03.07.06 Maintenance personnel: requirements and evidence

03.07.06 maintenance personnel: what the requirement asks for and why it is hard

If a contract requires NIST SP 800-171 and anyone outside your core team can reach systems that hold CUI, requirement 03.07.06 applies to them. It asks your organization to authorize maintenance personnel, keep a list of the people and maintenance organizations authorized to work on those systems, verify that any maintenance person without an escort holds the access authorizations the CUI requires, and assign designated staff with the authorizations and technical competence to supervise anyone who lacks them. The organization owns this process. An assessor will test it through the policy and procedures, service provider contracts, service-level agreements, the authorized personnel list and maintenance records, and will interview the people who run maintenance and information security.

The risk is simple to describe and hard to contain. A cloud operator, a hardware technician, a software vendor's support engineer or an internal administrator with privileged access can change, copy or disable the components that protect CUI, often outside the normal change process. Maintenance is also spread across internal teams, managed service providers and remote vendors, so no single department sees the full list of who has been in the environment. Remote sessions add a second layer that is covered by 03.07.05 (nonlocal maintenance), and the physical visits that come with on-site work are tied to the physical access controls in 03.10.01, which the Rev. 3 discussion of this requirement references. The practical question for your team is whether you can name, today, every person and vendor that has maintenance access and show who approved each one.

Rev. 3 changed the shape of this requirement. Rev. 2 split the work between 3.7.2 (controls on maintenance personnel) and other maintenance requirements. In Rev. 3, 03.07.06 absorbed Rev. 2 3.7.2, and NIST's change analysis classifies the change as significant because the requirement now asks for more detail and foundational tasks. Rev. 2 3.7.2 is the identifier that CMMC Level 2 still uses (MA.L2-3.7.2 maps to the Rev. 2 requirement), so teams working toward a CMMC assessment should map their existing evidence to both numbers. Confirm with your contracting officer which revision your contract names, because the answer determines which numbering your assessor will use.

Which maintenance people and systems fall under 03.07.06

03.07.06 applies to anyone who performs maintenance on a system that processes, stores or transmits CUI, whether they work for your company or someone else. The scoping question is less about job titles and more about who can reach the CUI boundary and who can touch the components inside it. Work through each group below and record the result in your maintenance personnel list.

In-house system administrators

Internal administrators who patch servers, change firewall rules or repair workstations inside the CUI boundary are maintenance personnel for this requirement. They are often left off the list because they are employees with broad access. Confirm that every administrator with maintenance rights on in-scope assets appears on the authorized list, and that privileged accounts used for maintenance are tied to named individuals. Include contractors who work as staff augmentation under your direction.

Managed service providers

An MSP that remotely administers, monitors or repairs in-scope systems is a maintenance organization, even when the contract never uses that word. Identify each MSP engineer or team with access, and confirm the service agreement and service-level terms describe how maintenance is authorized and supervised. Ask the provider to name the individuals who will hold access, because the requirement attaches to people, not only to the company.

Hardware and software vendors

Vendor field engineers, warranty repair technicians and software support staff who open a system to service it fall under the requirement. Equipment that leaves your control for repair may also be covered by the media and maintenance tool requirements. Record the vendor organization and each technician who may perform work, and decide in advance whether vendor staff will be escorted or require their own access authorizations.

Remote support and nonlocal sessions

A support engineer who connects from outside the facility to diagnose a problem is performing maintenance, even if no one visits the site. Remote sessions also bring 03.07.05 into play, so the people behind those sessions must appear on the authorized list as well. Check that every remote maintainer has an individual account, and that shared or emergency accounts are either prohibited or recorded against a named person.

On-site visitors and escorted staff

Technicians or visitors who enter a facility to work on in-scope equipment need a decision on whether they are escorted or hold their own access authorizations. Under 03.07.06, unescorted maintenance personnel must be verified as holding the required access authorizations, and escorted personnel must be supervised by someone with the authorizations and technical competence. The reference to 03.10.01 (Physical access authorizations) means your facility access list and maintenance list must agree, so check both before the visit.

