Control statement
- a.Approve, control, and monitor the use of system maintenance tools; and
- b.Review previously approved system maintenance tools [Organization-defined: frequency].
Discussion
Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues associated with maintenance tools that are not within system authorization boundaries and are used specifically for diagnostic and repair actions on organizational systems. Organizations have flexibility in determining roles for the approval of maintenance tools and how that approval is documented. A periodic review of maintenance tools facilitates the withdrawal of approval for outdated, unsupported, irrelevant, or no-longer-used tools. Maintenance tools can include hardware, software, and firmware items and may be pre-installed, brought in with maintenance personnel on media, cloud-based, or downloaded from a website. Such tools can be vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and subsequently into systems. Maintenance tools can include hardware and software diagnostic test equipment and packet sniffers. The hardware and software components that support maintenance and are a part of the system (including the software implementing utilities such as "ping," "ls," "ipconfig," or the hardware and software implementing the monitoring port of an Ethernet switch) are not addressed by maintenance tools.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Maintenance Tools as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to controlled maintenance, trusted tools, authorized personnel, and monitored support access.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- maintenance schedules and tickets
- tool approval records
- remote maintenance session logs
- maintenance personnel authorization
Common failure patterns
- vendor access left enabled permanently
- unapproved diagnostic tools introduced
- maintenance bypasses normal change control
- remote sessions not monitored or terminated
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- MA-03a.
- MA-03a.[01]the use of system maintenance tools is approved;
- MA-03a.[02]the use of system maintenance tools is controlled;
- MA-03a.[03]the use of system maintenance tools is monitored;
- MA-03b.previously approved system maintenance tools are reviewed [Organization-defined: frequency].
Examine
- Maintenance policy
- procedures addressing system maintenance tools
- system maintenance tools and associated documentation
- maintenance records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes for approving, controlling, and monitoring maintenance tools
- mechanisms supporting and/or implementing the approval, control, and/or monitoring of maintenance tools
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Related defensive techniques
D3FEND maps this base control or one of its enhancements to the following defensive techniques. The ontology relation label is preserved and does not by itself prove implementation or effectiveness.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
MA-3(1) — Inspect Tools
Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.
Official discussion
Maintenance tools can be directly brought into a facility by maintenance personnel or downloaded from a vendor’s website. If, upon inspection of the maintenance tools, organizations determine that the tools have been modified in an improper manner or the tools contain malicious code, the incident is handled consistent with organizational policies and procedures for incident handling.
Assessment objectives and methods
maintenance tools used by maintenance personnel are inspected for improper or unauthorized modifications.
Examine
- Maintenance policy
- procedures addressing system maintenance tools
- system maintenance tools and associated documentation
- maintenance tool inspection records
- maintenance records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes for inspecting maintenance tools
- mechanisms supporting and/or implementing the inspection of maintenance tools
Related controls
MA-3(2) — Inspect Media
Check media containing diagnostic and test programs for malicious code before the media are used in the system.
Official discussion
If, upon inspection of media containing maintenance, diagnostic, and test programs, organizations determine that the media contains malicious code, the incident is handled consistent with organizational incident handling policies and procedures.
Assessment objectives and methods
media containing diagnostic and test programs are checked for malicious code before the media are used in the system.
Examine
- Maintenance policy
- procedures addressing system maintenance tools
- system maintenance tools and associated documentation
- maintenance records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational process for inspecting media for malicious code
- mechanisms supporting and/or implementing the inspection of media used for maintenance
Related controls
MA-3(3) — Prevent Unauthorized Removal
Prevent the removal of maintenance equipment containing organizational information by:
- (a)Verifying that there is no organizational information contained on the equipment;
- (b)Sanitizing or destroying the equipment;
- (c)Retaining the equipment within the facility; or
- (d)Obtaining an exemption from [Organization-defined: personnel or roles] explicitly authorizing removal of the equipment from the facility.
Official discussion
Organizational information includes all information owned by organizations and any information provided to organizations for which the organizations serve as information stewards.
Organization-defined parameters (1)
Assessment objectives and methods
- MA-03(03)(a)the removal of maintenance equipment containing organizational information is prevented by verifying that there is no organizational information contained on the equipment; or
- MA-03(03)(b)the removal of maintenance equipment containing organizational information is prevented by sanitizing or destroying the equipment; or
- MA-03(03)(c)the removal of maintenance equipment containing organizational information is prevented by retaining the equipment within the facility; or
- MA-03(03)(d)the removal of maintenance equipment containing organizational information is prevented by obtaining an exemption from [Organization-defined: personnel or roles] explicitly authorizing removal of the equipment from the facility.
Examine
- Maintenance policy
- procedures addressing system maintenance tools
- system maintenance tools and associated documentation
- maintenance records
- equipment sanitization records
- media sanitization records
- exemptions for equipment removal
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
- organizational personnel responsible for media sanitization
Test
- Organizational process for preventing unauthorized removal of information
- mechanisms supporting media sanitization or destruction of equipment
- mechanisms supporting verification of media sanitization
Related controls
MA-3(4) — Restricted Tool Use
Restrict the use of maintenance tools to authorized personnel only.
Official discussion
Restricting the use of maintenance tools to only authorized personnel applies to systems that are used to carry out maintenance functions.
Assessment objectives and methods
the use of maintenance tools is restricted to authorized personnel only.
Examine
- Maintenance policy
- procedures addressing system maintenance tools
- system maintenance tools and associated documentation
- list of personnel authorized to use maintenance tools
- maintenance tool usage records
- maintenance records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes for restricting the use of maintenance tools
- mechanisms supporting and/or implementing the restricted use of maintenance tools
Related controls
MA-3(5) — Execution with Privilege
Monitor the use of maintenance tools that execute with increased privilege.
Official discussion
Maintenance tools that execute with increased system privilege can result in unauthorized access to organizational information and assets that would otherwise be inaccessible.
Assessment objectives and methods
the use of maintenance tools that execute with increased privilege is monitored.
Examine
- Maintenance policy
- procedures addressing system maintenance tools
- system maintenance tools and associated documentation
- list of personnel authorized to use maintenance tools
- maintenance tool usage records
- maintenance records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes for restricting the use of maintenance tools
- organizational process for monitoring maintenance tools and maintenance tool usage
- mechanisms monitoring the use of maintenance tools
Related controls
MA-3(6) — Software Updates and Patches
Inspect maintenance tools to ensure the latest software updates and patches are installed.
Official discussion
Maintenance tools using outdated and/or unpatched software can provide a threat vector for adversaries and result in a significant vulnerability for organizations.
Assessment objectives and methods
maintenance tools are inspected to ensure that the latest software updates and patches are installed.
Examine
- Maintenance policy
- procedures addressing system maintenance tools
- system maintenance tools and associated documentation
- list of personnel authorized to use maintenance tools
- maintenance tool usage records
- maintenance records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes for inspecting maintenance tools
- organizational processes for maintenance tools updates
- mechanisms supporting and/or implementing the inspection of maintenance tools
- mechanisms supporting and/or implementing maintenance tool updates.
Related controls
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.