Control statement
Obtain maintenance support and/or spare parts for [Organization-defined: system components] within [Organization-defined: time period] of failure.
Discussion
Organizations specify the system components that result in increased risk to organizational operations and assets, individuals, other organizations, or the Nation when the functionality provided by those components is not operational. Organizational actions to obtain maintenance support include having appropriate contracts in place.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Timely Maintenance as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to controlled maintenance, trusted tools, authorized personnel, and monitored support access.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- maintenance schedules and tickets
- tool approval records
- remote maintenance session logs
- maintenance personnel authorization
Common failure patterns
- vendor access left enabled permanently
- unapproved diagnostic tools introduced
- maintenance bypasses normal change control
- remote sessions not monitored or terminated
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
maintenance support and/or spare parts are obtained for [Organization-defined: system components] within [Organization-defined: time period] of failure.
Examine
- Maintenance policy
- procedures addressing system maintenance
- service provider contracts
- service-level agreements
- inventory and availability of spare parts
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with acquisition responsibilities
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Organizational processes for ensuring timely maintenance
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Related defensive techniques
D3FEND maps this base control or one of its enhancements to the following defensive techniques. The ontology relation label is preserved and does not by itself prove implementation or effectiveness.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
MA-6(1) — Preventive Maintenance
Perform preventive maintenance on [Organization-defined: system components] at [Organization-defined: time intervals].
Official discussion
Preventive maintenance includes proactive care and the servicing of system components to maintain organizational equipment and facilities in satisfactory operating condition. Such maintenance provides for the systematic inspection, tests, measurements, adjustments, parts replacement, detection, and correction of incipient failures either before they occur or before they develop into major defects. The primary goal of preventive maintenance is to avoid or mitigate the consequences of equipment failures. Preventive maintenance is designed to preserve and restore equipment reliability by replacing worn components before they fail. Methods of determining what preventive (or other) failure management policies to apply include original equipment manufacturer recommendations; statistical failure records; expert opinion; maintenance that has already been conducted on similar equipment; requirements of codes, laws, or regulations within a jurisdiction; or measured values and performance indications.
Organization-defined parameters (2)
Assessment objectives and methods
preventive maintenance is performed on [Organization-defined: system components] at [Organization-defined: time intervals].
Examine
- Maintenance policy
- procedures addressing system maintenance
- service provider contracts
- service-level agreements
- maintenance records
- list of system components requiring preventive maintenance
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Organizational processes for preventive maintenance
- mechanisms supporting and/or implementing preventive maintenance
MA-6(2) — Predictive Maintenance
Perform predictive maintenance on [Organization-defined: system components] at [Organization-defined: time intervals].
Official discussion
Predictive maintenance evaluates the condition of equipment by performing periodic or continuous (online) equipment condition monitoring. The goal of predictive maintenance is to perform maintenance at a scheduled time when the maintenance activity is most cost-effective and before the equipment loses performance within a threshold. The predictive component of predictive maintenance stems from the objective of predicting the future trend of the equipment's condition. The predictive maintenance approach employs principles of statistical process control to determine at what point in the future maintenance activities will be appropriate. Most predictive maintenance inspections are performed while equipment is in service, thus minimizing disruption of normal system operations. Predictive maintenance can result in substantial cost savings and higher system reliability.
Organization-defined parameters (2)
Assessment objectives and methods
predictive maintenance is performed on [Organization-defined: system components] at [Organization-defined: time intervals].
Examine
- Maintenance policy
- procedures addressing system maintenance
- service provider contracts
- service-level agreements
- maintenance records
- list of system components requiring predictive maintenance
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Organizational processes for predictive maintenance
- mechanisms supporting and/or implementing predictive maintenance
MA-6(3) — Automated Support for Predictive Maintenance
Transfer predictive maintenance data to a maintenance management system using [Organization-defined: automated mechanisms].
Official discussion
A computerized maintenance management system maintains a database of information about the maintenance operations of organizations and automates the processing of equipment condition data to trigger maintenance planning, execution, and reporting.
Organization-defined parameters (1)
Assessment objectives and methods
predictive maintenance data is transferred to a maintenance management system using [Organization-defined: automated mechanisms].
Examine
- Maintenance policy
- procedures addressing system maintenance
- service provider contracts
- service-level agreements
- maintenance records
- list of system components requiring predictive maintenance
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system maintenance responsibilities
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Automated mechanisms implementing the transfer of predictive maintenance data to a computerized maintenance management system
- operations of the computer maintenance management system
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.