Cloud provider staff

Cloud provider personnel who perform infrastructure maintenance under the provider's own controls are a scoping question for each contract. Whether their activity falls under your maintenance list depends on the shared responsibility split, the provider's access model and whether they can reach your CUI or the components that hold it. Ask the provider for its documented maintenance access controls and confirm with your assessor how those records will be used as evidence.

How to implement 03.07.06 in order

This sequence turns the maintenance personnel requirement into a working process: you map every route maintenance people can take into the CUI environment, decide who approves them, keep a current list, and set escort and supervision rules that an assessor can trace. Each step produces a record you can show during an assessment.

Inventory every maintenance path into the CUI environment
Start by listing every way a person can perform maintenance on systems that handle CUI. Include on-site vendor visits, field engineers, managed service providers, cloud provider support staff, remote vendor sessions and internal IT staff who work on CUI systems. Record the system, the access route, the organization or person involved and whether the work is on site or remote. The output is a maintenance access inventory that your assessor can compare against the authorized list. Confirm the scope with the system owner before moving on, because gaps in this inventory carry into every later step.
Define who may authorize maintenance
Assign a named authority, or a small group, to approve maintenance personnel and organizations before any access is granted. Document the approval criteria, such as the business need, the work scope and the access authorization the person must hold. Write down who can approve, who can revoke approval and how approvals are recorded. The output is an approval policy section and a designated authorizer roster, signed or accepted by the system owner and the security lead. Without a named authority, the later list has no owner to answer for it.
Build the authorized maintenance list
Create a list of the organizations and individuals approved for maintenance, with each entry tied to the systems and access routes from the inventory. For each person, record whether they hold the required access authorization, which the organization verifies through its personnel security records under 03.09. Mark anyone without that authorization as requiring escort or supervision. Store the list in a controlled location with version history so changes are traceable. The output is the authorized maintenance roster, which is the artifact an assessor will ask to see first.
Verify access authorizations for unescorted staff
For every person on the list who will work without an escort, check the access authorization against your records and keep a dated verification entry. Compare the verification against the approval, and remove unescorted access for anyone whose authorization cannot be confirmed. Repeat the check when a person's status changes or when contract terms renew. The output is a verification log that links each unescorted individual to the evidence supporting their authorization. Confirm the specific authorization standard that applies to your contract with the contracting agency, since the requirement depends on it.
Set escort and supervision rules
For personnel who lack the required access authorization, define the escort or supervision arrangement before any work starts. Specify who escorts or supervises, what the supervisor must watch, and what happens when work is interrupted. The requirement calls for designated personnel who hold the required authorizations and have the technical competence to supervise the work. Record the rules in the procedure so they apply the same way on every visit. The output is a written escort and supervision standard.
Name technically competent supervisors
Assign specific supervisors for each maintenance activity that involves people without the required authorizations. Confirm that each supervisor holds the required access authorization and has demonstrated technical competence for the systems involved. Keep a supervision roster that links each supervisor to the systems, periods and visitors they cover. Review the roster when staffing or system scope changes. The output is a supervision roster that shows who was responsible for each supervised session, which is the record an interviewer will test against the procedure.
Write and approve the maintenance personnel procedure
Consolidate the approval policy, the authorized list, the verification steps, the escort rules and the supervision roster into one written procedure. Include the steps for adding, changing and removing maintenance personnel, and the records each step creates. Ask the system owner and the security lead to approve the procedure, and keep the approved version under document control so that changes and approval dates can be shown. The output is an approved maintenance personnel procedure that the people who run maintenance can follow and an assessor can examine.
Confirm the link to physical access and the system security plan
Check that the procedure matches the physical access controls for the facilities where maintenance occurs, since the Rev. 3 discussion of this requirement refers to 03.10.01 on physical access authorizations. Update the system security plan so it describes the maintenance personnel process, the roster locations and the responsible roles. Confirm that the escort and supervision steps appear in the training material for staff who sponsor visitors. The output is a cross-referenced set of documents where the physical access list, the system security plan and the maintenance procedure agree.

