MA-2 Controlled maintenance: requirements and evidence

What MA-2 controlled maintenance asks for and where assessors look

When an assessor or contract asks for MA-2 evidence and the team's maintenance history lives in email threads and memory, the gap is usually in the records, not the work. MA-2 Controlled maintenance requires that maintenance, repair and replacement of system components be scheduled, documented and reviewed against vendor or organizational requirements, that every maintenance activity be approved and monitored, that off-site removal of equipment be explicitly approved, that equipment be sanitized of defined information before it leaves the facility, that affected security controls be checked after maintenance, and that maintenance records contain defined information. The risk it addresses is simple: unapproved or unrecorded work can change a system's configuration or security state without anyone knowing, and hardware can leave the building carrying data nobody accounted for. MA-2 sits in the Maintenance (MA) family and is allocated to the low, moderate and high security control baselines in SP 800-53B. It is not part of the privacy baseline.

Meeting MA-2 starts with decisions the organization must make and write down. Set the maintenance schedule and the review cycle for it, define who approves each type of work (on-site, remote, vendor-performed, and off-site removal), list the sanitization steps and the information they must remove, and name the fields every maintenance record must carry, such as date, component, performer, reason, approval reference, controls checked afterward and sanitization outcome. Then confirm that those definitions match what the vendor requires. The difficulty is that the evidence is scattered: ticket queues hold some approvals, vendor portals hold service reports, facilities logs record visits and asset tools hold disposal status. An assessor will sample individual maintenance events and expect to trace each one from approval to post-work check. Before any assessment, pick a sample of recent events and try that trace yourself. Confirm the specific schedule and sanitization requirements with your system owner and your vendors, since those are organizational and contractual choices rather than values this page can supply.

Because MA-2 is assessed by examining procedures, interviewing the people who sanitize media, and testing whether the maintenance process actually runs, the most persuasive evidence is a complete, consistent record set rather than a policy alone. Assessment procedures in SP 800-53A Rev. 5 point assessors toward manufacturer maintenance specifications and the organization's own controlled maintenance procedures, so keep those documents current and linked to the records they govern. The later sections of this page explain how a ticketing or inventory system can hold these records. For the assessment method itself, the NIST CPRT catalog entry for MA-02 is the natural next read.

Which maintenance events and systems fall under MA-2

MA-2 applies to every maintenance, repair and replacement activity on the system, whoever performs it and wherever it happens. The cards below cover the scoping decisions that change how much work MA-2 creates, and who in the organization makes each one.

On-site versus remote maintenance

Any work performed at the facility, and any work performed over a network connection, is maintenance that MA-2 covers. Remote sessions carry the same approval, monitoring and record duties as on-site visits, and they usually also fall under MA-4. The system owner decides which activities may be performed remotely, and the security plan should say so. Check whether vendor remote access tools and jump hosts appear in the maintenance log as well as in the access logs.

Vendor-performed versus internal work

Work done by a hardware vendor, a managed service provider or a contractor is still maintenance on your system and needs the same approvals and records as internal work. The organization approves the work order, reviews the vendor's maintenance specifications and confirms the results. Ask each vendor for its maintenance procedures and sign-off process before the first visit, and keep them with the system's maintenance records.

Hardware and media leaving the facility

Repair returns, warranty swaps and drives sent to a third party for recovery all leave the controlled environment. MA-2 requires explicit approval for this off-site removal and sanitization of defined information before the equipment goes. The organization defines which information must be sanitized, and the security plan should record that definition along with the approved sanitization method. Confirm which items in your asset inventory are capable of holding stored data.

Cloud and managed components you do not own

When a cloud provider or managed service runs the hardware, the provider performs most maintenance, but the organization still needs to know what the provider does and how it notifies you. Your scope covers the maintenance that touches your data, configuration or tenant, and any change the provider makes that affects your system. Review the provider's shared responsibility documentation and its contract terms to decide which maintenance events you receive records for and which you inherit from the provider's own assessment.

