MA.L2-3.7.6
Maintenance Personnel
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee MA.L2-3.7.6 in the reference catalog with its NIST cross-references
Official requirement
Supervise the maintenance activities of maintenance personnel without required access authorization.
Assessment objectives
a. maintenance personnel without required access authorization are supervised during maintenance activities.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Supervise maintenance personnel who lack the required access authorization.
Implementation example
Example from the source assessment guide (not a mandatory implementation): One of your software providers has to come on- site to update the software on your company’s computers. You give the individual a temporary logon and password that expires in 12 hours and is limited to accessing only the computers necessary to complete the work [a]. This gives the technician access long enough to perform the update. You monitor the individual’s physical and network activity while the maintenance is taking place [a] and revoke access when the job is done.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System maintenance policy; procedures addressing maintenance personnel; service provider contracts; service- level agreements; list of authorized personnel; maintenance records; access control records; system security plan; other relevant documents or records
Common mistakes
Allowing an unapproved technician to work unobserved on an in-scope system.