Requirements 3.7
3.7 Maintenance: the NIST SP 800-171 requirements
The 6 requirements of family 3.7, Maintenance, in NIST SP 800-171 Rev 2, worth 18 points of a SPRS score under 32 CFR 170.24. For each: NIST's text, what it costs when not met, the objectives an assessor determines under NIST SP 800-171A, and how to meet it. To mark each one and work out your score, use the free calculator.
3.7.1 System Maintenance
Perform maintenance on organizational systems.
Points: 3 points.
Assessment objectives (NIST SP 800-171A)
- [a]system maintenance is performed.
How to meet it
Establish a documented maintenance program: a monthly patch cycle for OS and applications (automate with WSUS, Intune, or your RMM), firmware update reviews for network gear, and preventive maintenance records for servers and infrastructure. Consistent, logged patching is the core of this control for most small contractors. Evidence: the maintenance schedule, patch deployment reports, and maintenance tickets.
3.7.2 Maintenance Tool Control
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]tools used to conduct system maintenance are controlled.
- [b]techniques used to conduct system maintenance are controlled.
- [c]mechanisms used to conduct system maintenance are controlled.
- [d]personnel used to conduct system maintenance are controlled.
How to meet it
Control the tools used for maintenance: keep an approved list of remote support and diagnostic tools, remove unapproved remote-access utilities, and vet or supervise vendor-supplied tools before they touch your systems. Restrict maintenance tool installation to admin roles. Evidence: the approved tools list, endpoint reports showing no unauthorized remote tools, and vendor tool review notes.
3.7.3 Equipment Sanitization
Ensure equipment removed for off-site maintenance is sanitized of any CUI.
Points: 1 point.
Assessment objectives (NIST SP 800-171A)
- [a]equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI.
How to meet it
Before any device leaves the building for repair or warranty service, remove or sanitize CUI-bearing storage: pull the drive when possible, or cryptographically erase/wipe it per NIST SP 800-88, and record each event in a sanitization log. Where drives cannot be removed, require the vendor to sign data handling terms. Evidence: the off-site maintenance procedure and completed sanitization log entries.
3.7.4 Media Inspection
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
Points: 3 points.
Assessment objectives (NIST SP 800-171A)
- [a]media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI.
How to meet it
Scan any media containing diagnostic or test software with your antivirus/EDR before connecting it to production systems, and prefer downloading vendor tools directly over accepting USB media from technicians. Write this into your maintenance procedure so vendor visits follow it. Evidence: the procedure and logged scan results from maintenance events.
3.7.5 Nonlocal Maintenance
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]multifactor authentication is used to establish nonlocal maintenance sessions via external network connections.
- [b]nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete.
How to meet it
Require MFA on every remote maintenance path (vendor VPN accounts, remote support sessions, and your own admins working from home) and configure sessions to terminate when the work is done rather than persisting. Disable vendor accounts between uses and enable them only for scheduled maintenance windows. Evidence: MFA configuration on remote maintenance accounts, session logs showing termination, and the vendor account enable/disable records.
3.7.6 Maintenance Personnel
Supervise the maintenance activities of maintenance personnel without required access authorization.
Points: 1 point.
Assessment objectives (NIST SP 800-171A)
- [a]maintenance personnel without required access authorization are supervised during maintenance activities.
How to meet it
Escort and supervise any maintenance personnel who lack authorized access (copier technicians, HVAC contractors, unvetted IT vendors) while they work near systems or CUI, and log the visit with escort name and duration. A simple visitor/escort log plus a policy statement closes this control cheaply. Evidence: the escort policy and completed visit log entries.