Skip to content
CMMC 2.13
CMMC · Rev 2.132FAMILY MA

MA.L2-3.7.1

Perform Maintenance

Requirement

Perform maintenance on organizational systems.

Further discussion

One common form of computer security maintenance is regular patching of discovered vulnerabilities in software and operating systems, though there are others that require attention. System maintenance includes: • corrective maintenance (e.g., repairing problems with the technology); • preventative maintenance (e.g., updates to prevent potential problems); • adaptive maintenance (e.g., changes to the operative environment); and • perfective maintenance (e.g., improve operations). Example You are responsible for maintenance activities on your company’s machines. This includes regular planned maintenance, unscheduled maintenance, reconfigurations when required, and damage repairs [a]. You know that failing to conduct maintenance activities can impact system security and availability, so you ensure that maintenance is regularly performed. You track all maintenance performed to assist with troubleshooting later if needed. Potential Assessment Considerations • Are systems, devices, and supporting systems maintained per manufacturer recommendations or company defined schedules [a]?

Supporting controls

NIST 800-171 · Rev 21 mapped

Create a free account or log in to view the cross-referenced controls.

Implementation strategies

10 recommended strategies for this practice.

Create a free account or log in to view the implementation strategies.

Source: DoD CIO · https://dodcio.defense.gov/CMMC/