Organization-defined maintenance types and information

MA-2 leaves the list of maintenance types and the information to be sanitized to the organization. Each system owner decides which activities count as maintenance for that system, such as firmware updates, component replacement or diagnostic runs, and which data classes must be cleared before media leaves. Record these definitions in the system security plan so that an assessor can compare the recorded scope with the maintenance records you produce.

Where MA-2 ends and MA-1, MA-4 and MA-7 begin

MA-2 is the maintenance lifecycle record: what work was scheduled, who approved it, how it was monitored, what left the facility, how media was sanitized, and whether the affected controls were rechecked afterward. It is not the policy that governs maintenance, not the remote session control, and not the field maintenance restriction. An organization that files one binder of maintenance tickets and assumes it covers the whole MA family will fail the neighboring controls. Before you start collecting evidence, write down which control each artifact supports.

MA-1 covers the maintenance policy and procedures themselves. Its evidence is the approved document, its owner, and its review cycle, which an assessor examines as a document rather than as a log of events. MA-4 covers nonlocal maintenance over a network, so its evidence is the approved remote tools, the strong authentication used, the session records, and the termination of connections when work ends. MA-7 restricts field maintenance on deployed components and limits repair to trusted facilities. A remote vendor session logged under MA-4 can still appear as a maintenance record under MA-2, so the same event may need entries in both places, cross-referenced rather than duplicated.

The catalog ties MA-2 to CM-2, CM-3, CM-4, CM-5, CM-8, MA-4, MP-6, PE-16, SI-2, SR-3, SR-4 and SR-11. Two links deserve particular attention. MP-6 governs media sanitization, so the sanitization step in MA-2 should point to the sanitization records and the equipment inventory maintained under that control. PE-16 governs the delivery and removal of system components, so the off-site removal approval in MA-2 should match the physical movement records. Confirm with your own control owners how these records are produced and where they are stored, because MA-2 assessors frequently sample across these boundaries.

How an assessor tests MA-2 under SP 800-53A

The table compares the three SP 800-53A assessment methods applied to MA-2, showing what each asks for, the evidence requested and where organizations usually fall short. SP 800-53A gives 9 determination statements for MA-2, and the test method relies on sampled maintenance records, so a single incomplete entry for a sampled event is a common reason for a finding.

Method	What the assessor asks for	Evidence requested	Common findings
Examine	Controlled maintenance procedures and the manufacturer or vendor maintenance specifications for each system in scope	Written maintenance procedure, vendor maintenance specifications, schedule of planned maintenance, and evidence of who reviews the procedure	Procedure exists but does not address off-site removal, sanitization or post-maintenance control checks; vendor specifications are not on file
Interview	Personnel responsible for media sanitization, asked how equipment is cleared before it leaves the facility for repair or replacement	Named owner for sanitization, the sanitization method used for each media type, and records of the last sanitization performed	Staff describe a sanitization step that the written procedure does not require, or cannot name who signs off the sanitization
Test: scheduling	Whether maintenance, repair and replacement are scheduled and reviewed against vendor or organizational requirements	Maintenance calendar, change tickets linked to scheduled work, and records of periodic review against vendor guidance	Work performed with no scheduled entry, or a schedule that was never reviewed after a vendor advisory
Test: approval and monitoring	Whether all maintenance, including remote sessions and on-site vendor visits, was approved and monitored	Approval record before each sampled event, monitoring notes or session logs, and the named approver	Approval recorded after the work began, or remote sessions with no monitoring record
Test: off-site removal	Whether equipment removed for repair was explicitly approved and sanitized of defined information before leaving	Removal approval, sanitization record and chain of custody for each sampled removal	Approval missing for the removal, or sanitization record that does not name the information types cleared
Test: documenting and post-maintenance checks	Whether each sampled event has the defined information recorded and affected controls were rechecked afterward	Maintenance record with date, personnel, description, tools, and the control check performed after the work	Entries missing the person performing the work, the tools used or the post-maintenance check; records completed days after the event

How to implement MA-2 in a sequence that produces assessable records

This sequence turns MA-2 from a policy statement into a working cycle of scheduled, approved, monitored and verified maintenance, where each event leaves a record an assessor can sample. Each step produces a named artifact, and the last steps prove the process works before the control owner signs off.

