MA-2 Controlled Maintenance deals with the security side of keeping equipment working. Servicing, repairing and replacing parts can expose data and weaken controls. This control makes that work scheduled, approved, recorded and checked.
800-53 binds US federal systems and contract holders. For other organizations it is a reference. Reviewers of data centers, offices and hardware heavy products tend to ask these questions.
What the control asks
The statement has six parts:
- Schedule, document and review records of maintenance, repair and replacement on system components, in line with vendor specifications or your own requirements.
- Approve and monitor all maintenance, on site or remote, and whether the equipment is serviced in place or taken elsewhere.
- Require designated people to approve removal of equipment from your facilities for off site service.
- Sanitize equipment of defined information from associated media before it leaves for off site maintenance, repair or replacement.
- Check all potentially affected controls afterward to confirm they still function.
- Include defined information in maintenance records.
What it means in practice
NIST applies it to local and nonlocal entities and includes peripherals such as scanners, copiers and printers. It lists what an effective record contains: date and time, description of the work, names of the people doing it, the name of the escort, and components removed or replaced. It also tells you to consider supply chain risks tied to replacement components.
The post maintenance check is easy to forget. After a firmware update or a hardware swap, logging, encryption settings and access rules can silently revert.
Evidence to collect
- A maintenance schedule for network gear, servers and critical devices.
- A maintenance log with the fields NIST lists.
- Approval records for off site removal.
- Sanitization certificates for drives that left the premises.
- A post maintenance verification checklist with results.
- Vendor visit sign in records and escort names.
Start with knowing what you own. An asset inventory tells you which components need a schedule at all.
Click through it at your own pace, or open it full screen.
Common gaps
Equipment repaired by the manufacturer with the drive still in it. Maintenance logs that list the date and nothing else. No check that security settings survived an update. Replacement parts bought from unvetted sources.
The record lists two enhancements: MA-2.1 Record Content and MA-2.2 Automated Maintenance Activities. In the Rev 5 OSCAL catalog MA-2.1 is withdrawn and incorporated into MA-2 itself, which is why the base statement already carries the record content requirement. MA-2.2 covers automating maintenance scheduling and records.
How to implement it
Keep one maintenance register. Require a ticket before any service and a named approver for removal. Wipe or remove media before shipping. Add a verification step to your change template. Buy spares from authorized channels.
Quick check
What information does NIST say a maintenance record needs?
Date and time, a description of the work, names of those performing it, the escort's name, and the components removed or replaced.
Why check controls after maintenance?
Repairs and replacements can change or disable controls. MA-2 requires verifying that potentially affected controls still work.
