Think about who has actually repaired, patched or serviced your systems in the past year. Employees, yes. Also the hardware vendor, the managed service provider, the contractor who fixed the network closet, and the person who came to replace a failed disk. NIST SP 800-53 Rev 5 control MA-5 Maintenance Personnel asks you to control that group on purpose.
800-53 binds US federal systems and, through contracts, some of their suppliers. For a small or mid size company it is a reference worth borrowing from, particularly when a customer asks how you manage outside technicians.
What the control asks
Three requirements. First, establish a process for authorizing maintenance personnel, and keep a list of authorized maintenance organizations or people. Second, verify that people who work without an escort hold the required access authorizations. Third, designate staff with the right access and technical skill to supervise maintenance by people who lack the authorizations.
The guidance separates two ideas. Technical competence is about the maintenance itself. Required access authorizations are about being on or near the system. It also points to PE-2, which covers physical access for people whose maintenance duties put them inside the protected perimeter.
What it means in practice
There is a list, and the list has names or organizations on it. A person who is not on it does not work alone. They are escorted and watched by someone who understands what they are doing, because an escort who cannot tell a normal repair from a bad one is only a chaperone.
This applies to remote work as well as on site visits. The remote side is covered in MA-4.
Evidence to collect
- The authorized maintenance organizations and personnel list, with a date and an owner.
- The process document describing how people get added and removed.
- Contracts or work orders that name the vendor and the scope.
- Visitor and escort logs for maintenance visits, with the supervisor named.
- Records that supervisors were designated, including their qualifications.
- Review records showing the list was checked and stale entries removed.
Common gaps
The list is a vendor name with no individuals, so nobody can show that the person who showed up was approved. A former vendor technician still has a badge. Visits are logged at the front desk but the log never mentions the supervisor. The escort was whoever was nearby.
Another gap is the managed provider that subcontracts. Their staff change often and your list does not.
How to implement it
Start with a table: organization, individuals, systems in scope, access level, escort required, last review date. Tie additions to a ticket with a sponsor inside your company. Review the list quarterly or when a contract ends. Name two or three supervisors per site and record why they are qualified.
Then look at the enhancements for your situation. MA-5.1 Individuals Without Appropriate Access is the one most relevant to small teams, since it covers escorts and monitoring when someone lacks access. MA-5.5 Non-system Maintenance covers people who work near a system without servicing it. The others (MA-5.2 Security Clearances for Classified Systems, MA-5.3 Citizenship Requirements for Classified Systems and MA-5.4 Foreign Nationals) apply to classified environments and most commercial companies can note them as not applicable.
Your outside maintenance providers are also vendors. A formal vendor review catches the question of who their staff are.
Click through it at your own pace, or open it full screen.
Quick check
Can an unapproved technician work alone on a system?
Not under MA-5. Unescorted personnel must hold the required access authorizations. Others need supervision by designated staff.
Which enhancements apply to classified systems?
MA-5.2 and MA-5.3 cover security clearances and citizenship, and MA-5.4 covers foreign nationals. A commercial company usually records them as not applicable.