Define maintenance types and record content
Start by listing every kind of maintenance, repair and replacement performed on in-scope systems, including vendor work, internal work, hardware swaps and firmware updates. For each type, define the fields its record must hold: asset identifier, date and time, who performed the work, the reason, the vendor or maintenance specification followed, the approval reference, the information sanitized or verified, and the checks performed afterward. The output is a maintenance record standard that the control owner approves. It is done when a blank record template covers every maintenance type on the inventory without gaps.
Set approval rules for on-site, remote and off-site work
Write an approval matrix that states who authorizes each category of work: on-site maintenance by staff or vendors, remote sessions, and removal of equipment from the facility. Each row names the approver, the conditions that trigger extra review, and the evidence required before work starts. Off-site removal needs an explicit approval entry that is separate from routine maintenance approval. The output is an approved matrix. It is done when every system in scope maps to at least one approval path and the matrix references the nonlocal maintenance and maintenance personnel rules that apply.
Define sanitization methods by media type
Equipment leaving the facility must be sanitized of defined information, so list each media type the organization uses, such as hard drives, solid-state drives, removable media, memory modules, network devices and printers, and assign a sanitization method and verification step to each. Confirm the method against the organization's media protection policy and the manufacturer's guidance. The personnel responsible for sanitization should sign off the standard. The output is a sanitization standard with a verification record format. It is done when each media type has a method, a verifier and a place in the maintenance record where its completion is logged.
Build the post-maintenance check list per control
Maintenance can change the security posture of a system, so for each control that the maintenance could affect, write a short check that confirms it still works after the work. Typical examples include confirming that logging still runs after a server rebuild, that encryption settings still apply after a controller swap, and that access restrictions still hold after a network device change. Link each check to the control it verifies so that an assessor can trace it. The output is a check list keyed to control identifiers. It is done when the control owner has reviewed each check and agreed which ones apply to which asset class.
Configure the system of record for tickets and inventory
Choose one system where maintenance requests, approvals, work notes and closure evidence are kept, and link each ticket to the asset record in the inventory. Open-source options such as GLPI, Zammad and Zabbix host inventory can handle parts of this, but confirm each product's current capabilities in your environment before you rely on them for a specific field. Configure ticket categories that match the maintenance types, required fields that match the record standard, and an approval step that cannot be skipped. Test that closed tickets cannot be edited without a logged reason. The output is a configured workflow and an inventory that shows the asset, owner and location. It is done when a test ticket carries every field from the record standard.
Run one real maintenance event end to end
Select one scheduled maintenance event, preferably one that involves removal of a component, and run it through the full cycle: request, approval, scheduling, execution, sanitization if equipment leaves, post-maintenance checks, and closure. Capture the evidence at each point, including the approval timestamp, the vendor specification referenced, the sanitization verification and the completed checks. Note any step that was slow, unclear or skipped. The output is a completed sample record and a short list of gaps. It is done when an independent reviewer can trace the event from request to closure using only the record.
Review the records with the control owner
Walk the control owner through the completed sample record and the gap list, then sample several other maintenance tickets to test whether the process held. Check for missing approvals, unverified sanitization, checks that were not performed and records that lack the defined fields. Assign corrections, update the standard or matrix where the process proved unworkable, and record the decision. The output is a signed review record and an updated maintenance procedure. It is done when the control owner accepts the records as the evidence the organization will present, and the review date and reviewer are recorded. Independent auditors or assessors then test the records; the organization and its implementation partner prepare them but do not issue any assessment result.

Which maintenance records pass an assessor's sample

An assessor testing MA-2 Controlled maintenance samples individual maintenance events and checks that each one traces back to a schedule, an approval, a monitoring trail and a post-work check. The cards below cover the records that usually carry that chain, what a passing version contains, and how to keep each one current between audits. Confirm with your auditor which records they expect to sample and in what form.

