MA.L2-3.7.2
System Maintenance Control
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee MA.L2-3.7.2 in the reference catalog with its NIST cross-references
Official requirement
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
Assessment objectives
a. tools used to conduct system maintenance are controlled;
b. techniques used to conduct system maintenance are controlled;
c. mechanisms used to conduct system maintenance are controlled; and
d. personnel used to conduct system maintenance are controlled.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Control maintenance tools, techniques, mechanisms, and personnel.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are responsible for maintenance activities on your company ’s machines. To avoid introducing additional vulnerability into the systems you are maintaining, you make sure that all maintenance tools are approved and their usage is monitored and controlled [a,b]. You ensure the tools are kept current and up -to-date [a]. You and your backup are the only people authorized to use these tools and perform system maintenance [d].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System maintenance policy; procedures addressing system maintenance tools and media; maintenance records; system maintenance tools and associated documentation; maintenance tool inspection records; system security plan; other relevant documents or records
Common mistakes
Approving a maintenance visit without considering the tools and methods used.