MA-1 Policy and procedures: requirements and evidence

What MA-1 policy and procedures requires before an assessment

An assessor or contract that requires SP 800-53 MA-1 is asking for two things that must exist together: a system maintenance policy and the procedures that put it into practice. The policy sets the intent for maintaining systems and must address purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. The procedures describe how those intentions are carried out day to day. Before an assessment, confirm that the policy is set at the level you have chosen (organization, mission or business process, or individual system) and that the document names that level explicitly, because an assessor will read the scope statement first. A policy that exists without matching procedures is the most common gap at this control.

The control also requires named ownership and a review cycle. Both the policy and the procedures must be disseminated to defined roles, managed by a designated official, and reviewed and updated at a frequency your organization defines, as well as after defined events. Those frequencies and events are organization-specific parameters, so the decision is yours to make and document. Check that each parameter has a value, that the value is written into the document itself, and that the revision history shows the review actually happened. The designated official should appear by role and name in the policy, and the owner of each procedure should be identifiable in the same way. Confirm the current parameter values with your authorizing official or assessor, since the catalog leaves them to you.

Baseline allocation is straightforward but easy to misread. SP 800-53B allocates MA-1 to the low, moderate and high baselines, so every system category that uses those baselines needs it. MA-1 is not part of the privacy baseline, which matters for privacy-only assessments. The control has four related controls in the Release 5.2.0 catalog (PM-9, PS-8, SI-2 and SI-12), and SP 800-53A assesses MA-1 through 17 determination statements using examine and interview methods. In practice, an assessor will examine the policy, the procedures and the organizational risk management strategy, then interview the personnel who carry out maintenance. Before the assessment, make sure those people can describe the procedures in their own words and point to the same version the assessor is reading.

Which systems, teams and documents MA-1 covers

MA-1 is written once but applies differently depending on where the organization sets the policy and which systems the chosen baseline reaches. The cards below cover the decisions that change the work, the teams and third parties that perform maintenance, and the related controls that assessors will expect to see connected to MA-1.

Policy level: organization, mission or system

MA-1 lets the organization set the maintenance policy at the organization, mission or business process, or system level. A single organization-wide policy is easier to keep current and to show to an assessor, but it must still be specific enough to govern each system. System-level policies suit a single high-impact system with unusual maintenance rules. Decide the level first, then write down why, because the assessor will ask how the chosen level reaches every system in scope.

Systems inside the chosen baseline

MA-1 is allocated to the low, moderate and high baselines in SP 800-53B, and it is not part of the privacy baseline. Confirm the impact level of each system before you map the policy to it. Systems in the privacy baseline only are outside MA-1 scope, but the same hardware or cloud accounts may host systems that are in scope, so inventory shared components as well as system boundaries.

Internal maintenance teams

List every internal group that performs or approves maintenance, including platform engineering, network operations, facilities, and the teams that patch hypervisors, storage arrays and self-hosted application servers. Assessors interview these personnel, so the policy must name their roles and responsibilities. Gaps usually appear where a team performs firmware or appliance work outside the usual change process.

Third parties and vendors

Vendors that perform remote support, warranty repair, or managed platform work bring maintenance into the policy even when no employee is involved. Identify each third party, the systems it touches, and the agreement that governs its access. Where a vendor maintains a self-hosted platform inside your environment, the policy must cover its sessions, tools and personnel, and it should align with the supply chain expectations in the SR family.

Policy and procedure owners

MA-1 requires a designated official to manage both the policy and the procedures. Record that owner's name and role, and separate the policy owner from the people who perform maintenance. Procedures usually sit with the operations team and are reviewed more often than the policy, so define the review frequency and the events, such as a major system change or a security incident, that trigger an update.

Related controls PM-9, PS-8, SI-2 and SI-12

The catalog lists PM-9 (risk management strategy), PS-8 (personnel sanctions), SI-2 (flaw remediation) and SI-12 (information management and retention) as related to MA-1. Check that the maintenance policy references the risk strategy, sanctions for violations, the timing of patches and the handling of maintenance records. Assessors will trace these links, so an MA-1 policy that ignores them tends to draw findings in the related families.

