FedRAMP Moderate Compliance Checklist for: (MA) Maintenance Control Family

The Maintenance (MA) control family ensures that information systems remain secure during maintenance, repair, and diagnostic activities. These controls establish processes for scheduling, approving, and monitoring maintenance work—whether performed on-site or remotely—while protecting sensitive information and maintaining system integrity. The family addresses the authorization and supervision of maintenance personnel, proper handling of maintenance tools and equipment, and timely acquisition of support services. These controls are critical because maintenance activities often require elevated access privileges and can introduce security vulnerabilities if not properly controlled and documented.

Security controls are written in a way that's unnecessarily complex and difficult to understand. We took the time to simplify the FedRAMP Moderate security controls so you don't have to. Here's a straightforward list of everything you need to do to implement the MA family:

Policy and Documentation

• MA-01: Develop comprehensive maintenance policy at organization-level, mission/business process-level, or system-level
• MA-01: Ensure maintenance policy addresses purpose, scope, roles, responsibilities, management commitment, coordination, and compliance
• MA-01: Verify maintenance policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines
• MA-01: Document procedures to facilitate implementation of the maintenance policy and associated controls
• MA-01: Designate an official to manage development, documentation, and dissemination of maintenance policy and procedures
• MA-01: Disseminate maintenance policy and procedures to organization-defined personnel or roles
• MA-01: Review and update maintenance policy at least every 3 years and following significant changes
• MA-01: Review and update maintenance procedures at least annually and following significant changes

Controlled Maintenance

• MA-02: Schedule maintenance, repair, and replacement activities according to manufacturer/vendor specifications and organizational requirements
• MA-02: Document all maintenance, repair, and replacement activities on system components
• MA-02: Review maintenance records regularly to ensure compliance
• MA-02: Approve all maintenance activities before they are performed (on-site or remote)
• MA-02: Monitor all maintenance activities whether performed on-site or remotely
• MA-02: Establish explicit approval process for removal of systems or components from organizational facilities
• MA-02: Define specific personnel or roles authorized to approve off-site maintenance
• MA-02: Identify types of information that must be sanitized from equipment before off-site maintenance
• MA-02: Sanitize equipment to remove sensitive information before off-site maintenance, repair, or replacement
• MA-02: Verify all potentially impacted security controls are functioning properly after maintenance activities
• MA-02: Define specific information to be included in maintenance records
• MA-02: Maintain comprehensive maintenance records with organization-defined information

Maintenance Tools

• MA-03: Establish approval process for system maintenance tools
• MA-03: Control and restrict access to approved maintenance tools
• MA-03: Monitor the use of all system maintenance tools
• MA-03: Review previously approved maintenance tools at least annually
• MA-03(01): Inspect maintenance tools used by personnel for improper modifications
• MA-03(01): Inspect maintenance tools used by personnel for unauthorized modifications
• MA-03(02): Check diagnostic and test program media for malicious code before use in the system
• MA-03(02): Establish procedure for malware scanning of maintenance media
• MA-03(03): Implement controls to prevent unauthorized removal of maintenance equipment containing organizational information
• MA-03(03): Verify maintenance equipment contains no organizational information before removal from facility
• MA-03(03): Sanitize or destroy maintenance equipment that cannot be cleared of organizational information
• MA-03(03): Retain maintenance equipment within facility when it contains organizational information
• MA-03(03): Establish exemption process requiring information owner authorization for equipment removal

Nonlocal Maintenance

• MA-04: Establish approval process for nonlocal (remote) maintenance and diagnostic activities
• MA-04: Monitor all nonlocal maintenance and diagnostic activities
• MA-04: Document organizational policy for use of nonlocal maintenance tools
• MA-04: Document nonlocal maintenance requirements in system security plan
• MA-04: Implement strong authentication for nonlocal maintenance sessions
• MA-04: Maintain detailed records of all nonlocal maintenance and diagnostic activities
• MA-04: Terminate sessions and network connections immediately upon completion of nonlocal maintenance

Maintenance Personnel

• MA-05: Establish formal process for authorizing maintenance personnel
• MA-05: Maintain current list of authorized maintenance organizations
• MA-05: Maintain current list of authorized maintenance personnel
• MA-05: Verify non-escorted maintenance personnel possess required access authorizations
• MA-05: Designate organizational personnel with appropriate clearances to supervise maintenance activities
• MA-05: Ensure supervisory personnel have required access authorizations
• MA-05: Ensure supervisory personnel have technical competence to oversee maintenance work

Timely Maintenance

• MA-06: Identify critical system components requiring maintenance support
• MA-06: Define acceptable time periods for obtaining maintenance support after component failure
• MA-06: Establish agreements or contracts for timely maintenance support
• MA-06: Establish agreements or contracts for spare parts procurement
• MA-06: Ensure maintenance support can be obtained within defined timeframes