and recent records that match what actually happened.

Where maintenance personnel supervision usually falls short

Most failures under MA.L2-3.7.6 are not missing policies. They are vendor accounts that outlive the visit, supervision that happens but leaves no record, and lists and procedures that were never kept current. Each card below names one gap and a fix you can start this quarter.

Permanent or shared vendor accounts

A technician who logs in with a standing account or a password shared across a vendor team has access that nobody reviews. For MA.L2-3.7.6, the account used by maintenance personnel without required access authorization should be temporary, expire on a short schedule, and carry the most restrictive permissions that still let the work finish. Start by listing every vendor login on in-scope systems and retiring any that are shared or have no expiration date. Ask your identity team to confirm that each remaining account is individually named.

Supervision claimed but not recorded

Many organizations say an employee watched the vendor work, but no record shows who supervised, when the session started and stopped, or what was done. The assessment objective asks whether maintenance personnel without authorization are supervised during the activity, so the claim has to be provable. Require a supervisor name, ticket number, start and end times, and a short summary on every visit. Keep these entries with the maintenance records so an assessor can trace one visit from request to closeout.

Contracts silent on escort and access terms

Service agreements often cover price and response time but say nothing about who may touch in-scope systems, whether an escort is required, or how accounts are issued and removed. Assessors review service provider contracts and service-level agreements as evidence for this requirement. Amend the contract or statement of work to state the escort rule, the account lifecycle, the session logging expectation, and the obligation to return or revoke access at the end of each visit. Confirm the language with your counsel before signing.

Authorized personnel lists that go stale

The list of people authorized to perform maintenance is a named assessment object, and it is often out of date. Staff leave, vendors reassign technicians, and contractors change roles, while the list stays the same. Assign one owner for the list, review it on a fixed schedule you set in your own procedures, and compare it against directory group membership and recent access records. Any vendor technician who appears in logs but not on the list is a finding you should find first.

Draft procedures presented as final evidence

An escort procedure saved in a working folder, marked draft, or updated after the assessment began will not be accepted as final evidence. Under the CMMC rules, a requirement is met only when the evidence is in final form. Put the supervision procedure through your document approval process, record the approval date and approver, and store the signed version in your controlled repository. Remove older drafts from the evidence folder so an assessor cannot mistake one for the current version.

Vendor access without directory governance

When vendor accounts live outside the central directory, deprovisioning depends on someone remembering to remove them. Tie temporary maintenance accounts to a directory group with an expiry date, so access ends automatically when the group membership lapses. Automated deprovisioning from a central identity provider, such as the SCIM provider in authentik, removes users from target applications when they lose access. Test the removal on a non-production system and keep the test output as evidence.

Questions buyers ask about MA.L2-3.7.6 cost, effort and outside help

How much effort does MA.L2-3.7.6 actually take to meet?

The requirement carries 1 point and has a single assessment objective: maintenance personnel without required access authorization must be supervised during maintenance activities. The effort is small in scoring terms but not in practice, because it depends on how often vendors and visiting technicians touch your systems. Most of the work is writing down who may come in, who watches them, and how their access is created and removed. Effort rises with the number of vendors, the number of maintenance windows and the number of systems in scope. Ask a partner to estimate effort from your actual maintenance log rather than from the single objective.

Can we meet MA.L2-3.7.6 in-house without outside help?

Yes, if your team has an administrator who can run temporary accounts and a process owner who can keep the authorization list current. The organization owns the control, so internal staff must perform the supervision and keep the records. Outside help is useful when your identity platform is not set up for short-lived, least-privilege accounts or when no one has time to produce the evidence. An assessor will test the process and the records, so an in-house team should rehearse the evidence before the assessment. Whether you bring in help is a capacity and skills decision, not a requirement of this control.

What does the work need from our team and our systems?

The work needs four things in place:

A current list of service providers, service-level agreements and personnel authorized for maintenance
A way to create temporary accounts with short expiration periods and the most restrictive permissions possible
Supervision by an authorized employee during each visit, with the activity recorded
Access control records that show when each account was created, used and removed

Your identity administrators, the system owner and the people who schedule vendor visits all need defined roles. Self-hosted identity tools can automate account creation and removal, for example through SCIM provisioning, but you must confirm that any tool you choose supports the expiration and permission limits you need.

How long does it take to get MA.L2-3.7.6 in place?

No fixed duration applies to this requirement, so treat any timeline you are quoted as a function of your scope. The duration depends on how many maintenance relationships you have, whether temporary account tooling already exists, and how quickly your team can write and approve the authorization list. Ask a partner to break the schedule into written milestones, such as process definition, account tooling, a dry run of one maintenance visit and evidence collection. Confirm the schedule against your next scheduled vendor maintenance window and your own assessment date.

Can MA.L2-3.7.6 go on a POA&M under the scoring rules?

Yes, under the scoring rules this requirement is eligible. It is worth 1 point and is not on the exclusion list in 32 CFR 170.21, so it may be placed on a plan of action and milestones for Conditional Level 2 status if your score is at least 88 of 110 (0.8). Closeout is due within 180 days. Confirm the current status of the POA&M rules with your contracting officer and the regulation text, because the program is in transition. Do not use a POA&M as a substitute for having the process in place when an assessor asks for it.

Is MA.L2-3.7.6 enforced now after the Phase II suspension?

The requirement itself remains part of the Level 2 security requirements. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Because of that, the practical risk is a self-assessment score and an affirmation that must be accurate today. Confirm with your contracting officer and the official sources which obligations apply to your contracts before you change your plan.

What should we ask a partner before signing a fixed-scope agreement?

Ask for a written scope that names the systems, maintenance relationships and evidence you expect at the end. Most DeployOpen engagements are fixed-scope, so deliverables and timelines are agreed in writing before work starts. Ask who owns each control and who issues any assessment report, because DeployOpen prepares systems and evidence but only an independent assessor or certification body issues reports or certificates. Also ask what is one-time and what recurs, such as a retainer for ongoing support, and what changes if your scope grows. A quote should follow directly from that written scope.

How DeployOpen prepares supervised maintenance access for assessment

DeployOpen helps organizations prepare the systems, accounts and evidence that show visiting maintenance personnel are supervised and limited to temporary access. The organization owns its controls and decides who is authorized, and an independent assessor makes the final judgment on MA.L2-3.7.6.

How we scope

Scope lists every system, vendor and maintenance path where people without required access authorization may work.
The written scope names the accounts, tools and records we will prepare for supervised maintenance access.
Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.

How we build

We configure temporary accounts with short expiration periods and the most restrictive permissions the work allows.
We set up the identity platform so that access ends automatically when a visit or contract ends.
We test the supervision workflow end to end, including who approves each session and who watches it.

How we hand over

We document the authorized personnel list, account lifecycle, supervision steps and maintenance records for the assessor.
We deliver evidence in final form that maps to the 3.7.6 assessment objective in NIST SP 800-171A.
We walk your team through the runbook so your staff can run supervised visits without us.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
We can review new vendor contracts and service-level agreements against the 3.7.6 supervision requirement.
We confirm with you which evidence your assessor expects before each assessment cycle begins.