How an assessor tests 03.07.06 under SP 800-171A

This table walks through how an assessor applies the examine, interview and test methods from SP 800-171A Rev. 3 to 03.07.06, with the objects each method uses. Read it as a checklist of what to have ready before the assessment, and of the gaps assessors most often report.

Method or focus	What the assessor does	Evidence to have ready
Examine: policy and procedures	Reads the maintenance policy and procedures to confirm they describe how maintenance personnel are authorized, listed and supervised	Current maintenance policy with an owner, review date and approval record
Examine: contracts and SLAs	Checks service provider contracts and service-level agreements for who may perform maintenance and what access rules apply	Signed contracts, SLAs and any addenda naming maintenance responsibilities
Examine: authorized personnel list	Compares the list of authorized maintenance organizations and people against the access records for systems that hold CUI	Dated list with names, employers and authorization basis, plus the matching access records
Examine: maintenance records	Samples maintenance records to confirm that the people who did the work appear on the authorized list	Maintenance tickets showing who worked on which system and when
Interview: maintenance staff	Asks system maintenance personnel how they request authorization, what they can access and who supervises them	Staff able to walk through the authorization and escort steps without referring to notes
Interview: security staff	Asks information security personnel how access authorizations are verified and how the list is kept current	Named owners for the list, the verification step and the review cadence
Test: authorization process	Observes or walks through the process for authorizing and removing maintenance personnel	A worked example, such as a recent onboarding or offboarding, traced end to end
Test: supporting mechanisms	Checks that tools or access systems actually enforce the authorization, such as role assignments or access reviews	Configuration output or access review records showing the mechanism is in use

Evidence that passes 03.07.06 and how to keep it current

An assessor testing 03.07.06 examines documents, interviews staff and tests the mechanisms that authorize maintenance people. The cards below cover the artifacts that answer each part of the requirement and the routines that keep them accurate between assessments. Each artifact should name the same people, systems and dates as the others, so a reviewer can trace one maintenance visit from authorization through supervision to the logged work.

Maintenance personnel procedure

This is the written process for authorizing maintenance personnel, including who approves a request, what checks run first and how access is removed afterward. Assessors compare it with the examine objects listed for 03.07.06, so the document should match how staff actually work. Confirm it names the roles that hold approval authority, the access authorization checks it requires and the link to physical access authorizations under 03.10.01. Record the review date and owner on the document itself.

Authorized maintenance list

The list of authorized maintenance organizations and individuals is the core artifact for the requirement. Each entry should show the person or vendor, the systems they may maintain, the date access was granted, the approver and the date access expires or was last confirmed. Export it from the system of record and keep prior versions so an assessor can see who was on the list during a past maintenance window. Stale entries for departed vendor staff are a common finding.

Service contracts and SLAs

Contracts with external maintenance providers should state which systems they may touch, whether remote sessions are permitted and what personnel screening and access verification the provider performs. Service-level agreements should set response and access terms that match the authorized list. Ask legal and procurement to confirm that the contract language on access terms, subcontractors and termination of access is current, and file the executed version alongside the list it supports.

Maintenance logs tied to individuals

Maintenance records should identify the person who performed each task, the system affected, the start and end times and the work done. Shared or generic accounts make it impossible to show that only authorized people worked on CUI systems, so check that each session maps to a named individual. Logs from the maintenance activity should be retained with the other audit records the organization keeps for its CUI environment, and sampled during internal reviews.

Escort and supervision records

Where maintenance personnel lack the required access authorizations, the organization must show that a designated person with those authorizations and the technical competence to supervise was present. Escort records should name the supervisor, the visitor or technician, the systems or areas involved and the time window. Confirm that the supervisor list is itself reviewed, because a supervisor who has left the organization cannot provide the oversight the requirement expects.

Access authorization verification checks

Before unescorted maintenance begins, the organization should record that each person was checked for the access authorizations the system requires. Evidence can include screening confirmations from the personnel security process, badge or account approvals and the date each check was completed. Ask the personnel security owner to confirm how these checks connect to the screening requirements in 03.09, since assessors often test both families together.

