Timely Maintenance MA-6

Source: NIST SP 800-53 Rev.5, Maintenance family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

MA-6 (Timely Maintenance) is about being able to fix or replace critical parts fast enough. Decide which components matter, set a target time to restore them after a failure, and line up the support or spare parts to hit it. It enters at the Moderate baseline.

What good looks like

• Identify the components that matter — the parts whose failure would take the server down (disks, power supply, boot volume).
• Set a target time to obtain support or a spare after a failure — the maximum downtime you can accept.
• Line up the source in advance — a support contract, a vendor, or on-hand spares — so you are not shopping mid-outage.
• Keep the operating system in support so security fixes keep arriving — track its End-of-Life date.
• This pairs with contingency planning — timely parts only help if you also know how to restore.

Framework mapping

• NIST CSF 2.0 — ID.AM-08 — Systems, hardware, software, services, and data are managed throughout their life cycles

How to move it toward Implemented

• List the critical components and, next to each, the target restore time and where the support or spare comes from.
• Confirm the operating system is still in a supported window: check /etc/os-release against the distribution’s support schedule (for example, an Ubuntu LTS (Long-Term Support) release, supported for five years).
• Note the current hardware and support status — lsblk, smartctl -H for disk health, and any vendor warranty or contract reference — so the plan reflects the real box.
• Attach the component list with target times and the support and End-of-Life (EOL) check as hardening evidence on the asset, naming MA-6 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.