Remote support is how most small teams fix things. A vendor connects to a database host at night, a contractor opens a shell on a server, an engineer joins a diagnostic session from home. NIST SP 800-53 Rev 5 control MA-4 Nonlocal Maintenance is the control that governs all of it.
SP 800-53 binds US federal systems and, by contract, some of their suppliers. If you are not in that group it is still a clear checklist for remote maintenance, and a customer security review may ask the same questions in different words.
What the control asks
The statement has five parts. You approve and monitor nonlocal maintenance and diagnostic activity. You allow only the tools your policy permits and document them in the system security plan. You use strong authentication to set up each session. You keep records of the activity. You terminate the session and network connection when the work is done.
The guidance defines nonlocal as work done by people who communicate through an external or internal network. Local work is done by someone physically present. A person on the corporate VPN fixing a server counts as nonlocal.
Authentication should follow the network access requirements in IA-2, and strong authentication means more than a password. Multifactor is the usual answer.
What it means in practice
Every remote maintenance path needs an owner, an approval, a strong login, a record and an end. If a vendor can reach your systems without any of those, the control is not met.
The hard part is the word every. Remote access tends to grow by accident: a shared jump host, a vendor VPN account created for one project and never removed, a remote desktop tool someone installed during an outage.
Evidence to collect
- The list of approved remote maintenance tools and the policy that permits them.
- The section of your system security plan that documents them.
- Authentication settings showing multifactor on the maintenance path.
- Session logs with who, what system, start time and end time.
- Tickets or approvals tied to specific maintenance windows.
- Proof that sessions time out or are closed, such as idle timeout settings or a disconnect log.
Common gaps
Shared accounts used by a vendor, so logs show a name nobody can trace to a person. Sessions that stay open for weeks. A remote tool in use that is not on the approved list. Logs that exist but nobody reads, which matters because the MA-4.1 Logging and Review enhancement asks for review of the records.
Another common gap is a vendor who connects directly to production with the same trust level as an employee.
How to implement it
Route all remote maintenance through one controlled path, such as a bastion host or privileged access tool. Require multifactor and named accounts. Use time limited access that expires on its own. Send session logs to central storage and sample them on a schedule.
The other enhancements are worth reading. MA-4.3 Comparable Security and Sanitization, MA-4.4 Authentication and Separation of Maintenance Sessions, MA-4.5 Approvals and Notifications, MA-4.6 Cryptographic Protection and MA-4.7 Disconnect Verification each tighten one part of the picture. MA-4.2 Document Nonlocal Maintenance is withdrawn in Rev 5, with its content folded into the base control. MA-4.6 is the one most teams already meet, since encrypted channels are the norm.
Checking that the controls keep working is its own task. A continuous monitoring view helps here.
Click through it at your own pace, or open it full screen.
Quick check
Does a VPN session from an employee at home count as nonlocal maintenance?
Yes. The guidance defines nonlocal as activity by people communicating through an external or internal network. Only someone physically present is local.
What are the five things MA-4 asks for?
Approve and monitor, allow only policy approved tools documented in the security plan, use strong authentication, keep records, and terminate the session when done.
Do mappings to SOC 2 or ISO 27001 exist?
Several published mappings exist and they differ. Check the one your customer or auditor names.