Review cadence and change history

Evidence stays credible only when someone can show it was reviewed and changed deliberately. Set a review schedule for the procedure, the authorized list and the supervisor roster, and record each review with its date and reviewer. Keep version history for the procedure and the list so changes are attributable to a person and a date. Access certification campaigns in identity tools can formalize the periodic decision to keep, change or revoke each entry, which gives assessors a dated trail between audits.

Keeping the authorized list true with access certification

A maintenance personnel list written once starts to decay the day it is approved. Vendor engineers change projects, internal administrators move into new roles, and contractors finish engagements without anyone telling the security team. Each change leaves behind an access grant that still works, and over time the list stops matching the people who can actually reach systems that hold CUI. Under 03.07.06, the authorized list and the access authorizations behind it must stay accurate, so the list needs a recurring check, not just an initial sign-off. A list that nobody re-examines is a list that no longer shows who can maintain the system.

One way to keep the list true is a periodic access certification campaign. In this approach, the organization exports every account and role that can perform maintenance on in-scope systems, including accounts held by external service providers, and assigns each item to a designated reviewer, usually the system owner or a manager who knows the work. The reviewer decides within a set timeframe whether to keep, change or revoke each item, and anything not decided by the deadline is treated as a revocation or escalated under a defined rule. The organization sets the cadence, the timeframe and the escalation path in its own maintenance policy. Confirm those values with your assessor before the first campaign, because the Rev. 3 requirement leaves the frequency to the organization and assessors will check that the chosen values are written down and followed.

Segregation of duties is the reason to run the campaign separately from the people who grant access. An administrator who approves a vendor's maintenance account should not also be the only person who confirms it still belongs on the list. Use the campaign records to show that the requester, the approver and the reviewer are different people where the system allows it. Keep each decision, reviewer, date and any change to the list, and ask whether your identity platform or ticketing system can produce those records without manual reconstruction. Confirm that capability with the vendor rather than assuming it, because the audit trail is what an assessor will ask to see when they interview the people responsible for maintenance.

What meeting 03.07.06 costs in money and effort

This table breaks down the cost components of meeting 03.07.06 by who is paid, whether each cost is one-time or recurring, and what drives it up or down. Use it to structure a written scope and to compare quotes on like-for-like terms. No price or duration is stated because none is supplied for this requirement; confirm figures in the written scope.

Cost component	Who is paid	One-time or recurring	What drives it
Tooling and licenses	Software vendors or none if self-hosted	Recurring if licensed, one-time to deploy	Self-hosted open-source platforms can avoid license spend for the authorization list and access records; confirm support terms with the vendor
Building the authorized maintenance list	Internal staff, possibly an implementation partner	One-time, then recurring upkeep	Number of maintenance organizations and individuals, and how many systems each one touches
Access authorization checks	Internal security or HR staff	Recurring per maintenance event or staffing change	Whether escorted or unescorted access is common, and how often personnel change
Supervision design and competence records	Internal engineering and security leads	One-time design, recurring training records	Number of staff who must hold the authorizations and technical competence to supervise
Remote maintenance paths and their records	Internal platform engineering	One-time setup, recurring review	Number of remote maintenance paths, which overlap with 03.07.05 nonlocal maintenance
Evidence upkeep	Internal compliance staff	Recurring	Frequency of list reviews, contract and service-level agreement updates, and maintenance record volume
External review or testing	Independent assessor or testing firm	Periodic	Scope of the assessment, number of systems in the boundary, and whether the assessor interviews maintenance providers
Auditor or assessor sampling	Independent assessor or certification body	Per assessment cycle	Sample size the assessor selects from maintenance records and authorization lists; ask how sampling is set

Who owns 03.07.06, who can help, and where the auditor draws the line

The organization owns requirement 03.07.06 in full. Its leaders decide who may perform maintenance on systems that hold CUI, which outside organizations are approved, and who may supervise people who lack the required access authorizations. Those decisions are business and risk decisions, and no contractor or consultant can make them on the organization's behalf. The contracting federal agency also remains responsible for how NIST SP 800-171 is applied and for any compliance issues, regardless of the organization's size.

