Nonlocal Maintenance MA-4
Maintenance · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds MA-4 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Maintenance family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
MA-4 (Nonlocal Maintenance) covers maintenance done over the network — remote administration and diagnostics — where nobody is physically at the machine. The risk is the remote channel itself, so it must be approved, strongly authenticated, recorded, and closed cleanly. It sits in the Low baseline.
What good looks like
- Approve and monitor remote maintenance — on this box that means administrative SSH (Secure Shell, an encrypted remote-login protocol) sessions.
- Use strong authentication for those sessions — keys or MFA (Multi-Factor Authentication, proving identity with more than a password), never a lone password.
- Allow only what policy permits, and write the approved remote-maintenance methods into the system security plan.
- Keep records of remote sessions — who connected, when, and from where.
- Terminate the session and its network connection when the work is done; do not leave idle admin sessions open.
Framework mapping
- CIS Controls v8 — Control 4 — Secure Configuration of Enterprise Assets and Software
How to move it toward Implemented
- Harden the remote-maintenance channel: in
/etc/ssh/sshd_configsetPasswordAuthentication noandPermitRootLogin no, and require keys (add MFA with a one-time-password module where available). - Auto-close idle sessions with
ClientAliveIntervalandClientAliveCountMax, then apply withsystemctl reload sshd. - Capture session records for evidence:
lastandlastlogfor logins, plus the SSH authentication log (journalctl -u sshor/var/log/auth.log). - Attach the
sshd_configand a dated session log as hardening evidence on the asset, namingMA-4in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.