Maintenance Tools MA-3

Source: NIST SP 800-53 Rev.5, Maintenance family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

MA-3 (Maintenance Tools) is about controlling the tools used to maintain the system — diagnostic scripts, admin utilities, USB (Universal Serial Bus) media — so a ‘repair’ tool cannot quietly become an attack tool. Approve which tools are allowed, watch how they are used, and re-review the list. It enters at the Moderate baseline.

What good looks like

• Approve a known set of maintenance tools — the admin and diagnostic utilities allowed on the box — instead of ‘whatever someone brings.’
• Control access to those tools so only authorized admins can run them.
• Monitor their use — log when powerful maintenance tools run, and who ran them.
• Inspect removable media (like a USB stick) for malicious code before it touches the server (enhancement MA-3(2)).
• Re-review the approved list on a schedule so stale or risky tools get removed, and so unauthorized tools cannot be carried off with data.

Framework mapping

• NIST CSF 2.0 — PR.PS-02 — Software is maintained, replaced, and removed commensurate with risk
• CIS Controls v8 — Control 2 — Inventory and Control of Software Assets

How to move it toward Implemented

• Write down the approved maintenance-tool list, then reconcile it against what is installed: dpkg -l or rpm -qa, plus the admin binaries in /usr/sbin.
• Restrict the tools to admins — keep sensitive utilities out of world-executable paths and gate them behind sudo in /etc/sudoers.d/.
• Turn on usage logging with the audit daemon: add an auditctl -w watch on key tool paths (or rules in /etc/audit/rules.d/), then review with ausearch.
• Attach the approved-tool list, the sudoers and audit rules, and a sample ausearch log as hardening evidence on the asset, naming MA-3 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.