How an assessor tests MA-1

This table maps the SP 800-53A examine and interview methods for MA-1 to the artifacts an assessor requests, the questions they ask, and the findings that appear most often. Read it as a checklist for preparing the policy, the procedures and the people who run maintenance before an assessment begins.

Assessment element	What the assessor does	Evidence requested	Common findings
Maintenance policy	Examines the policy against the determination statements for purpose, scope, roles, management commitment, coordination and compliance	Current signed policy, its scope statement, named roles, and the level at which it is set (organization, mission or business process, or system)	Policy omits one of the required elements, or scope does not name the systems in the boundary
Maintenance procedures	Examines whether procedures implement the policy in enough detail for a maintainer to follow	Written procedures for scheduling, approving and recording maintenance, mapped to the policy sections they implement	Procedures are generic, or they describe a process that staff do not follow in practice
Review and update cadence	Checks that the organization defined a review frequency and triggering events, then checks that reviews happened on time	Version history, approval records, and the defined frequency and event list in the policy itself	Review dates are past due, or the policy never defines a frequency so the reviews cannot be measured
Dissemination	Confirms the policy and procedures reached the defined roles	Distribution list, acknowledgment records, and the location where staff retrieve current versions	Maintenance staff, including outside vendors, never received the current version
Designated official	Confirms a named official manages the policy and procedures	Document owner field, delegation records, and the official's current role	Owner has left the organization or changed roles, and no one has taken over the document
Organizational risk management strategy	Examines how maintenance policy connects to the organization's risk strategy	Risk management strategy or governance document referenced by the MA policy, and any risk decisions that set maintenance priorities	Policy cites a risk strategy that no longer exists or was never updated after the system changed
Interview with maintenance personnel	Asks staff with maintenance duties how they learned the policy and what they do when a situation is not covered	Interview notes, training or briefing records, and examples of work orders that follow the procedure	Staff describe practices that differ from the written procedure, or they do not know where the procedure is kept
Interview with policy owner	Asks the designated official how reviews are triggered and how changes reach the field	Review calendar, change log, and any record of events that prompted an out-of-cycle update	Owner cannot name the review trigger, so the update record does not show that events were acted on

Steps to write, approve and maintain the MA policy

This sequence turns MA-1 from a required document into an approved, disseminated and reviewed policy with matching procedures. Each step ends with a named output that an assessor can examine, so the policy stays traceable to the people who maintain systems.

Confirm the policy level and scope
Decide whether the maintenance policy will sit at the organization, mission or business process level, or at the system level, and list the systems, facilities and maintenance activities it covers. Check the scope against the system security and privacy plan and the baseline selected for each system, since MA-1 applies to the low, moderate and high baselines. The output is a short scope statement that names the level chosen and the systems in it, which becomes the first section of the draft.
Assign the designated official
Name one official who owns the policy and procedures, manages updates and answers assessor questions about them. Record the appointment in writing and confirm the official has authority over the maintenance teams, including internal staff and any external maintenance providers. Ask the organization to confirm this assignment with its CISO or equivalent, since the official will be interviewed. The output is a signed or minuted appointment that names the role and its backup.
Draft the policy statement
Write the policy to address purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. Assign each role by title rather than by individual name so the policy survives staff changes. Keep the language specific to maintenance on systems and their components, and cross-reference the MA-2 through MA-7 controls where the policy sets rules for those areas. The output is a complete draft policy that a reviewer can check line by line against the MA-1 determination statements.
Write procedures that implement the policy
Document the step-by-step procedures that carry out the policy, such as how maintenance requests are raised, approved, logged and closed, and who performs each action. Link each procedure to the policy statement it implements so an assessor can trace policy to practice. Involve the teams that actually perform maintenance so the procedures match real workflows. The output is a procedures document with a clear owner, version and a mapping to the policy sections it supports.
Set review frequency and event triggers
Define how often the policy and procedures are reviewed and updated, and list the events that force an earlier review, such as a significant system change, a security incident involving maintenance, or a change in applicable law or organizational structure. Ask the organization to confirm the cycle with its governance body, because the frequency is an organizational decision that the control leaves to the defined parameter. The output is a review schedule and trigger list recorded in the policy itself.
Obtain approval and record it
Route the policy and procedures to the senior official who has authority to approve them, and record the approval with the date, approver and version number. Keep the approval record with the policy so it can be produced on request. Confirm that the approved version is the only one in circulation before dissemination begins. The output is an approved, versioned policy with a dated approval record and a change history.
Disseminate to defined roles
Distribute the approved policy and procedures to every role the policy names, including maintenance staff, system owners, and any external maintenance organizations under contract. Record who received the documents and when, and make the current version easy to find for anyone who needs it. Ask the designated official to confirm acknowledgment from each defined role, since assessors commonly interview personnel with maintenance responsibilities about whether they know the policy. The output is a distribution record and acknowledgment list.
Maintain version control and reviews
Keep every revision under version control so the organization can show what changed, when and why, and can restore an earlier version if needed. Run each scheduled or triggered review, record its outcome even when no change is made, and reissue the approved version after any update. Repeat the approval and dissemination steps for material changes. The output is a current version, a revision history and a review log that together show the policy was kept up to date.