Maintenance schedule and vendor specifications

The schedule shows which components receive maintenance, when, and under which vendor or internal requirement. A passing schedule names each system, the maintenance interval, the vendor specification it follows, and the owner who reviews it. Assessors compare sampled events against this schedule, so unexplained gaps or work outside it raise questions. Review the schedule at a fixed cadence, record each change with a reason, and keep the vendor documents it cites on file with their version dates.

Maintenance ticket with approval and actor

Each maintenance event needs a ticket that records the request, the approver, the technician who performed the work, the start and end times, and the systems affected. A passing ticket shows approval before work began, not a retroactive sign-off. Helpdesk and change tools such as GLPI can hold these tickets with planning and status history. Check that closed tickets cannot be edited without a logged reason, since assessors sample closed records first.

Monitoring record for remote or vendor work

Work performed remotely or by a vendor needs a monitoring record that shows who was watching, what was done, and when the session ended. A passing record links the ticket to session logs, the person who monitored the work, and confirmation that access was closed afterward. Without this link, the approval alone does not show that the work stayed within scope. Confirm with your auditor how they expect session evidence to be presented, including whether they want the monitor's identity captured separately.

Off-site removal approval

When equipment leaves the facility for repair, the removal needs its own written approval naming the item, its serial number, the destination, the expected return date and the approver. A passing approval exists before the item moves and is closed when the item returns. Assessors check that removals match the maintenance tickets they relate to. Keep asset identifiers consistent between the removal form and the inventory record so the chain can be followed in both directions.

Sanitization certificate or log

Before equipment leaves, the defined information must be removed, and the removal must be recorded. A passing record names the device, the sanitization method, the person who performed it, the verification step, and the date. Where a vendor performs the work, keep the vendor's signed certificate with the ticket. The sanitization record must match the device identity in the removal approval, so confirm which information types your organization has defined as in scope before the first sample is drawn.

Post-maintenance control check results

After maintenance, the controls that the work could have affected must be checked again. A passing check record lists the controls reviewed, the test performed, the result, and the person who signed off. For example, an illustrative firmware update to a network device would be followed by a check of configuration settings and logging, with the outcome attached to the same ticket. Keep the list of affected controls current, since an incomplete list is a common finding.

Review of maintenance records

Records must be reviewed on a defined cycle to catch missing approvals, open tickets and unexplained work. A passing review record shows the reviewer, the period covered, the sample checked, and any exceptions with their follow-up. Assessors often ask for the most recent review first. Set the review cadence in your policy, keep a dated log of each review, and track exceptions to closure so the review itself shows that problems were acted on.

What meeting MA-2 costs in money and effort

This table compares the cost components of running MA-2 controlled maintenance, who is paid for each, whether it is one-time or recurring, and what drives it up or down. Use it to structure a request for a written scope and quote, since NIST does not estimate compliance costs and no figures are supplied here.

