NIST 800-171 3.7.2 (MA.L2-3.7.2): Maintenance Tools
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
CMMC Level 2 practice MA.L2-3.7.2
What 3.7.2 means in practice
Control what is used to maintain systems and who uses it: approved diagnostic tools, remote support software, the techniques allowed and the technicians themselves. Unknown tools and unvetted remote support are common ways in.
SPRS points and the CMMC POA&M
- CMMC Level 2 practice
- MA.L2-3.7.2
- SPRS points
- 5 points. When it is not met, the DoD Assessment Methodology subtracts 5 from the score of 110.
- CMMC POA&M
- Not allowed. It is worth 5 points, and 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point, with one exception: 3.13.11 when encryption is used but not FIPS validated.
Sources: NIST SP 800-171 DoD Assessment Methodology, version 1.2.1 (June 24, 2020), Annex A; 32 CFR 170.21, Plan of Action and Milestones requirements.
What an assessor checks for 3.7.2
NIST SP 800-171A gives 4 determination statements for 3.7.2, each found satisfied or other than satisfied. Determine if:
- 3.7.2[a] tools used to conduct system maintenance are controlled.
- 3.7.2[b] techniques used to conduct system maintenance are controlled.
- 3.7.2[c] mechanisms used to conduct system maintenance are controlled.
- 3.7.2[d] personnel used to conduct system maintenance are controlled.
NIST SP 800-171A (June 2018), assessment objectives for 3.7.2
Evidence that shows 3.7.2 is met
- An approved list of maintenance tools and remote support software.
- Controls on who may use them, such as restricted accounts or check-out logs.
- Records of maintenance personnel and their authorization.
How PolicyCortex gathers the evidence
No PolicyCortex collector reads the evidence for 3.7.2. Your team provides the evidence listed above.
Meet the requirement once. Keep the evidence current.
- Published
- Last updated
- Unchanged since publication