Evidence that passes an MA-1 assessment

MA-1 is tested on documents first. An assessor reads the maintenance policy and procedures, then checks that they were disseminated, owned and reviewed on schedule. The cards below cover the artifacts that carry those answers and how to keep each one current between assessments.

Approved maintenance policy

The policy should state its purpose, scope, roles, responsibilities, management commitment, coordination among entities and compliance expectations. Confirm it is approved by a named senior official and that it is set at the organization, mission or system level the assessment covers. Store it in version control so the approved text, approver and approval date are visible for each release.

Maintenance procedures

Procedures turn the policy into steps staff can follow, such as how maintenance is requested, approved, scheduled and closed. Assessors compare them with the policy to find gaps, for example a policy that requires approval but procedures with no approval step. Map each procedure to the MA controls it implements so the link is easy to show during an interview.

Designated official record

MA-1 requires the organization to name the official who manages the policy and procedures. Keep a signed or system-recorded designation that states the official's role and authority. Confirm the record is current after staff changes, because an assessor will ask who answers for the document and will check whether that person actually holds the role.

Dissemination records

Evidence that the policy and procedures reached the defined roles is often weaker than the documents themselves. Keep distribution lists, acknowledgment logs or access records showing which personnel with maintenance responsibilities received each version. Check that the recipient list matches the roles defined in the policy, including contractors who perform maintenance.

Review and revision history

Record each review against the frequency and triggering events the organization defined, along with the reviewer, the outcome and any changes made. Gaps between the defined cycle and the recorded reviews are a common finding. Keep the history in the document itself so an assessor can compare any two versions and confirm that each change was approved.

Link to risk management strategy

Assessors examine the organizational risk management strategy alongside the maintenance policy, so the policy should trace back to it. Keep a short cross-reference that shows which strategy statements drive maintenance requirements, and update it when the strategy changes. Confirm the link during the annual review so the two documents do not drift apart.

Where MA-1 documents live: wiki, repository or document system

A wiki is a natural home for an MA-1 policy when the document changes often and assessors need to see how it changed over time. The policy and procedures are the controlled documents, so the platform must show who edited them and what they said before. XWiki, a free and open-source wiki licensed under LGPL-2.1-or-later, keeps every change to a page under version control, so the history records what changed, when and by whom.

Change history: Each revision records the change, the date and the editor, which gives an assessor a dated trail for the review and update cycle.
Compare any two versions: Reviewers can see exactly which maintenance steps, roles or review intervals were altered between the last approved version and the current draft.
Rollback: A bad edit can be reverted to an earlier version, but the reverted state should still be recorded as a change so the history stays complete.
Approval workflow: Version history shows edits, not approvals. Record approval, such as a signed sign-off or an approval page, separately and link it from the policy.
Self-hosting: Running the wiki inside the organization's own environment keeps the policy and its history under its own control.

