Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

NIST SP 800-53 Learning Center

MA-6 — Timely Maintenance

Read the official control and assessment content, then use the separately labeled Bare Metal Cyber perspective to connect the requirement to implementation, evidence, and sustained operation.

3Enhancements
2Parameters
2Baseline memberships
3Assessment methods

MA — Maintenance · NIST SP 800-53 Release 5.2.0

ModerateHigh
Official NIST control content

Control statement

Obtain maintenance support and/or spare parts for [Organization-defined: system components] within [Organization-defined: time period] of failure.

Official NIST discussion

Discussion

Organizations specify the system components that result in increased risk to organizational operations and assets, individuals, other organizations, or the Nation when the functionality provided by those components is not operational. Organizational actions to obtain maintenance support include having appropriate contracts in place.

Official OSCAL parameters

Organization-defined parameters

These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.

system componentssystem components for which maintenance support and/or spare parts are obtained are defined;
time periodtime period within which maintenance support and/or spare parts are to be obtained after a failure are defined;
Original Bare Metal Cyber perspective

From control text to operational evidence

Use Timely Maintenance as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to controlled maintenance, trusted tools, authorized personnel, and monitored support access.

Implementation workflow

  • Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
  • Resolve each organization-defined parameter before declaring the control implemented.
  • Document how the implementation satisfies every clause of the official control statement.
  • Collect evidence as a normal byproduct of operation rather than only before an assessment.
  • Review exceptions, changes, and monitoring results on a risk-based cadence.

Evidence examples

  • maintenance schedules and tickets
  • tool approval records
  • remote maintenance session logs
  • maintenance personnel authorization

Common failure patterns

  • vendor access left enabled permanently
  • unapproved diagnostic tools introduced
  • maintenance bypasses normal change control
  • remote sessions not monitored or terminated

Questions practitioners should ask

  • What risk decision is this control intended to support in this system?
  • Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
  • Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
  • What event or threshold requires the implementation to be reviewed or changed?
Official NIST SP 800-53A content

Assessment objectives and methods

Show the assessment objective

maintenance support and/or spare parts are obtained for [Organization-defined: system components] within [Organization-defined: time period] of failure.

Examine

  • Maintenance policy
  • procedures addressing system maintenance
  • service provider contracts
  • service-level agreements
  • inventory and availability of spare parts
  • system security plan
  • other relevant documents or records

Interview

  • Organizational personnel with system maintenance responsibilities
  • organizational personnel with acquisition responsibilities
  • organizational personnel with information security responsibilities
  • system/network administrators

Test

  • Organizational processes for ensuring timely maintenance
Official relationships

Related controls

These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.

MITRE D3FEND semantic mapping

Related defensive techniques

D3FEND maps this base control or one of its enhancements to the following defensive techniques. The ontology relation label is preserved and does not by itself prove implementation or effectiveness.

MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.

Official NIST enhancements

Control enhancements

Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.

Official NIST control enhancement

MA-6(1) — Preventive Maintenance

Perform preventive maintenance on [Organization-defined: system components] at [Organization-defined: time intervals].

Official discussion

Preventive maintenance includes proactive care and the servicing of system components to maintain organizational equipment and facilities in satisfactory operating condition. Such maintenance provides for the systematic inspection, tests, measurements, adjustments, parts replacement, detection, and correction of incipient failures either before they occur or before they develop into major defects. The primary goal of preventive maintenance is to avoid or mitigate the consequences of equipment failures. Preventive maintenance is designed to preserve and restore equipment reliability by replacing worn components before they fail. Methods of determining what preventive (or other) failure management policies to apply include original equipment manufacturer recommendations; statistical failure records; expert opinion; maintenance that has already been conducted on similar equipment; requirements of codes, laws, or regulations within a jurisdiction; or measured values and performance indications.

Organization-defined parameters (2)
system componentssystem components on which preventive maintenance is to be performed are defined;
time intervalstime intervals within which preventive maintenance is to be performed on system components are defined;
Assessment objectives and methods

preventive maintenance is performed on [Organization-defined: system components] at [Organization-defined: time intervals].

Examine

  • Maintenance policy
  • procedures addressing system maintenance
  • service provider contracts
  • service-level agreements
  • maintenance records
  • list of system components requiring preventive maintenance
  • system security plan
  • other relevant documents or records

Interview

  • Organizational personnel with system maintenance responsibilities
  • organizational personnel with information security responsibilities
  • system/network administrators

Test

  • Organizational processes for preventive maintenance
  • mechanisms supporting and/or implementing preventive maintenance
Official NIST control enhancement

MA-6(2) — Predictive Maintenance

Perform predictive maintenance on [Organization-defined: system components] at [Organization-defined: time intervals].

Official discussion

Predictive maintenance evaluates the condition of equipment by performing periodic or continuous (online) equipment condition monitoring. The goal of predictive maintenance is to perform maintenance at a scheduled time when the maintenance activity is most cost-effective and before the equipment loses performance within a threshold. The predictive component of predictive maintenance stems from the objective of predicting the future trend of the equipment's condition. The predictive maintenance approach employs principles of statistical process control to determine at what point in the future maintenance activities will be appropriate. Most predictive maintenance inspections are performed while equipment is in service, thus minimizing disruption of normal system operations. Predictive maintenance can result in substantial cost savings and higher system reliability.

Organization-defined parameters (2)
system componentssystem components on which predictive maintenance is to be performed are defined;
time intervalstime intervals within which predictive maintenance is to be performed are defined;
Assessment objectives and methods

predictive maintenance is performed on [Organization-defined: system components] at [Organization-defined: time intervals].

Examine

  • Maintenance policy
  • procedures addressing system maintenance
  • service provider contracts
  • service-level agreements
  • maintenance records
  • list of system components requiring predictive maintenance
  • system security plan
  • other relevant documents or records

Interview

  • Organizational personnel with system maintenance responsibilities
  • organizational personnel with information security responsibilities
  • system/network administrators

Test

  • Organizational processes for predictive maintenance
  • mechanisms supporting and/or implementing predictive maintenance
Official NIST control enhancement

MA-6(3) — Automated Support for Predictive Maintenance

Transfer predictive maintenance data to a maintenance management system using [Organization-defined: automated mechanisms].

Official discussion

A computerized maintenance management system maintains a database of information about the maintenance operations of organizations and automates the processing of equipment condition data to trigger maintenance planning, execution, and reporting.

Organization-defined parameters (1)
automated mechanismsautomated mechanisms used to transfer predictive maintenance data to a maintenance management system are defined;
Assessment objectives and methods

predictive maintenance data is transferred to a maintenance management system using [Organization-defined: automated mechanisms].

Examine

  • Maintenance policy
  • procedures addressing system maintenance
  • service provider contracts
  • service-level agreements
  • maintenance records
  • list of system components requiring predictive maintenance
  • system security plan
  • other relevant documents or records

Interview

  • Organizational personnel with system maintenance responsibilities
  • organizational personnel with information security responsibilities
  • system/network administrators

Test

  • Automated mechanisms implementing the transfer of predictive maintenance data to a computerized maintenance management system
  • operations of the computer maintenance management system
Source record

Authoritative sources