MA.L2-3.7.1 Perform Maintenance

CMMC Practice MA.L2-3.7.1 – Perform Maintenance: Perform maintenance on organizational systems.

Links to Publicly Available Resources

Discussion [NIST SP 800-171 R2]
This requirement addresses the information security aspects of the system maintenance program and applies to all types of maintenance to any system component (including hardware, firmware, applications) conducted by any local or nonlocal entity. System maintenance also includes those components not directly associated with information processing and data or information retention such as scanners, copiers, and printers.

Further Discussion
One common form of computer security maintenance is regular patching of discovered vulnerabilities in software and operating systems, though there are others that require attention.
System maintenance includes:

  • corrective maintenance (e.g., repairing problems with the technology);
  • preventative maintenance (e.g., updates to prevent potential problems);
  • adaptive maintenance (e.g., changes to the operative environment); and
  • perfective maintenance (e.g., improve operations).