Confirm with the vendor or your own test instance that the current release provides the history, comparison and rollback behavior you plan to rely on, and confirm how exports are retained for assessment.

What meeting MA-1 costs in money and effort

Meeting MA-1 is mostly a matter of staff time, not software. The cost sits in drafting a system maintenance policy, writing the procedures that put it into practice, getting the right people to approve both, and keeping them current. NIST does not estimate compliance costs for SP 800-53, so no figure appears here. Confirm the numbers with your own staff, your legal and security reviewers and any outside party you hire. The largest one-time items are usually the policy drafting by the security or compliance function, the procedure writing by the people who actually perform maintenance on servers, network devices, facility systems and vendor-managed equipment, and the review cycle that follows. Maintenance owners are often the most expensive hours because their time is taken from operations.

Recurring cost comes from the review and update cycle MA-1 requires. Your organization sets the review frequency and the events that trigger an update, and both should be written into the policy itself. Each scheduled review consumes time from the designated official, from the maintenance owners whose procedures may have changed, and from any legal or privacy reviewer whose sign-off you require. Costs rise with the number of systems and maintenance providers covered, the number of separate policies at mission, business process or system level, the number of approval layers, and how often your environment changes. They fall when one policy sets the common rules and system-level procedures are kept short and point back to it. Keeping the policy in a version-controlled wiki reduces the effort of showing what changed and when.

When you request a quote for MA-1 work, ask the provider to state in writing which deliverables are included: a drafted policy, a set of procedures, a review of your existing documents against the MA-1 determination statements in SP 800-53A, a stakeholder interview plan, and a reviewer sign-off step. Ask who performs each task, how many review rounds are included, whether ongoing reviews are priced separately, and what you must supply, such as current maintenance contracts and interview availability. An independent assessor's fees for examining these documents are separate from preparation work and are set by that assessor. For an implementation partner, DeployOpen works from a written scope agreed before work starts, so the quote follows from the deliverables you define.

Open-source platforms that hold MA-1 documents

This table compares two self-hosted open-source documentation platforms that teams commonly use to hold maintenance policy and procedures. It shows the evidence each produces for an assessor, such as version history and role-based access records, and the license point to check before deployment. Confirm every feature against your own deployment, because the facts available describe the platforms only at the level of their documented capabilities.

Capability	XWiki (LGPL-2.1-or-later)	BookStack (MIT)
License	LGPL-2.1-or-later. Confirm with counsel what the license requires if you modify or redistribute the software.	MIT. Permissive license with no copyleft obligations for internal use.
Version history for MA-1 documents	Every change is kept under version control, recording what changed, when and by whom. Assessors can compare any two versions.	Confirm in your deployment how page revisions are retained and whether they meet your retention requirements for policy history.
Rollback to an earlier policy version	Users can roll back to any earlier version, which supports showing the approved text in force on a given date.	Confirm whether revisions can be restored and whether restoration is logged for audit review.
Role-based access records	Confirm which access and edit actions are logged and how that log is exported for review.	User abilities come from assigned roles, with permissions overridable per role at shelf, book, chapter or page level.
Restricting who can approve or edit policy	Confirm how page-level rights and approval workflows are configured for policy owners.	Permissions can be set per shelf, book or page, so the maintenance policy can be limited to designated owners.
Evidence for review and update cycles	Version history shows review edits, but the review schedule and sign-off must be recorded separately.	Page history shows edits, but the review schedule and sign-off must be recorded separately.
Suitable for policy that is reviewed on a schedule	Yes, when version history and page rights are configured and tested.	Yes, when roles and page permissions are configured and tested.

Who owns the MA policy, who prepares evidence and who assesses it

Your organization owns MA-1. Management must set the maintenance policy and the procedures that implement it, designate an official to manage both, and approve them. The policy has to state purpose, scope, roles, responsibilities, management commitment, coordination among entities and compliance expectations, so the people who carry the accountability need to be named in the document itself, not inferred from an org chart.

