Controlled Maintenance MA-2

Source: NIST SP 800-53 Rev.5, Maintenance family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

MA-2 (Controlled Maintenance) is about doing maintenance on purpose and leaving a trail: schedule it, approve it, record what was done, and check that nothing security-relevant broke afterward. It applies whether the work is done on the box or remotely, and it sits in the Low baseline.

What good looks like

• Schedule and approve maintenance before it happens — patching, disk swaps, kernel upgrades — rather than changing the box ad hoc.
• Keep a maintenance record: what was done, when, by whom, and whether it was on-site or remote.
• Sanitize media before it leaves — if a disk or the server goes off-site for repair, remove sensitive data first.
• Re-check security controls after the work — confirm the firewall, logging, and access settings still behave as expected.
• Review the records periodically so approvals and outcomes actually get looked at.

Framework mapping

• NIST CSF 2.0 — ID.AM-08 — Systems, hardware, software, services, and data are managed throughout their life cycles

How to move it toward Implemented

• Keep a dated maintenance log for the server, and capture the package history that backs each entry with grep -E 'install|upgrade|remove' /var/log/dpkg.log (Debian/Ubuntu) or dnf history (Red Hat family).
• After patching, verify the box came back clean: systemctl --failed, uptime, and a check that logging and the firewall are still up (systemctl status auditd ufw).
• If any drive is retired or sent out, wipe it first (shred, blkdiscard, or nvme sanitize) and note it on the log.
• Attach the maintenance log and the post-maintenance check as hardening evidence on the asset, naming MA-2 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.