What MA-5 maintenance personnel requires and why it is hard to evidence
When an assessor or a contract asks who can touch the system during maintenance, MA-5 is the control that answers it. In plain terms, MA-5 asks for three things. First, a documented process for authorizing maintenance personnel, plus a list of the maintenance organizations and individuals who are authorized. Second, verification that any maintenance staff working without escort already hold the access authorizations the system requires. Third, where someone without those authorizations must do maintenance, a designated supervisor who holds the authorizations and has the technical competence to oversee the work. The risk behind all three is simple: an unvetted maintainer with privileged access can change configurations, pull data or install code without anyone noticing. MA-5 applies at the low, moderate and high baselines in SP 800-53B but is not part of the privacy baseline, and SP 800-53A breaks its assessment into 4 determination statements.
The control is hard to evidence because the proof sits in three places that rarely talk to each other. The authorization list usually lives with a vendor manager or in a contract file. Background screening and access agreements sit with HR or the personnel security team. The actual access rights, such as the accounts, groups and privileges a maintainer holds, sit in the identity and access management system. An assessor will ask for the procedure, the authorized list, the access control records and the supervision arrangements, then test whether they agree. Reconciling them by hand, after the fact, is where most gaps appear. Start by naming one owner for the authorized list and confirming with your personnel and vendor teams which records they keep and how often they update them.
Self-hosted identity tools can narrow that gap. Confirm in your own environment whether your identity provider can publish group membership for maintenance roles and remove access when a contract ends. For example, authentik's SCIM provider pushes user and group changes and deprovisions users from target applications when they lose access, with a full sync every hour, so a lapsed maintenance contractor's access can be checked against the authorized list. FreeIPA, with its 389 Directory Server, offers centralized access control and delegated administration, which helps show who is authorized to administer hosts. These tools produce access records, but they do not decide who is authorized. That decision and its approval trail remain the organization's responsibility, and an independent assessor reviews the result.
Which maintainers, systems and contracts MA-5 covers in your environment
MA-5 applies to anyone who performs maintenance on a system, whether they are employees, vendors, remote engineers or cloud provider staff. The scoping decisions below determine which people, contracts and baselines your authorization list and access checks must cover.
Internal maintenance staff
Your own system administrators, network engineers and facilities technicians who perform maintenance count as maintenance personnel when they work on in-scope components. Record which internal roles hold maintenance duties, confirm each person's access authorizations, and decide whether any staff member lacks authorization and must be supervised. Include contractors on your payroll and temporary staff, since they are often missed in role-based lists.
Vendor and service provider personnel
Hardware vendors, software support teams and managed service providers often perform the bulk of maintenance on production systems. Assessors look for a list of authorized maintenance organizations and personnel, plus contract terms and service-level agreements that govern who may touch the system. Confirm that each vendor's named staff appear on the list and that contracts require the vendor to notify you when personnel change.
Remote maintainers
Engineers who maintain systems over a network are maintenance personnel even when they never enter your facilities. Their authorization must be recorded in the same list as on-site staff, and their access paths must be checked against MA-4 for nonlocal sessions and MA-3 for any diagnostic or repair tools they run. Where remote staff are employed by a vendor, confirm the vendor's background and access reviews cover them.
Cloud provider staff where contracts apply
When a cloud provider's own staff perform maintenance on infrastructure that hosts your system, the scope depends on your contract and the shared responsibility model in use. Document which provider personnel are covered by the agreement, what evidence the provider supplies about their authorization, and where your organization must still verify access. Treat provider attestations as inputs to your assessment, not a substitute for your own records.
Baseline and enhancement scope
MA-5 is allocated to the low, moderate and high baselines in SP 800-53B, so every system at those impact levels needs the control. The high baseline adds enhancement MA-5(1), which you should confirm against the current baseline profile before scoping. MA-5 is not part of the privacy baseline. Record the impact level of each system in your security plan so the scope is traceable.
