Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

NIST SP 800-171 CUI Protection Center

03.07 — Maintenance

Study this CUI requirement family as a connected set of implementation decisions, evidence expectations, and assessment procedures.

3Active requirements
3Withdrawn records
16Assessment objectives

CUI requirement family

Maintenance

Use this family as a planning boundary, but assess every applicable requirement against the real CUI system boundary, inherited services, organization-defined parameters, and operational evidence.

3 active3 withdrawnRevision 3
MA

Family catalog

Requirements and assessment procedures.

Withdrawn records remain available and link to the requirements where their intent was incorporated or addressed.

03.07.01Withdrawn

Withdrawn requirement

Withdrawn NIST SP 800-171 Rev. 3 requirement 03.07.01; use the recorded replacement relationships.

03.07.02Withdrawn

Withdrawn requirement

Withdrawn NIST SP 800-171 Rev. 3 requirement 03.07.02; use the recorded replacement relationships.

03.07.03Withdrawn

Withdrawn requirement

Withdrawn NIST SP 800-171 Rev. 3 requirement 03.07.03; use the recorded replacement relationships.

03.07.04Active

Maintenance Tools

Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues associated with the tools that are used for diagnostic and repair actions on the system. Maintenance tools can include hardware and software diagnostic and test equipment as well as packet sniffers. The tools may be pre-installed, brought in with maintenance personnel on media, cloud-based, or downloaded from a website

03.07.05Active

Nonlocal Maintenance

Nonlocal maintenance and diagnostic activities are conducted by individuals who communicate through an external or internal network. Local maintenance and diagnostic activities are carried out by individuals who are physically present at the location of the system and not communicating across a network connection. Authentication techniques used to establish nonlocal maintenance and diagnostic sessions reflect the req

03.07.06Active

Maintenance Personnel

Maintenance personnel refers to individuals who perform hardware or software maintenance on the system, while 03.10.01 addresses physical access for individuals whose maintenance duties place them within the physical protection perimeter of the system. The technical competence of supervising individuals relates to the maintenance performed on the system, while having required access authorizations refers to maintenan