The Maintenance family governs the moments when someone works on your systems — your own staff, a vendor, or a remote support provider. It covers the tools they use, equipment that leaves the building for repair, diagnostic media that comes in, remote maintenance sessions, and supervision of maintenance personnel who are not otherwise authorized.
It is a family where third parties create most of the risk. Managed service providers, equipment vendors and remote support tools are where the requirements actually bite.
What the Maintenance family covers
Maintenance contains 6 requirements, numbered 3.7.1 to 3.7.6 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix MA.L2, so 3.7.1 appears as MA.L2-3.7.1.
The six requirements cover performing maintenance (3.7.1), controlling tools and personnel (3.7.2), sanitizing equipment sent off-site (3.7.3), scanning diagnostic media (3.7.4), securing nonlocal maintenance (3.7.5) and supervising unauthorized maintenance personnel (3.7.6).
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.7.1 | Perform maintenance on organizational systems | 3 | No |
| 3.7.2 | Provide controls on the tools, techniques, mechanisms and personnel used for system maintenance | 5 | No |
| 3.7.3 | Ensure equipment removed for off-site maintenance is sanitized of CUI | 1 | Eligible |
| 3.7.4 | Check media containing diagnostic and test programs for malicious code before use | 3 | No |
| 3.7.5 | Require multifactor authentication for nonlocal maintenance sessions and terminate them when complete | 5 | No |
| 3.7.6 | Supervise maintenance activities of personnel without required access authorization | 1 | Eligible |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 18 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.7.2 and 3.7.5. 3.7.1 and 3.7.4 are worth three points. The remaining 2 are worth one point each.
The two five-point requirements are 3.7.2 and 3.7.5. 3.7.5 is the one most organizations need to look at first: any remote support session into a system in the CUI boundary — through a vendor's remote access tool or your MSP's platform — must use multifactor authentication and be terminated when the work ends.
Where maintenance controls break down
No Maintenance requirement is on the DIBCAC top-ten list, but the family causes trouble in two places. The first is remote support tools left permanently connected with shared credentials, which fails 3.7.5 and often 3.5.3 as well. The second is equipment sent for repair with drives still in it — a laptop returned to the manufacturer, a multifunction printer collected by the lessor, or a CNC controller sent to the OEM — which fails 3.7.3.
Both are solved by procedure rather than technology: a remote session process requiring MFA and explicit start and end, and a checklist that removes or sanitizes storage before equipment leaves. Media Protection covers the sanitization standard.
Controlling vendor and MSP maintenance
List every party that maintains systems in the boundary and how each connects. Require MFA on every remote maintenance path and remove standing connections so that sessions are started on request and ended when the work finishes. Approve the tools vendors may use and scan any diagnostic media before it touches an in-scope system. For on-site work by people without authorization, assign an escort and log the visit. These steps cover all six requirements and usually take less effort than any single technical control elsewhere in the standard.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes 3.7.3 and 3.7.6 eligible for deferral.
Only 3.7.3 and 3.7.6 are deferrable. Escort procedures and sanitization checklists are usually quick to establish, so deferral is rarely necessary.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- Maintenance records and schedules for systems in scope.
- An approved list of maintenance tools and remote access methods.
- Remote session logs showing MFA and session termination.
- Sanitization records for equipment sent off-site.
- Escort or supervision logs for vendor maintenance personnel.
Frequently asked questions
Does our MSP's remote access tool count as nonlocal maintenance?
Yes. Any remote session used to maintain systems in scope must meet 3.7.5, including MFA and termination at the end of the session.
Do we need to sanitize a laptop sent for warranty repair?
If it held CUI, yes — or remove the drive before shipping. Document which you did.
Are maintenance vendors in scope for assessment?
Their access is. Your controls over what they can reach and how they connect are what assessors examine.
Does a vendor's own MFA satisfy 3.7.5?
It can, if the vendor's MFA protects the session into your systems and you can evidence it. Many organizations require vendors to connect through their own access gateway so the MFA and logging are under their control.