Authorization decisions: Named owners approve maintenance personnel and maintenance organizations before access is granted.
The authorized list: Someone in the organization maintains the list of authorized maintenance organizations and people and keeps it current.
Access verification: The organization confirms that unescorted maintenance staff hold the required access authorizations.
Supervision assignments: Designated staff with the right authorizations and technical competence are named to supervise anyone without them.
Contracts and service levels: Leaders sign the terms that govern outside maintenance providers.

Confirm that these owners are named in the system security plan and that someone can explain each decision to an assessor without help.

Where 03.07.06 implementations usually fall short

Most 03.07.06 failures are not missing policies. They are gaps between who actually touches systems and what the authorization records, supervision and visitor logs show. The cards below cover the places assessors usually find those gaps, with a closing action for each.

Vendor staff with access but no list entry

Remote and onsite vendor engineers often receive working accounts for emergency fixes that never make it into the authorized maintenance list. Under 03.07.06, the list of authorized maintenance organizations or personnel is the reference point an assessor compares against account and session records. Pull the last quarter of maintenance sessions and match every vendor identity to a list entry. Any account without a matching entry is a finding.

A maintenance list nobody reviews

A list that was accurate at go-live tends to drift as contracts end, engineers change employers and emergency access is granted and forgotten. The requirement expects the list to reflect current authorizations, so the owner should show when it was last reviewed and what changed. Ask for a dated review record and a named approver for each revision. Access certification tooling, such as midPoint campaigns, can prompt that review on a schedule.

Supervision without technically competent staff

Where uncleared or unescorted personnel perform maintenance, the organization must name people who hold the required access authorizations and the technical competence to supervise that work. Many programs name a manager who has never administered the system being maintained. Confirm that each supervisor is named in writing, has the required authorization, and can explain the platform's maintenance procedures without reading them off a page.

Physical visitors not linked to 03.10.01

Hardware vendors and field technicians often enter facilities through visitor processes that never reach the maintenance record. The Rev. 3 discussion of 03.07.06 points to 03.10.01 on physical access authorizations, so the two lists should agree. Compare the facility visitor log against maintenance tickets for the same dates. A technician who entered a server room but has no maintenance ticket, or the reverse, shows the two processes are not connected.

No records tying maintenance to individuals

Assessors test whether maintenance records show who performed the work, under whose authorization and with whose supervision. Shared vendor logins, generic service accounts and tickets that name only a company leave that chain broken. Require unique individual identities for maintenance sessions, and link each ticket to the authorization record and supervisor. Versioned documentation such as XWiki page history can show how maintenance procedures changed over time.

Questions buyers ask about 03.07.06 cost, effort and outside help

How much effort does 03.07.06 maintenance personnel take to implement?

The effort is mostly process and records work rather than new technology. The requirement needs a documented process for authorizing maintenance personnel, a current list of authorized maintenance organizations and people, a way to verify access authorizations for any maintenance staff who are not escorted, and named supervisors who hold the required authorizations and technical competence. The size of the effort depends on how many vendors and internal staff touch maintenance, how many systems in the CUI environment need maintenance, and whether those records already exist in some form. Ask any provider to break the estimate into policy, list, verification and supervision work, and to state which items your own staff must produce.

Can an in-house team implement 03.07.06 without an outside partner?

Yes, an in-house team can implement this requirement if it has someone who owns the maintenance process, access to HR and contract records, and the authority to stop an unauthorized vendor from working on CUI systems. Outside help is most useful where the team lacks experience writing assessment-ready evidence, or where maintenance is handled by many third parties with different contract terms. An implementation partner can prepare the list, procedures and supervision records, but the organization remains responsible for the control and for keeping the evidence current.

What does the organization need to provide for an outside engagement?

