Subcontractor CMMC Tracker
Families

Maintenance (MA): the 6 CMMC Level 2 requirements a subcontractor self-assesses

The Maintenance family of NIST SP 800-171 Rev 2, as CMMC Level 2 numbers it: each requirement with the value it carries in the score, our statement of the clause, and the evidence an assessor asks for.

Where frameworks a subcontractor holds may supply evidence here

The requirements

6
CMMC L2 MA.L2-3.7.1Perform Maintenance 3 points in the score

Carry out maintenance on organizational systems, so the scheduled and corrective upkeep those systems require is actually performed and recorded.

What an assessor asks to see: Maintenance schedule covering in scope systems; Completed maintenance records showing work performed and by whom; Evidence maintenance covers both routine and corrective work
Where subcontractors usually fall short: Maintenance performed but never recorded; Only corrective repair occurs with no scheduled maintenance; Systems in scope for CUI omitted from the maintenance regime
Source: CMMC 2.0 Level 2 (NIST SP 800-171 Rev 2)
CMMC L2 MA.L2-3.7.2System Maintenance Control 5 points in the score

Place controls over the tools, techniques and mechanisms used for system maintenance, and over the personnel who carry it out.

What an assessor asks to see: Approved maintenance tool inventory and control procedure; Authorization records for maintenance personnel; Evidence maintenance tools are checked before use
Where subcontractors usually fall short: Personnel controlled while tools are unmanaged; Technicians bring unapproved diagnostic tools on site; No authorization list for who may perform maintenance
Source: CMMC 2.0 Level 2 (NIST SP 800-171 Rev 2)
CMMC L2 MA.L2-3.7.3Equipment Sanitization 1 point in the score

Remove CUI from equipment by sanitization before that equipment leaves the organization for off site maintenance.

What an assessor asks to see: Sanitization procedure for equipment leaving for maintenance; Sanitization records tied to specific equipment; Verification step confirming CUI removal
Where subcontractors usually fall short: Equipment sent to vendors without sanitization; Sanitization claimed but not verified or recorded; Embedded storage in peripherals overlooked
Source: CMMC 2.0 Level 2 (NIST SP 800-171 Rev 2)
CMMC L2 MA.L2-3.7.4Media Inspection 3 points in the score

Scan media holding diagnostic and test programs for malicious code before that media is connected to organizational systems.

What an assessor asks to see: Procedure requiring scanning of diagnostic media; Scan records for media used during maintenance; Control preventing unscanned media from being connected
Where subcontractors usually fall short: Vendor supplied media trusted without scanning; Procedure exists but no evidence of scans performed; Scanning applied to organizational media only
Source: CMMC 2.0 Level 2 (NIST SP 800-171 Rev 2)
CMMC L2 MA.L2-3.7.5Nonlocal Maintenance 5 points in the score

Authenticate nonlocal maintenance sessions opened across external networks using multiple factors, and close those sessions once the maintenance work finishes.

What an assessor asks to see: Multifactor configuration for nonlocal maintenance access; Records of maintenance session establishment and termination; Procedure requiring termination at completion
Where subcontractors usually fall short: Vendor maintenance accounts exempt from multifactor; Sessions left open after work completes; Termination relies on the vendor rather than the organization
Source: CMMC 2.0 Level 2 (NIST SP 800-171 Rev 2)
CMMC L2 MA.L2-3.7.6Maintenance Personnel 1 point in the score

Supervise maintenance personnel who do not hold the access authorization normally required, for the duration of their work.

What an assessor asks to see: Procedure requiring supervision of unauthorized maintenance personnel; Supervision or escort records naming the supervisor; Authorization status check performed before work begins
Where subcontractors usually fall short: Vendor technicians left unattended; Escort recorded at entry but not throughout the work; No check of whether the technician is authorized
Source: CMMC 2.0 Level 2 (NIST SP 800-171 Rev 2)