Links to PE-2, MA-4 and MA-3
Physical access for maintenance staff is assessed under PE-2, so MA-5 should not duplicate those checks. Remote sessions fall under MA-4 and the tools used during maintenance fall under MA-3, and both depend on knowing who is authorized in the first place. Map each maintainer to these related controls in your documentation so an assessor can follow one person's access across all of them.
How an assessor tests MA-5 with examine, interview and test methods
Examine means the assessor reads the artifacts that define and record who may perform maintenance. For MA-5, the SP 800-53A examine objects include procedures addressing maintenance personnel, service provider contracts, service-level agreements, the list of authorized personnel and access control records. The assessor checks whether the procedures name the authorization process, whether contracts oblige vendors to supply only authorized staff, and whether the list matches what the directory and access logs show.
- Procedures: the document should describe how maintenance personnel are approved, who approves them, and how approval is removed.
- Contracts and SLAs: look for clauses that require named or vetted staff, background checks where the organization requires them, and notice before personnel change.
- Authorized personnel list: assessors compare its dates and names against the directory, so stale entries are a common finding.
- Access control records: they sample account grants and removals for maintenance identities against the list.
- Dual sources: a list that differs from the contract roster or the access records is an immediate question.
Before the assessment, confirm that each examine object exists in your environment and that its owner can produce it on request.
Interviews test whether people who run maintenance know the rules and follow them. SP 800-53A directs the assessor to speak with organizational personnel who hold system maintenance responsibilities. The assessor is not checking a script. They are checking whether an administrator, a vendor manager and a service owner describe the same process, and whether that process matches the written procedure.
- Who to interview: system administrators, platform engineers, the owner of vendor relationships and the staff who escort or supervise outside technicians.
- Process walk-through: interviewees should explain how a new vendor engineer is approved and how access ends at the close of a job.
- Supervision practice: ask who supervises an unauthorized person and what authorization that supervisor must hold.
- Common findings: staff describe an informal approval by email that the procedure does not mention, or they cannot say who removes access after a contract ends.
- Consistency: divergent answers from two interviewees often lead to a finding even when the documents are correct.
Prepare interviewees with the procedure beforehand, and make sure they can describe the steps without reading from it.
Testing checks that the authorization process works in practice and that the mechanisms enforcing it actually block unauthorized maintenance. SP 800-53A lists two test objects for MA-5: the organizational processes for authorizing and managing maintenance personnel, and the mechanisms that support or implement that authorization. The assessor may request a sample of recent maintenance sessions and trace each one back to an approval.
- Sample tracing: the assessor picks a maintenance event and asks for the approval, the authorized identity and the access record.
- Enforcement mechanisms: directory group membership, role-based access and identity provider policies should limit who can reach maintenance interfaces.
- Deprovisioning: test whether removing a person from the authorized group removes their access to target applications. Identity provider sync settings, such as the authentik SCIM provider running a full sync every hour, determine how quickly that happens and should be documented.
- Supervision control: confirm that unauthorized staff cannot act without an authorized supervisor present or logged.
- Common findings: a revoked user still holds a working credential, or the sync interval is longer than the procedure states.
Run your own sample trace before the assessor does, and keep the screenshots, logs and tickets together.
Implementing MA-5 from authorization process to supervised access
This sequence turns MA-5 into working records: a written authorization process, a maintainer list, verified access for each maintainer, supervision rules for anyone unauthorized, and approvals enforced through identity tooling. Each step produces an artifact an assessor can examine or test.
Define the maintenance personnel authorization process
The organization owns this step. Its security, IT operations and facilities leads write the procedure that says who can request maintenance access, who approves it, what checks precede approval, how long an authorization lasts, and how it is withdrawn. Tie the procedure to the MA policy so the two documents agree. Done means an approved, dated procedure that names the roles responsible for each decision. Assessors examine this document first, so keep it specific enough to test.
Build the authorized maintainer list
Create a single register of every maintenance organization and individual permitted to work on in-scope systems. Include vendor firms, contractors and internal staff, and record the sponsor, scope of work and approval date for each entry. Keep the list under change control so additions and removals leave a trail. Done means the list matches the authorization process and an owner has signed off on it. Assessors typically compare this list against access records, so it must be current.
