Hardware fails. MA-6 Timely Maintenance in NIST SP 800-53 Rev 5 asks whether you have arranged, ahead of time, to get support or spare parts within a set period after a failure. The statement has two blanks that you fill in: which components, and how long.
800-53 binds US federal systems and, by contract, some suppliers. For others it is a reference, and the idea is useful for any team that runs its own equipment.
What it means in practice
Pick the components that would hurt most if they stopped. The guidance says to name components whose loss raises risk to operations, assets or people. Then decide a recovery time for each and make sure a contract, spare or cloud alternative can meet it.
Support contracts are the usual answer. The guidance mentions having appropriate contracts in place.
Evidence to collect
- The list of critical components and the time target for each.
- Support or warranty contracts showing response times.
- A spares inventory or a vendor agreement for parts.
- A record of a past failure and how fast support responded.
Common gaps
Targets that were never written down. Support contracts that lapsed. A spare that sits in a drawer with a different firmware version than production.
If you run entirely in the cloud, the provider carries most of this. Document that, and look at your own single points of failure.
How to implement it
Write a one page table, check contract dates twice a year and confirm response times match your targets. The enhancements MA-6.1 Preventive Maintenance, MA-6.2 Predictive Maintenance and MA-6.3 Automated Support for Predictive Maintenance go further, if you want to fix things before they fail.
Quick check
What two values does an organization choose for MA-6?
The system components in scope and the time period within which support or parts must be obtained after failure.