Cost component	One-time or recurring, and who pays	What drives it up	How to keep it down
Ticketing or maintenance tooling licenses	Recurring for commercial tools; open-source tools such as GLPI or Zammad carry no license fee but need hosting and administration	Number of sites, users and approval workflows; add-on modules or vendor support tiers	Choose a self-hosted tool that already records maintenance requests, approvals and closure; confirm each tool's ITIL or change workflow fits your approval steps
Engineering time to define rules and configure records	One-time for workflow design and record templates; the organization or its implementation partner is paid for the work	Multiple maintenance types, many system owners, and unclear ownership of approval roles	Define one maintenance record template and approval matrix before configuring tools; agree the fixed scope and deliverables in writing
Sanitization tooling and handling	Tools are one-time or recurring depending on purchase; staff handling is recurring with each off-site removal	Volume of equipment leaving the facility, media types, and need for verified sanitization records	Limit off-site removal to documented cases, standardize sanitization methods, and keep sanitization evidence in the same record as the removal approval
Vendor support contracts that generate maintenance documentation	Recurring, paid to the vendor; the vendor or your procurement team owns the contract terms	Number of covered components, response expectations, and whether vendor reports are delivered in a usable format	Ask vendors during procurement for maintenance reports that include dates, technicians and work performed, and align contract terms with your record fields
Evidence upkeep	Recurring; internal staff time to keep records complete, reviewed and retrievable	Frequency of maintenance events, manual data entry, and records split across tools	Automate record capture where possible, such as inventory data from Zabbix host inventory or Wazuh Syscollector, and run periodic completeness checks
External review of the procedures	Periodic, paid to an independent reviewer or consultant when used; the organization decides whether to engage one	Procedure complexity, number of systems in scope, and gaps found in earlier reviews	Review the procedure internally against the assessment objectives first, then bring in outside help for a focused check rather than a full rewrite
Auditor sampling time	Recurring with each assessment, paid to the independent assessor; the organization supplies records	Number of maintenance events, record quality, and missing approvals or sanitization evidence	Keep records retrievable by system and date, so sampled items can be produced quickly; confirm the sample approach with the assessor in advance

Which self-hosted open-source tools can hold MA-2 records

MA-2 evidence is mostly records: what was scheduled, who approved it, what left the facility and what was checked afterward. The tools below can hold parts of that trail, but none of them performs sanitization or enforces an approval policy by itself, so the control still depends on the procedures your organization defines and the assessor's sampling of the records.

GLPI maintenance tickets and changes

GLPI's Assistance module, licensed under GPL-3.0-or-later, lets teams open tickets, follow them through processing and plan changes using ITIL practices. For MA-2, a ticket can hold the scheduled maintenance window, the vendor requirement it responds to, the approver, the work performed and the post-maintenance check. Confirm in your version that approval steps, mandatory fields and closure rules are configured so that records cannot close without the defined information. GLPI does not sanitize media or decide what must be approved; those rules come from your maintenance policy.

Zammad consolidated request intake

Zammad, licensed under AGPL-3.0-only, is a web-based helpdesk that gathers requests from email, chat, telephone and social media into one ticket system. For MA-2, this helps keep maintenance requests that arrive by email or phone in the same record as the approval and the completed work, so an assessor can trace one request end to end. It does not itself schedule maintenance, approve off-site removal or verify sanitization. Confirm that the channels you use feed into tickets with the required fields, and check the AGPL obligations if you modify the software and offer it to users over a network.

Wazuh Syscollector inventory comparison

The Wazuh Syscollector module, part of Wazuh under GPL-2.0-only, collects hardware, operating system, installed software, network interfaces, open ports, services, users and groups from each endpoint into the Wazuh indexer. For MA-2, snapshots taken before and after maintenance give evidence of what changed, which supports the step that checks affected controls afterward. Syscollector shows what changed on the host, not whether the change was approved, so pair it with the maintenance ticket. Confirm collection frequency and retention in your deployment before relying on it as evidence.

Zabbix host inventory fields

Zabbix, licensed under AGPL-3.0-only, stores host inventory such as device type, serial number, location and responsible person, entered manually or filled from agent data on hardware, operating system and installed packages. For MA-2, these fields tie each maintained asset to a serial number and a responsible owner, which lets records identify exactly which equipment left a facility or was serviced. Inventory is only as accurate as its entries, so assign an owner to keep location and serial fields current. Zabbix does not track approvals, sanitization certificates or post-maintenance checks.

Who owns MA-2, who can help, and where the auditor stops

Your organization owns MA-2 in full. Your people decide what maintenance is needed, approve each job, decide whether equipment may leave the facility, and confirm that sanitization and control checks were done. The records that come out of those decisions are your records, and an assessor will test whether your staff followed the process they describe. No implementation partner can perform these decisions on your behalf without creating a gap in accountability.

