MA-1 Policy and procedures
The system maintenance policy and procedures control: what the MA policy must address, who owns it, review and update cycles for policy and procedures, and the documents assessors examine.
MA Maintenance
The SP 800-53 Rev. 5 Maintenance family: maintenance policy, controlled and nonlocal maintenance, maintenance tools and personnel, timely and field maintenance, with baselines, assessment procedures and evidence for each control.
MA-2 Controlled maintenance
Controlled maintenance: scheduling and recording maintenance, approving and monitoring all on-site and remote work, approving off-site removal, sanitizing equipment before it leaves, rechecking controls afterward, and the maintenance records assessors sample.
MA-3 Maintenance tools
Maintenance tools: approving, controlling and monitoring the diagnostic and repair tools used on systems, periodic review of the approved tool list, and the tool inventory and approval evidence assessors check. Not in the low baseline.
MA-4 Nonlocal maintenance
Nonlocal (remote) maintenance and diagnostics over a network: approval and monitoring, permitted tools documented in the security plan, strong authentication, session records and terminating connections when work ends.
MA-5 Maintenance personnel
Who may perform maintenance: authorizing maintenance organizations and personnel, verifying the access authorizations of unescorted staff, and supervising those without authorization. Physical access for maintenance staff is handled separately under PE-2.
MA-6 Timely maintenance
Timely maintenance: identifying components whose failure raises risk and obtaining maintenance support or spare parts within a defined time, usually through support contracts, with preventive and predictive maintenance as enhancements.
MA-7 Field maintenance
Field maintenance on deployed systems or components: restricting or prohibiting maintenance at the operational site and limiting it to trusted maintenance facilities. No SP 800-53B baseline includes it.