Policy approval: A senior owner, usually the CISO or the head of IT operations, approves the policy and records management commitment.
Designated official: One named role manages the policy and procedures, tracks review dates and triggers updates after defined events.
Procedure ownership: Platform and facilities leads own the procedures that carry out maintenance work, since they know the actual tasks.
Review schedule: Your team sets the review frequency and the events that force an update, such as a change in system boundary or a significant incident.
Dissemination: Your team distributes the approved documents to the defined roles and keeps proof of distribution.

Before an assessment, confirm that the defined review frequency in your policy matches what your records actually show.

Common MA-1 gaps and how to close them

Assessors rarely fail MA-1 for lacking a document. They fail it when the policy and procedures are unclear, unowned, out of date, or disconnected from how maintenance actually happens. The six gaps below are the ones that most often surface when an assessor compares the documents against the examine and interview methods in SP 800-53A.

Policy and procedures merged

Many organizations keep one document that mixes high-level intent with step-by-step tasks. MA-1 asks for a policy and for procedures that implement it, and these change at different rates. Split them into a policy that states purpose, scope, roles and commitment, and a procedure set that tells technicians how to schedule, record and close maintenance. Check that each procedure traces back to a statement in the policy.

No named designated official

A policy that says the security team owns it leaves no one accountable when a review is missed. MA-1 expects a designated official to manage the policy and procedures. Record one named role, with a deputy, in the policy itself and in the document control metadata. Confirm that the person knows they own the review cycle and the dissemination list.

Review dates missed or undefined

Policies often state that they are reviewed annually but carry no next review date, or the date has passed without a change record. MA-1 requires review and update at a defined frequency and after defined events, such as a major system change or a security incident. Write both triggers into the document, calendar the reviews, and keep the approval history so an assessor can see each cycle was completed.

Procedures that differ from practice

Assessors compare written procedures with what technicians do. A procedure that requires a ticket for every maintenance action will fail if the team handles urgent work by phone and records it later. Walk through two or three recent maintenance events with the people who performed them, then update either the procedure or the practice. Record the reason for any deliberate difference.

No dissemination record

A current policy has limited value if the personnel who perform maintenance never received it. MA-1 requires the policy and procedures to be disseminated to defined roles. Keep a distribution list tied to roles, record acknowledgments with dates, and track who joined or changed role since the last version. Confirm that contractors and outside maintenance staff receive the parts that apply to them.

No link to risk strategy

Maintenance policy that ignores the organizational risk management strategy is hard to defend. The SP 800-53A procedure for MA-1 asks assessors to examine the risk management strategy alongside the policy. State how maintenance priorities follow identified risk, reference the risk strategy and risk assessment by name, and confirm that the owner of each reference can explain the connection during an interview.

How much work is MA-1, and can we do it ourselves?

Can our own team write an MA-1 policy without an outside partner?

Yes. The organization owns its controls, and nothing in MA-1 requires an outside firm to write the policy. Internal staff who know the maintenance workflows can draft it, define the procedures and gather the approvals. A partner is most useful when the team has little experience writing security policy, when several systems need consistent documentation, or when the internal team lacks time. The policy must address purpose, scope, roles, responsibilities, management commitment, coordination and compliance, and the procedures must put it into practice. An independent assessor will test the result but will not write it for you. Confirm the expected format and depth with your assessor before drafting starts.

How long does it take to write and approve an MA-1 policy?

The duration depends on scope, so no fixed number applies. The main drivers are how many systems and maintenance providers the policy covers, whether the policy is set at organization, mission or business process, or system level, how many documents already exist, and how many approvers must sign off. Teams that already have a maintenance procedure and a policy template usually finish faster than teams starting from nothing. If you engage a partner, ask for the timeline in the written scope, with each deliverable, review round and approval step listed. Treat any duration quoted without a stated scope as an assumption, and check it against your own approval calendar.

What does MA-1 need from maintenance and security staff?