Maintenance policy inputs: Define the maintenance schedule basis, including vendor specifications and your own requirements, and the review cycle for both.
Approvals and monitoring: Name the people who approve on-site, remote and off-site maintenance, and who monitors work while it runs.
Sanitization decisions: Decide which information must be removed before equipment leaves the facility and who certifies that it was removed.
Post-maintenance checks: Assign owners for rechecking affected security controls after work is complete.
The records themselves: Keep maintenance records current and complete, and make sure they contain the defined information.

Before any outside help starts, confirm that your named approvers and record owners exist and have agreed to their roles in writing.

Where MA-2 evidence usually fails and how to close each gap

MA-2 evidence rarely fails because the maintenance itself was wrong. It fails because the approval, removal, sanitization, check and record for a given job cannot be shown together. The cards below cover the gaps assessors most often find when they sample maintenance events, with the fix for each.

Verbal or chat approvals

Maintenance approved in a hallway conversation or a chat thread leaves no record the assessor can sample. Require a maintenance request with a mandatory approver field, a planned date window and the systems affected, and make the approval a precondition for opening the work order. Check that approvals exist for a sample of recent jobs, including emergency work approved after the fact, which should be marked as such.

Off-site removal without approval

Equipment that leaves the facility for repair without an explicit approval is one of the most visible MA-2 gaps. Add a removal step to the change or maintenance ticket that records the item, serial number, destination, the approver and the expected return date. Confirm that the physical asset record and the ticket agree on where the device is.

Sanitization claimed but not logged

Teams often state that media was sanitized before a vendor took it, but cannot show which device, which method and who verified it. Log sanitization per asset with the media identifier, the method used, the operator and a verification result, and link that entry to the removal ticket. Assessors will ask for the entry for the specific device they sample, so a general policy statement is not enough.

Post-maintenance checks not tied to controls

A generic note that systems were tested after repair does not show which affected controls were rechecked. For each job, record the controls the work could touch, such as configuration, logging or access settings, the check performed and the result. Ask the maintenance owner to name those controls at ticket closure so the check can be traced back to them.

Vendor remote sessions without monitoring

Remote sessions opened by a vendor can leave no record of who connected, when, what they did and when access ended. Require each session to reference an approved ticket, capture start and end times and the named vendor user, and retain the session log with the ticket. Confirm this against the nonlocal maintenance controls in MA-4 as well, since MA-2 assessors will look for the monitoring record.

Records split across tools

When the request sits in one tool, the asset in another and the sanitization log in a spreadsheet, a sampled event cannot be traced from start to finish. Choose one maintenance record as the anchor and require every related item, asset, approval, sanitization entry and check result, to reference its ticket ID. Test the chain by picking one job and following it end to end before an assessment begins.

Questions buyers ask about MA-2 cost, time and effort

How much effort does MA-2 controlled maintenance take to implement?

MA-2 is mostly process and records work, so the effort depends on how many systems, facilities and maintenance providers fall in scope and how many maintenance events happen each year. The main workload is building a maintenance schedule, an approval and monitoring workflow for on-site and remote work, a sign-off step for off-site removal, a sanitization step before equipment leaves, and a post-maintenance control check. Each of those needs a written procedure and a record that an assessor can sample. Effort rises with the number of vendors, the number of hardware classes, and how often equipment leaves the facility. NIST does not publish effort estimates for SP 800-53 controls, so ask any provider to base its estimate on your inventory and maintenance volume, and confirm which records your assessor will expect.

How long does a first MA-2 implementation take?

The duration depends on how mature your maintenance records already are and how many systems are in the authorization boundary. Organizations that already log vendor visits, repairs and component swaps usually need less time than those that handle maintenance through email and verbal approvals. The schedule is typically set by three things: how quickly the team can produce a complete component inventory, how long it takes to agree on the sanitization and off-site removal rules with facilities and media owners, and how many review cycles the documentation needs before an assessor sees it. Confirm the timeline in a written scope before work starts, and do not accept a duration that is not tied to a defined set of systems and deliverables.

Can our own team implement MA-2 without an outside partner?