Map each maintainer to access authorizations
For every person on the list, confirm the access authorizations they need for the systems they will touch, such as administrative accounts, facility badges or remote access rights. Verify those authorizations exist before any maintenance begins, and record who verified them. Staff who lack the required authorizations move to the supervised path in the next step. Done means each maintainer has a documented, verified set of authorizations that matches the work scope.
Set escort and supervision rules for unauthorized staff
Some personnel will work on systems without holding the full access authorizations. Write rules that require a designated, authorized person to supervise each such worker for the duration of the task. Specify what supervision covers, what the supervisor must record, and when work stops if supervision lapses. Done means a written rule exists and each supervised session has a named supervisor. Clarify with the physical security owner where PE-2 controls end and MA-5 supervision begins, so no gap is left between them.
Designate qualified supervisors
Name the staff who may supervise maintenance personnel without authorization. Each designee needs both the required access authorizations and the technical competence to judge the work being done. Record the competence basis for each designee, such as role, training or certification your organization recognizes, and keep the designation list under review as staff change. Done means a current supervisor roster exists and every supervised session can be traced to a qualified name. Confirm with your own HR and training records what competence evidence your organization accepts.
Wire approvals into identity tooling
Configure your identity platform so the approved list drives access rather than living only in a spreadsheet. In a self-hosted stack, FreeIPA can hold users, groups and delegated administration in one directory, and authentik's SCIM provider can push user and group changes to target applications, run a full sync every hour, and deprovision users when they lose access. Confirm the sync interval and deprovisioning behavior in your own environment before relying on them. Done means a test removal of a maintainer from the approved group removes their access in the target application, and the test is recorded.
Retain authorization and supervision records
Keep the procedure, maintainer list, verification records, supervisor roster, supervised session logs and deprovisioning results together in one evidence location with a retention period your policy sets. Review the set on a schedule you define and after any significant change in maintenance providers. Done means an assessor can pick any maintenance event and trace it back to an authorized person, a verified access right and, where needed, a named supervisor. Review the MA-5 assessment objects in the SP 800-53A procedure to confirm nothing is missing.
How identity lifecycle tooling keeps the maintainer list accurate
The list of authorized maintenance personnel is only as accurate as the identity records behind it, so the practical question is how a directory and identity provider keep those records current without manual edits. An identity provider such as authentik can act as the source of truth for maintainer accounts and groups. Its SCIM provider pushes user and group creations, changes and deletions to target applications over SCIM 2.0, runs a full sync every hour, and deprovisions users from the target when they lose access to the application. Confirm in your own environment that the target applications you use for maintenance tooling support SCIM, that the hourly full sync matches your change-approval timing, and that a removed user actually loses access in each downstream system, not only in the identity provider.
FreeIPA is a second building block, and it fits the access records that MA-5 asks you to verify. It uses 389 Directory Server as a multi-master LDAPv3 directory that stores users, groups, hosts and other network objects, with centralized access control and delegated administration through its web UI and command line tools. Delegation matters here because the people who approve maintenance access should be able to add or remove members of a maintenance group without holding broader administrative rights. Before relying on this design, confirm that your deployment's delegation rules limit who can change the maintenance group, and that the directory's audit output can show who changed membership and when. Check the current FreeIPA documentation for the exact capabilities of your release, since the supplied facts describe the project in general terms.
Whatever tooling you choose, the evidence assessors usually want is a dated list of authorized maintainers, the approval behind each entry and the removal record when access ends. Identity tooling can supply the membership history and the deprovisioning log, but the organization still owns the decision to authorize or remove a person. Ask your implementation partner to document which system is the authoritative source for each maintenance group, how a termination or contract end reaches the directory, and which reports you can export for an assessor. An independent assessor will then test whether the list, the directory and the target systems agree.