A fixed-scope engagement works best when the client supplies access and decisions up front. Typically this includes the system boundary and asset inventory, existing maintenance policies and vendor contracts or service-level agreements, the names of staff who maintain systems, copies of background or access authorization records as your rules allow, and a named owner who can approve the authorized list. Without these, the scope cannot be written precisely. Confirm each item in the written scope before work starts.

How long does a fixed-scope engagement for 03.07.06 take?

The duration is set by the written scope, which DeployOpen agrees with the client before work begins. The main variables are the number of maintenance organizations and people in scope, the number of systems in the CUI boundary, how mature the existing procedures are, and how quickly the client can review drafts and supply records. Most engagements are fixed-scope, so ask for the timeline, deliverables and client responsibilities to be stated in the same document. DeployOpen does not publish a price list, and a quote follows from that written scope.

Can DeployOpen certify that our systems meet 03.07.06?

No. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. For a DoD contract, the assessment is carried out by the government or by the authority named in the applicable process, and the score and results are the responsibility of the organization. Your independent assessor or certification body is the party that tests the control and reaches a conclusion. Confirm with your contracting officer which assessment applies before you plan the work.

What changes for 03.07.06 under Rev. 2 for DoD contracts?

Under Rev. 2, the equivalent requirement is 3.7.6, and CMMC Level 2 assesses it as MA.L2-3.7.6, worth 1 point under the 32 CFR 170.24 scoring methodology. The CMMC rule makes its Level 2 requirements identical to Rev. 2, so DoD contractors are assessed against the 110 Rev. 2 requirements. Rev. 3 also withdrew 3.7.2 and folded it into 03.07.06, so the wording and evidence for this area changed. DoD class deviation guidance signed in September 2026 names Rev. 2 explicitly, and a proposed FAR rule would move civilian contracts toward Rev. 3. Confirm which revision your contract cites before you build your evidence.

What do organization-defined parameters mean for 03.07.06?

Rev. 3 uses organization-defined parameters, which are values the organization or its federal customer must set to complete a requirement. NIST does not assign these values. For 03.07.06, the practical decision is how strictly your organization defines the authorization and verification process, and how often the authorized list is reviewed. If a federal agency does not specify the values, the nonfederal organization must assign them. The proposed FAR rule would have the DoW CIO publish values for contractors, so check whether those values exist for your contract before you write the procedure.

How DeployOpen prepares maintenance personnel controls for assessment

DeployOpen prepares the 03.07.06 controls in the client's own environment, and the first step is a written scope that names the systems, maintenance organizations and personnel categories in play. Before any workflow is built, the client decides who may perform maintenance, who approves each addition to the authorized list, and which people have the access authorizations needed to work unescorted. DeployOpen then builds the authorization workflow and the list of authorized maintenance organizations and individuals on the client's own infrastructure, so the records live where the assessor can examine them. The client owns these decisions and the policy behind them. DeployOpen's role is to configure, document and test the mechanics that carry them out.

On the evidence side, the work targets what SP 800-171A Rev. 3 asks an assessor to examine, interview and test. DeployOpen can help assemble maintenance policy and procedures, sample service provider contracts and service-level agreements, the list of authorized personnel, and maintenance records that show who worked on which system and under whose supervision. Where a self-hosted platform such as midPoint can run access certification campaigns, designated reviewers can periodically confirm, change or revoke maintenance access items within a set timeframe, which gives the assessor a dated record of the review. Document version history, such as the change tracking that XWiki provides for its pages, can show when the procedures changed and who approved each change. Confirm with your assessor which artifacts they expect in the format they prefer.

DeployOpen does not issue reports, attestations or certifications. Only an independent assessor, auditor or certification body can judge whether 03.07.06 is met, and the client should agree the evidence set with that party before the work starts. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work begins, and a quote follows from that written scope. To compare proposals, ask for the systems and maintenance populations covered, the deliverables for the authorization workflow and evidence pack, what the client must provide, and which items recur, such as access reviews and list updates, and therefore need ongoing support rather than a one-time build.

03.07.06 Maintenance personnel