Yes, many organizations implement MA-2 with internal staff, and the control itself does not require an outside party. The organization owns the control, so it must own the decisions: who approves maintenance, which equipment may leave the facility, and what counts as sanitized. A partner is most useful when the team lacks time, when maintenance records are spread across ticketing tools, or when the environment needs self-hosted tooling set up and tested. DeployOpen plans, implements and documents self-hosted platforms in your own infrastructure under a written, fixed scope, but it does not issue audit reports or certifications. An independent assessor still evaluates the result.

What does MA-2 require from our staff day to day?

Staff need to follow a repeatable maintenance workflow and keep records that match it. Facilities, IT operations and any external vendor must request approval before work starts, record what was done, and confirm that affected security controls still work afterward. Staff who approve off-site removal must check that defined data has been sanitized, and the people responsible for media sanitization should be able to explain the method they use. Interviews are part of assessment, so the people named in your procedures should understand their role. Plan a short training session and assign a named owner for the maintenance log, because records that no one reviews are a common reason for findings.

Does a self-hosted open-source tool satisfy MA-2 by itself?

No. A tool can hold the evidence for MA-2, such as tickets, planned maintenance, inventory and change records, but it cannot approve work, sanitize equipment or decide what the organization accepts as residual risk. Ticketing and ITSM platforms such as GLPI can route maintenance requests, approvals and change records, and Wazuh Syscollector or Zabbix host inventory can show hardware and software details for each asset. You still need written procedures, defined sanitization steps and an owner who reviews the records. Confirm with your assessor which records they will sample, and confirm each tool's current capabilities in its own documentation before you rely on them.

Does MA-2 apply to cloud-hosted components?

MA-2 applies to the systems within your authorization boundary, and cloud-hosted components are included when your organization or a contract makes you responsible for their maintenance. Cloud providers typically handle physical hardware maintenance inside their data centers, so your MA-2 scope often covers virtual machines, managed services you configure, and any maintenance you perform remotely. The division of responsibility should be written down. Ask your cloud provider for its shared responsibility documentation and any independent assurance reports it publishes, then document which maintenance activities you own. Confirm the boundary with your assessor before you define the records you need.

What should we ask for in a written quote for MA-2 work?

A written quote should follow from a written scope, so ask for the scope first. Request a list of systems, facilities and maintenance providers in scope, the deliverables (procedures, workflow configuration, record templates, sanitization standard, and post-maintenance check steps), and the roles each party performs. Ask which costs are one-time, such as setup and documentation, and which recur, such as review cycles, support or retainers. Ask how the provider will handle changes to scope, what it will hand over at the end, and who will confirm that the evidence is complete. A quote should also state that the independent assessor, not the provider, issues any report.

How DeployOpen works on this

DeployOpen helps organizations prepare the systems, records and evidence that show MA-2 Controlled maintenance is operating, inside the client's own infrastructure. The organization owns its maintenance controls, and only an independent assessor can test them and report on them.

How we scope

Written scope lists which systems, facilities and maintenance workflows fall under MA-2 before any work starts.
Scope names the approved maintenance tools, vendors and remote access paths that the MA-2 records must cover.
Scope confirms the vendor and organizational maintenance requirements the schedule will be reviewed against.

How we build

We configure a self-hosted ticketing workflow so each maintenance action has a request, approval and closure record.
We set up inventory collection so each maintained asset has a current record of location, serial number and owner.
We document the sanitization and post-maintenance check steps as tested procedures, with logs kept for each run.

How we hand over

Handover includes the MA-2 procedure, sample maintenance records and the tool configuration used to produce them.
We provide a record-by-record walkthrough so the control owner can explain each evidence source to an assessor.
Documentation names the owner of each step, the review cycle and the gaps the organization still needs to close.

How we support

Ongoing support and upgrades of the maintenance tooling are available as a retainer under a separate written scope.
Retainers can cover periodic review of maintenance records against the schedule and the approval workflow.
Ask any provider which assessment objects they will produce and which parts still need your own owners and sign-off.