CMMC 2.0 • LEVEL 2 • MAINTENANCE

MA.L2-3.7.6 — Maintenance Personnel

Establish a process for maintenance personnel authorization. Maintain a list of authorized maintenance organizations or personnel. Verify that non-escorted personnel who perform maintenance on the system possess the required access authorizations. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

NIST 800-171 Mapping

NIST 800-53 Controls

MA-6

Assessment Objectives

  • a process for maintenance personnel authorization is established.
  • a list of authorized maintenance organizations or personnel is maintained.
  • organizational personnel with required access authorizations are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.
  • organizational personnel with required technical competence are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.
  • non-escorted personnel who perform maintenance on the system possess the required access authorizations.

Practitioner Notes

Practitioner commentary coming soon.

Related CMMC 2.0 Practices

MA.L2-3.7.1 Perform Maintenance on Organizational Systems MA.L2-3.7.2 Provide Controls on the Tools, Techniques, Mechanisms, and Personnel Used to Conduct System Maintenance MA.L2-3.7.3 Ensure Equipment Removed for Off-Site Maintenance Is Sanitized of Any CUI MA.L2-3.7.4 Maintenance Tools