Maintenance Personnel MA-5

Source: NIST SP 800-53 Rev.5, Maintenance family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

MA-5 (Maintenance Personnel) is about who is allowed to maintain the system. Keep a list of authorized maintenance people, confirm anyone working unescorted has the required access, and have a competent, cleared person supervise anyone who does not. It is a personnel-process control in the Low baseline.

What good looks like

• Keep an authorized-maintenance list — the named people (and any outside vendors) allowed to work on the server.
• Verify authorization before unescorted work — no one maintains the box on their own without the required access.
• Escort and supervise anyone without that access, using someone who is both cleared and technically competent.
• Tie maintenance access to named accounts, not shared logins, so the list and the real access match.
• Update the list when people join, leave, or change roles so it never drifts from reality.

Framework mapping

How to move it toward Implemented

• Write a short authorized-maintenance-personnel list: names, roles, any vendors, and who approves adding someone.
• Back it with the actual access on the box — the named admin accounts and who holds sudo, from getent group sudo (or wheel) and /etc/sudoers.d/ — and confirm the two lists match.
• Write down the escort-and-supervise rule for anyone not on the list, naming who is authorized to supervise.
• Attach the personnel list and the matching access review as hardening evidence on the asset, naming MA-5 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.