---
title: "NIST 800-171 3.7 Maintenance"
description: "The 6 NIST SP 800-171 Maintenance requirements (3.7, CMMC MA): text, SPRS points, POA&M rules and evidence."
url: https://policycortex.com/nist-800-171/maintenance
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/maintenance
records: 4
digest: sha3:2bc26981606b703ce0c04f9be6c2ac55adf2761aed6db141b10bead852dc1e50
---

# NIST 800-171 3.7 Maintenance

NIST 800-171 / Maintenance

Maintenance covers how systems are serviced and repaired: scheduled maintenance, controlled tools and technicians, sanitized equipment leaving for repair, checked diagnostic media, protected remote maintenance and supervised visitors.

6 requirements · up to 18 SPRS points · 2 can go on a CMMC POA&M

## The 6 Maintenance requirements

| Requirement | CMMC practice | SPRS points | Requirement text |
|---|---|---|---|
| [3.7.1 System Maintenance](https://policycortex.com/nist-800-171/maintenance/3.7.1) | MA.L2-3.7.1 | 3 points | Perform maintenance on organizational systems. |
| [3.7.2 Maintenance Tools](https://policycortex.com/nist-800-171/maintenance/3.7.2) | MA.L2-3.7.2 | 5 points | Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. |
| [3.7.3 Off-Site Maintenance](https://policycortex.com/nist-800-171/maintenance/3.7.3) | MA.L2-3.7.3 | 1 point | Ensure equipment removed for off-site maintenance is sanitized of any CUI. |
| [3.7.4 Diagnostic Media Checks](https://policycortex.com/nist-800-171/maintenance/3.7.4) | MA.L2-3.7.4 | 3 points | Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. |
| [3.7.5 Nonlocal Maintenance](https://policycortex.com/nist-800-171/maintenance/3.7.5) | MA.L2-3.7.5 | 5 points | Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. |
| [3.7.6 Maintenance Personnel](https://policycortex.com/nist-800-171/maintenance/3.7.6) | MA.L2-3.7.6 | 1 point | Supervise the maintenance activities of maintenance personnel without required access authorization. |

## Maintenance: points and the CMMC POA&M

**Q: How many SPRS points can the Maintenance family cost?**
A: Up to 18 of the 313 points a score can lose: 2 worth 5 points, 2 worth 3 and 2 worth 1.

**Q: Which Maintenance requirements can go on a CMMC POA&M?**
A: 2 of the 6: 3.7.3 and 3.7.6, worth 1 point each. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.

## Related pages

- **Calculator**: [SPRS score calculator: mark the Maintenance requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-MA)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Previous family**: [3.6 Incident Response](https://policycortex.com/nist-800-171/incident-response)
- **Next family**: [3.8 Media Protection](https://policycortex.com/nist-800-171/media-protection)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | FAMILY | a768559f3f5c | beb81e77213a |
| REC 0001 | REQUIREMENTS | 7b7df5abb7e2 | a768559f3f5c |
| REC 0002 | POINTS AND POA&M | 4ccef3ad47bf | 7b7df5abb7e2 |
| REC 0003 | RELATED | 2bc26981606b | 4ccef3ad47bf |

Head sha3:2bc26981606b703ce0c04f9be6c2ac55adf2761aed6db141b10bead852dc1e50. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.