The policy is only accurate if both groups contribute specific facts. Maintenance staff should describe what they actually do today:

the systems, components and vendors they service, and where the work happens
the diagnostic and repair tools they use, and who approves them
how remote sessions are started, authenticated and ended
the records they keep when work is performed

Security staff should align the policy with the organization's risk management strategy, set the rules that the MA-2 through MA-7 controls will rely on, and confirm how maintenance connects to incident response and vulnerability work. Management must state its commitment, and the designated official must own the document. Interviews with maintenance personnel are part of the assessment, so the written policy should match what those people describe.

How often must the MA policy and procedures be reviewed?

MA-1 requires the organization to define the review frequency and the events that trigger an update, then follow its own definition. The assessor tests the values you set, so they should be written into the policy and be achievable. A common pattern is a scheduled review plus event triggers, such as a new maintenance tool, a change in remote access, a major incident, a change in the maintenance provider, or a change in staff responsibilities. NIST's Release 5.2.0 updated all of the -1 policy controls, so a review should also check the current release against your document. Keep a dated record of each review, including reviewers and any changes made.

Can one maintenance policy cover several systems?

Yes. MA-1 allows the policy to be set at the organization, mission or business process, or system level. A single organization-level policy with system-specific procedures is a common approach because it keeps governance consistent while letting each procedure reflect its own boundary, maintenance providers and remote paths. Be cautious about stretching one policy across systems with very different maintenance models, such as an on-premises data center and an air-gapped network. In that case, use shared policy language with separate procedures. Keep a register that shows which systems fall under which procedure, because assessors will ask how coverage was determined.

What will an assessor ask for first on MA-1?

Assessors start with documents and people. Under the SP 800-53A assessment procedure for MA-1, the examine method covers the maintenance policy and procedures and the organizational risk management strategy. The interview method covers personnel with maintenance responsibilities. Expect requests for the current policy with its version and approval date, the procedures, evidence that both were disseminated to defined roles, the name of the designated official, review records and proof that the policy matches actual practice. The procedure contains 17 determination statements, so each element of the policy needs a traceable home. Read the SP 800-53A Rev. 5 publication before the assessment begins.

What does outsourcing MA-1 cost, and what recurs after the first version?

Costs fall into one-time and recurring groups. One-time work includes gap analysis, drafting, review, approvals and initial dissemination. Recurring work includes scheduled reviews, updates after trigger events, re-dissemination to staff and keeping review records. The main cost drivers are the number of systems, the number of maintenance providers, the state of existing documentation and the number of approval layers. Partner fees follow a written scope, and DeployOpen does not publish a price list, so ask for a quote that lists each deliverable and review round. Keep the independent assessment separate in your budget, since an assessor is paid for testing, not for writing the policy. NIST does not estimate compliance costs, so any figure should come from a quote.

How DeployOpen prepares MA-1 policy and evidence

DeployOpen works on MA-1 as part of the wider maintenance program that your organization owns and approves. We prepare the policy, procedures and document set that an assessor will examine, deployed on self-hosted open-source tooling inside your own infrastructure. Independent auditors and assessors issue any findings or reports.

How we scope

Agree in writing which systems, business processes and maintenance roles the MA-1 policy and procedures will cover.
Confirm the policy level (organization, mission or business process, or system) and the owner who will manage the policy.
Record the review frequency and triggering events you set for the policy and procedures, and confirm them with your own governance.

How we build

Draft a maintenance policy addressing purpose, scope, roles, management commitment, coordination and compliance for your review.
Write procedures that show how maintenance staff implement the policy, and link them to the MA-2 through MA-7 records.
Set up document control so every version, change and approval is recorded, using self-hosted wiki or documentation tools in your environment.

How we hand over

Deliver the approved policy, procedures, revision history and dissemination records as one document set in your repository.
Provide a mapping from each MA-1 determination statement to the document or record that answers it, so assessors can trace evidence quickly.
Walk your designated official and maintenance leads through the document set, and confirm who reviews and updates it going forward.

How we support

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
Ongoing policy review, document updates and assessment support are available as a retainer, with the terms set in your contract.
Ask any partner to confirm which steps are performed by your staff, which by DeployOpen, and which by your independent assessor.