What this requirement asks
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
This is a CMMC Level 2 requirement in the Maintenance family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (4)
- 3.7.2[a] — tools used to conduct system maintenance are controlled
- 3.7.2[b] — techniques used to conduct system maintenance are controlled
- 3.7.2[c] — mechanisms used to conduct system maintenance are controlled
- 3.7.2[d] — personnel used to conduct system maintenance are controlled
What an assessor examines
Examine:
- System maintenance policy
- procedures addressing system maintenance tools and media
- maintenance records
- system maintenance tools and associated documentation
- maintenance tool inspection records
- system security plan
- other relevant documents or records
Interview:
- Personnel with system maintenance responsibilities
- personnel with information security responsibilities
Test:
- Organizational processes for approving, controlling, and monitoring maintenance tools
- mechanisms supporting or implementing approval, control, and monitoring of maintenance tools
- organizational processes for inspecting maintenance tools
- mechanisms supporting or implementing inspection of maintenance tools
- organizational process for inspecting media for malicious code
- mechanisms supporting or implementing inspection of media used for maintenance
Evidence that defends it
Tool allowlist, approved tool inventory
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.