Field maintenance is work done on a system after it has been deployed to its site, rather than at a depot or factory. NIST SP 800-53 Rev 5 control MA-7 says to restrict or prohibit field maintenance on chosen systems or components, and to a chosen set of places or conditions.
800-53 binds US federal systems and some suppliers by contract. Everyone else can treat it as a reference.
What it means in practice
The guidance explains the worry. Work at the site may not get the same quality checks as work at a depot. For systems you designate as critical, it may be better to send the unit back, or to forbid anyone to open it in place.
For a company this could be a hardware security module, a payment terminal fleet, or an edge device in a customer location. Decide which devices only the manufacturer or an approved depot may service.
Evidence to collect
- The list of systems where field maintenance is restricted or prohibited.
- The policy statement and who may grant an exception.
- Exception records.
- Depot or return records for serviced units.
Common gaps
No list of designated systems. An on site technician replaced a part on a restricted device and nobody noticed. Tamper seals were not checked after a visit.
How to implement it
Choose the devices, write the rule, tag the devices in your asset inventory and make the service vendor aware. Pair it with MA-5 for personnel and MA-3 for tools. There are no enhancements for this control.
Quick check
Does MA-7 ban all field maintenance?
No. It lets you restrict or prohibit it on the systems or components you choose.