Evidence that passes an MA-5 review and how to keep it current
An MA-5 assessor looks for a documented authorization process, a current list of who may maintain the system, and proof that unescorted staff hold the right access and that unauthorized staff are supervised. The cards below cover each artifact and the recurring checks that keep it accurate between assessments.
Maintenance personnel procedure
This is the written process for authorizing maintenance organizations and individuals, including who approves them, what competence and access they must hold, and when authorization ends. Assessors examine it first, so it should name the owner, the approval steps and the review cycle. Check that it covers vendor staff and remote maintainers, not only employees, and that it matches what the team actually does.
Authorized maintainer list
Keep one list of every authorized maintenance organization and person, with the date each was added, the approver, the systems covered and the date authorization expires or is reviewed. Assessors sample this list and then check the access records against it. A list without approver names or dates is hard to defend, and a list that omits contractors is a common finding.
Vendor contract clauses and SLAs
Where maintenance is outsourced, the contract or service-level agreement should require the provider to name its personnel, follow the organization's access rules, and notify the organization of staffing changes. Assessors examine these clauses against the authorized list. Ask legal and procurement to confirm that each maintenance contract contains these terms and that renewals do not drop them.
Access control records for maintainers
Export the directory and account records for maintenance staff, showing account status, group membership and the access granted to each system. Assessors test whether unescorted maintainers hold the required authorizations by comparing these records with the authorized list. Self-hosted identity platforms such as FreeIPA can hold these records centrally, which makes the export repeatable.
Supervision assignments
For any maintainer without the required authorization, record the designated supervisor, the date of assignment, the scope of the work and the supervisor's competence basis. Assessors interview supervisors to confirm they know their role. Keep these assignments tied to specific maintenance tickets so a sample can be traced from request to supervised session.
Deprovisioning and access review records
Record periodic reviews of the maintainer list and proof that access was removed when authorization ended. Automated lifecycle tools can help here: the authentik SCIM provider deprovisions users from a target application when they lose access, and runs a full sync every hour. Confirm that removals reach every connected application, and keep the review sign-off dated and signed.
What meeting MA-5 costs in staff time, tooling and external review
This table compares the cost components of meeting MA-5 Maintenance personnel, showing who is paid for each, whether the cost is one-time or recurring, and what drives it up or down. Use it to scope internal effort and to decide which parts an implementation partner or external reviewer should handle, then ask for a written quote that breaks out each row.
| Cost component | Who carries the cost | One-time or recurring, and main drivers |
|---|---|---|
| Process design for authorizing maintenance personnel | Internal security, IT operations and HR, with optional outside help | One-time to establish, then recurring review. Drivers: number of maintenance organizations, vendor count and whether contractors are involved |
| Building and maintaining the authorized maintenance list | Maintenance owner and system owners | Recurring. Drivers: staff turnover, vendor changes and how often access is granted or revoked |
| Identity configuration for maintenance accounts | Internal identity team or implementation partner | Mostly one-time setup, then recurring administration. Lever: self-hosted open-source identity such as authentik or FreeIPA reduces licensing but still needs skilled administration |
| Vendor contract review for maintenance terms | Legal, procurement and security reviewers | Per contract at signing and at renewal. Drivers: number of service providers and whether SLAs reference personnel authorization |
| Supervision staffing for unauthorized personnel | Designated staff with required authorizations and technical competence | Recurring for each maintenance window. Drivers: how often unescorted or unauthorized staff perform work and how many supervisors are qualified |
| Evidence upkeep | Compliance lead and system owners | Recurring. Drivers: how many records must be kept current, and whether access logs and lists are generated automatically |
| Auditor sampling and inquiry | Independent assessor, billed to the organization | Periodic, per assessment. Drivers: size of the population assessors sample and how quickly records can be produced. Ask the assessor for a written scope and fee basis |
Who owns MA-5 inside your team, with a partner and with the auditor
Your organization owns MA-5. The authorization of maintenance organizations and personnel is a management decision that the assessment expects to see recorded, approved and reviewed by people accountable for the system. No partner or auditor can make that decision for you, and an assessor will look for evidence that your own staff made it.
- Maintenance personnel policy: Own the procedure that defines how maintenance organizations and individuals are proposed, approved, supervised and removed, and keep it aligned with MA-1.
- Authorized list: Maintain the list of authorized maintenance organizations and personnel, with named owners and the systems each person may touch.
- Access authorization checks: Confirm that unescorted maintenance staff hold the required access authorizations before they receive access, and record the verification.
- Supervisor designation: Name the staff who hold the required authorizations and technical competence to supervise anyone without them.
- Vendor decisions: Decide which external service providers may perform maintenance, and make sure their contracts and service-level agreements reflect those obligations.
Before engaging anyone, confirm that a named accountable owner has signed the authorized list and that your reviews produce dated records.
An implementation partner such as DeployOpen supports the control by preparing the systems and evidence your organization uses. The partner does not approve maintainers, decide who is authorized or certify that the control is met. Those decisions stay with you, and the partner's role is limited to making the decisions easy to record and to prove.
- Identity configuration: Set up directory and identity services so that maintenance accounts are created, grouped and removed in line with your authorized list. In a self-hosted environment this often means working with products such as authentik or FreeIPA, after confirming which capabilities your chosen version provides.
- Deprovisioning paths: Configure how access ends when a person leaves the authorized list, and test that the change reaches the target applications.
- Evidence collection: Export group membership, access logs and approval records on a schedule your team sets, so the assessor can sample them.
- Supervision records: Build a template for logging supervised sessions, including who supervised, who was supervised and what work was done.
- Runbooks: Document the steps your staff follow, so the evidence reflects the actual process.
Ask the partner to state in writing which artifacts it produces, which decisions remain with your staff, and who retains the configuration after the engagement ends.
An independent auditor, assessor or certification body tests MA-5 and issues the report or attestation. The assessment procedure for MA-5 asks the assessor to examine policy and records, interview staff with maintenance responsibilities and test the processes and mechanisms that enforce authorization. The auditor must be independent of the people who built the controls, which is why a partner cannot sign off on its own work.
- Examination: The assessor reviews procedures, service provider contracts, service-level agreements, the authorized list and access control records.
- Interviews: The assessor asks the people responsible for maintenance how the process works in practice.
- Testing: The assessor tests whether the authorization process and its supporting mechanisms operate as documented, often by sampling individuals and events.
- Findings: Gaps become findings that your organization must answer, often through a plan of action and milestones.
- Independence: Your partner may help you prepare, but the auditor should not design the controls it is testing.
Confirm with the auditor, before fieldwork, which evidence formats and sampling approach it expects, and whether your federal or contractual context changes its scope.
Common MA-5 gaps and how to close them
Most MA-5 findings come from the same place: the maintenance access list no longer matches who is actually working on the system. The cards below cover the gaps assessors most often find and the closing action for each, so the list, the access records and the supervision arrangements agree at the point of assessment.
Vendor staff missing from the list
Maintenance is often performed by a vendor's engineers who never appear on the authorized list, because the contract names the vendor rather than individuals. MA-5 expects a list of authorized maintenance organizations or personnel, so an interview that names an engineer absent from the record is a direct gap. Check the list against the vendor's roster and the tickets from the last quarter. Close it by requiring the vendor to name each engineer before first access, and by recording that approval against the individual.
Stale access after contract end
When a maintenance contract ends, the vendor's accounts often stay active on directories, jump hosts and vendor portals. Those accounts are the access that MA-5 is meant to govern, and they persist long after the authorization lapsed. Compare active accounts tagged to each vendor against the contract register each month. Close it by tying each vendor account to a contract end date and removing access automatically when that date passes.
No competent supervisors designated
Unescorted staff may be authorized, but staff without authorization often have no named supervisor who holds both the required access authorizations and the technical competence to oversee the work. Assessors look for that designation on paper and in practice. Ask who supervised the last unauthorized maintenance session and whether that person could have stopped an unsafe action. Close it by naming a supervisor for each maintenance window and recording their authorization and competence.
Unescorted access not verified
Organizations often grant maintenance staff unescorted access on the strength of a badge or a vendor letter without checking that the individual holds the access authorizations the system requires. MA-5 calls for verification of exactly that. Sample several unescorted maintenance accounts and confirm each has a current authorization record and the group memberships that the authorization implies. Close it by making authorization verification a required step before access is granted, with a dated record of who checked.
Evidence that exists only verbally
Many teams can explain the process in an interview but cannot show a record of it. SP 800-53A expects examination of procedures, contracts, service-level agreements, authorized personnel lists and access control records, so an explanation alone does not pass. Ask for the last three maintenance authorizations and see whether each one can be produced in writing. Close it by writing the approval into the ticket or directory workflow so the record is created as a side effect of the work.
Vendor access without directory linkage
Vendor engineers sometimes log in through shared or generic accounts on maintenance hosts, which breaks the link between a person, an authorization and a session. Without that link, the list of authorized personnel cannot be reconciled with activity. Review which maintenance hosts accept shared credentials and whether session logs identify a named individual. Close it by issuing each vendor engineer a named identity in the central directory, governed by the same lifecycle as internal staff.
MA-5 questions buyers ask before bringing in help
How much effort does MA-5 maintenance personnel take to implement?
The effort depends mostly on how many maintenance organizations and people touch the system and how well access is already managed. Most of the work is documentation and access records: a process for authorizing maintenance personnel, a current list of authorized organizations and individuals, and proof that unescorted staff hold the required access authorizations. If your identity provider and directory already hold clean group membership, the technical part is smaller. If maintenance access is granted by phone calls, shared accounts or vendor email threads, expect the larger share of effort to go into reconstructing who has access and why. Ask any partner to split the quote into discovery, process documentation, access clean-up and evidence collection so you can see where the hours go.
Can we implement MA-5 in-house without outside help?
Yes, if your team has the authority and capacity to write the process, maintain the list and collect evidence. The organization owns its controls, so nothing in MA-5 requires an outside firm. Internal teams often struggle with three things: getting maintenance vendors to share their staff lists, keeping the authorized list current as people change, and showing that supervision of unauthorized staff is actually performed. An outside implementation partner can help with the technical setup, such as access groups in your identity platform and deprovisioning rules, and with evidence packaging. The assessor still examines and interviews your people, so the process has to reflect how work really happens inside your organization.
What does a partner need from us to start MA-5 work?
A partner needs enough access and context to see how maintenance access is granted today. Typically this means:
- A list of all maintenance organizations, vendors and internal staff who perform maintenance on in-scope systems
- Read access to the identity provider, directory and access control records that show who holds maintenance-related accounts
- Existing service agreements, service-level agreements and support contracts that govern vendor staff
- Your current maintenance policy and any procedures already written
- A named owner on your side who can approve the process and decide which staff need escorts or supervision
Agree in writing which systems are in scope and who will review the output before any change is made to live access.
How long does MA-5 take to implement and assess?
No researched timeline is available for this control, so confirm the duration with your assessor and with any partner you are considering. The duration depends on the number of maintenance organizations, the state of your access records, how many systems are in scope, and how quickly your contracts can be updated. Ask a partner to break the timeline into phases with dependencies, such as waiting on vendor responses or contract changes. Ask your assessor which evidence they expect to sample and how far in advance they need it, because that often sets the critical path more than the technical work does.
Does DeployOpen issue the MA-5 assessment or certify our compliance?
No. DeployOpen plans, implements, integrates and documents self-hosted open-source platforms inside your own infrastructure, and it prepares systems, controls and evidence for assessment. Only an independent assessor or authorizing body issues assessment results, reports or authorization decisions. For MA-5, DeployOpen could help set up the identity and access records that show who is authorized to perform maintenance and how that access is removed, then package the evidence. Your organization owns the control and its decisions. Any engagement is fixed-scope, with deliverables and timelines agreed in writing before work starts.
How does MA-5 relate to PE-2 physical access authorizations?
MA-5 covers who may perform maintenance and how their access is authorized and supervised, while PE-2 covers physical access authorization for facilities. The two overlap when maintenance staff need to enter a facility, but they are assessed separately. For MA-5, assessors look at maintenance authorization, unescorted access verification and supervision of staff who lack authorization. For PE-2, they look at physical access lists and credentials. Keep the MA-5 list and the PE-2 access list consistent, and cross-reference them in your evidence so an assessor can trace one person across both controls without finding conflicting records.
Which tools can automate MA-5 access records and removals?
Identity platforms and directories can hold the maintenance group, record membership and push changes to connected applications. For example, authentik's SCIM provider pushes user and group creations, changes and deletions to target applications over SCIM 2.0, runs a full sync every hour, and deprovisions users from the target when they lose access. FreeIPA uses 389 Directory Server as a multi-master LDAPv3 directory that stores users, groups and hosts, with centralized access control and delegated administration through its web UI and command line tools. Confirm that either product covers your target systems, your vendor access paths and your audit logging needs before you rely on it as evidence.
What evidence will an assessor ask for under MA-5?
Assessors typically examine the maintenance personnel procedure, service provider contracts and service-level agreements, the list of authorized personnel and access control records. They interview staff who hold system maintenance responsibilities and test the processes and mechanisms that authorize and manage maintenance personnel. Prepare a dated authorized-personnel list, the approval record for each entry, the access records for unescorted staff, and a log of supervised sessions where the supervisor's own authorization and technical competence are documented. Confirm the exact sampling approach and format with your assessor before you build the package.
How DeployOpen prepares MA-5 evidence for an assessment
DeployOpen's role in MA-5 is to prepare the systems and evidence that the organization's assessor will examine, interview and test against the four determination statements in SP 800-53A. The work starts with a written scope that names the systems in the boundary, the maintenance organizations and personnel expected to touch them, and the people who own the authorization list. Scope and deliverables are agreed in writing before work begins, so the organization knows exactly which accounts, groups and procedures are being prepared. DeployOpen does not issue assessment reports, attestations or certifications. An independent assessor or certification body does that, and the organization owns the control decisions, including who is authorized to maintain its systems.
On the technical side, the usual starting point is a self-hosted identity layer inside the organization's own infrastructure. A FreeIPA deployment can hold maintenance staff and contractor accounts in groups with delegated administration, so that the people who approve maintenance access are separate from the people who perform it. An authentik deployment can then push user and group changes to target applications over SCIM 2.0 and deprovision users when they lose access, which gives the assessor a traceable link between an authorization decision and the removal of that access. Confirm with the platform documentation which sync intervals, provisioning events and audit records your version produces before you describe them to an assessor.
How DeployOpen scopes and prepares MA-5 for your assessment
DeployOpen prepares the systems, access records and evidence behind MA-5 Maintenance personnel, while your organization owns the control and an independent assessor makes the determination. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
How we scope
- Confirm which systems fall within the assessed boundary and which maintenance organizations and personnel touch them.
- Record the baseline your organization assesses against, such as low, moderate or high, and whether MA-5(1) applies.
- Agree in writing which maintenance access paths, service contracts and identity sources are in scope and excluded.
How we build
- Set up the identity provider and directory that hold maintenance accounts, groups and their access authorizations.
- Configure provisioning and deprovisioning so vendor or contractor access follows the authorized list and ends when it should.
- Test the authorization workflow against your written maintenance personnel process before handing it to your team.
How we hand over
- Document the authorized maintenance list, access control records and supervision assignments in a form your assessor can examine.
- Provide configuration records and test results showing how authorization and removal of maintenance personnel work.
- Walk your designated staff through the supervision responsibilities and the evidence to collect for each assessment cycle.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, agreed separately from the initial scope.
- Ask your assessor early which evidence they will sample, so the handover package matches their assessment procedures.
- Confirm with your organization who signs the authorization list and who reviews changes to maintenance access over time.
